# Flog Txt Version 1 # Analyzer Version: 2.4.0 # Analyzer Build Date: Jul 24 2018 18:08:56 # Log Creation Date: 22.09.2018 11:15:56.941 Process: id = "1" image_name = "qinynore ransomware.exe" filename = "c:\\users\\eebsym5\\desktop\\qinynore ransomware.exe" page_root = "0x7ea16600" os_pid = "0x96c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe\" " cur_dir = "C:\\Users\\EEBsYm5\\Desktop\\" os_username = "CRH2YWU7\\EEBsYm5" os_groups = "CRH2YWU7\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea01" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 136 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 137 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 138 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 139 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 140 start_va = 0x1350000 end_va = 0x13fffff entry_point = 0x1350000 region_type = mapped_file name = "qinynore ransomware.exe" filename = "\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe" (normalized: "c:\\users\\eebsym5\\desktop\\qinynore ransomware.exe") Region: id = 141 start_va = 0x77230000 end_va = 0x7736bfff entry_point = 0x77230000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 142 start_va = 0x77470000 end_va = 0x77470fff entry_point = 0x77470000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 143 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 144 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 145 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 146 start_va = 0x60000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 147 start_va = 0x6f990000 end_va = 0x6f9d9fff entry_point = 0x6f990000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 148 start_va = 0x75540000 end_va = 0x75589fff entry_point = 0x75540000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 149 start_va = 0x76910000 end_va = 0x769e3fff entry_point = 0x76910000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 150 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 151 start_va = 0x2b0000 end_va = 0x316fff entry_point = 0x2b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 152 start_va = 0x3c0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 153 start_va = 0x4f0000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 154 start_va = 0x75680000 end_va = 0x75720fff entry_point = 0x75680000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 155 start_va = 0x769f0000 end_va = 0x76a8ffff entry_point = 0x769f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 156 start_va = 0x76a90000 end_va = 0x76b3bfff entry_point = 0x76a90000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 157 start_va = 0x773c0000 end_va = 0x773d8fff entry_point = 0x773c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 158 start_va = 0x7f6f0000 end_va = 0x7f7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6f0000" filename = "" Region: id = 159 start_va = 0x600000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 160 start_va = 0x6f910000 end_va = 0x6f987fff entry_point = 0x6f910000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 161 start_va = 0x76480000 end_va = 0x76489fff entry_point = 0x76480000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 162 start_va = 0x76b40000 end_va = 0x76c08fff entry_point = 0x76b40000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 163 start_va = 0x76d70000 end_va = 0x76e0cfff entry_point = 0x76d70000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 164 start_va = 0x76e10000 end_va = 0x76e66fff entry_point = 0x76e10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 165 start_va = 0x773e0000 end_va = 0x7742dfff entry_point = 0x773e0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 166 start_va = 0x400000 end_va = 0x4c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 167 start_va = 0x76490000 end_va = 0x764aefff entry_point = 0x76490000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 168 start_va = 0x76ca0000 end_va = 0x76d6bfff entry_point = 0x76ca0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 169 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 170 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 171 start_va = 0x610000 end_va = 0x710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 172 start_va = 0x720000 end_va = 0x131ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 173 start_va = 0x748d0000 end_va = 0x748d8fff entry_point = 0x748d0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 174 start_va = 0x6c940000 end_va = 0x6cfe7fff entry_point = 0x6c940000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 175 start_va = 0x6e120000 end_va = 0x6e214fff entry_point = 0x6e120000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 176 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 177 start_va = 0x170000 end_va = 0x17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 178 start_va = 0x180000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 179 start_va = 0x190000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 180 start_va = 0x1a0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 181 start_va = 0x320000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 182 start_va = 0x330000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 183 start_va = 0x340000 end_va = 0x340fff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 184 start_va = 0x350000 end_va = 0x350fff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 185 start_va = 0x500000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 186 start_va = 0x1520000 end_va = 0x155ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 187 start_va = 0x16b0000 end_va = 0x16effff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 188 start_va = 0x1810000 end_va = 0x190ffff entry_point = 0x0 region_type = private name = "private_0x0000000001810000" filename = "" Region: id = 189 start_va = 0x1910000 end_va = 0x390ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 190 start_va = 0x3930000 end_va = 0x3a2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003930000" filename = "" Region: id = 191 start_va = 0x3af0000 end_va = 0x3beffff entry_point = 0x0 region_type = private name = "private_0x0000000003af0000" filename = "" Region: id = 192 start_va = 0x3bf0000 end_va = 0x3ebefff entry_point = 0x3bf0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 193 start_va = 0x6b710000 end_va = 0x6c93afff entry_point = 0x6b710000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll") Region: id = 194 start_va = 0x7ffdb000 end_va = 0x7ffdbfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 195 start_va = 0x7ffdc000 end_va = 0x7ffdcfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdc000" filename = "" Region: id = 196 start_va = 0x7ffdd000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdd000" filename = "" Region: id = 197 start_va = 0x76750000 end_va = 0x768abfff entry_point = 0x76750000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 198 start_va = 0x360000 end_va = 0x3bbfff entry_point = 0x360000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 199 start_va = 0x360000 end_va = 0x3bbfff entry_point = 0x360000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 200 start_va = 0x752d0000 end_va = 0x752dbfff entry_point = 0x752d0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 201 start_va = 0x741e0000 end_va = 0x7421ffff entry_point = 0x741e0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 202 start_va = 0x3ec0000 end_va = 0x402ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 203 start_va = 0x1400000 end_va = 0x14defff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001400000" filename = "" Region: id = 204 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 205 start_va = 0x6e0a0000 end_va = 0x6e11cfff entry_point = 0x6e0a0000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 206 start_va = 0x76c10000 end_va = 0x76c9efff entry_point = 0x76c10000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 207 start_va = 0x370000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 208 start_va = 0x6a100000 end_va = 0x6ad57fff entry_point = 0x6a100000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll") Region: id = 209 start_va = 0x6ad60000 end_va = 0x6b70cfff entry_point = 0x6ad60000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll") Region: id = 210 start_va = 0x6df10000 end_va = 0x6e09cfff entry_point = 0x6df10000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll") Region: id = 211 start_va = 0x69c60000 end_va = 0x6a0f7fff entry_point = 0x69c60000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 212 start_va = 0x380000 end_va = 0x381fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 213 start_va = 0x75830000 end_va = 0x76479fff entry_point = 0x75830000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 214 start_va = 0x390000 end_va = 0x390fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 215 start_va = 0x1560000 end_va = 0x15e1fff entry_point = 0x1560000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 216 start_va = 0x1560000 end_va = 0x15e1fff entry_point = 0x1560000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 217 start_va = 0x6e460000 end_va = 0x6e4e3fff entry_point = 0x6e460000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 218 start_va = 0x3a0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 219 start_va = 0x4030000 end_va = 0x41cafff entry_point = 0x4030000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 220 start_va = 0x4030000 end_va = 0x41cafff entry_point = 0x4030000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 221 start_va = 0x74360000 end_va = 0x744fdfff entry_point = 0x74360000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 222 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x3a0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 223 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 224 start_va = 0x4d0000 end_va = 0x4d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 225 start_va = 0x1660000 end_va = 0x169ffff entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 226 start_va = 0x71f40000 end_va = 0x71f52fff entry_point = 0x71f40000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 227 start_va = 0x4030000 end_va = 0x4301fff entry_point = 0x4030000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 228 start_va = 0x5b0000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 229 start_va = 0x74050000 end_va = 0x741dffff entry_point = 0x74050000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 230 start_va = 0x1560000 end_va = 0x163ffff entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 231 start_va = 0x5c0000 end_va = 0x5dafff entry_point = 0x5c0000 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\EEBsYm5\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\eebsym5\\appdata\\local\\gdipfontcachev1.dat") Region: id = 232 start_va = 0x4480000 end_va = 0x457ffff entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 233 start_va = 0x7ffda000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffda000" filename = "" Region: id = 234 start_va = 0x16f0000 end_va = 0x17effff entry_point = 0x0 region_type = private name = "private_0x00000000016f0000" filename = "" Region: id = 235 start_va = 0x1560000 end_va = 0x15defff entry_point = 0x1560000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 236 start_va = 0x1630000 end_va = 0x163ffff entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 237 start_va = 0x1560000 end_va = 0x15defff entry_point = 0x1560000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 238 start_va = 0x1560000 end_va = 0x15d9fff entry_point = 0x1560000 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 239 start_va = 0x1560000 end_va = 0x15d9fff entry_point = 0x1560000 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 240 start_va = 0x1560000 end_va = 0x15befff entry_point = 0x1560000 region_type = mapped_file name = "segoeuii.ttf" filename = "\\Windows\\Fonts\\segoeuii.ttf" (normalized: "c:\\windows\\fonts\\segoeuii.ttf") Region: id = 241 start_va = 0x1560000 end_va = 0x15befff entry_point = 0x1560000 region_type = mapped_file name = "segoeuii.ttf" filename = "\\Windows\\Fonts\\segoeuii.ttf" (normalized: "c:\\windows\\fonts\\segoeuii.ttf") Region: id = 242 start_va = 0x1560000 end_va = 0x15c1fff entry_point = 0x1560000 region_type = mapped_file name = "segoeuiz.ttf" filename = "\\Windows\\Fonts\\segoeuiz.ttf" (normalized: "c:\\windows\\fonts\\segoeuiz.ttf") Region: id = 243 start_va = 0x1560000 end_va = 0x15c1fff entry_point = 0x1560000 region_type = mapped_file name = "segoeuiz.ttf" filename = "\\Windows\\Fonts\\segoeuiz.ttf" (normalized: "c:\\windows\\fonts\\segoeuiz.ttf") Region: id = 244 start_va = 0x1560000 end_va = 0x160afff entry_point = 0x1560000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 245 start_va = 0x1560000 end_va = 0x160afff entry_point = 0x1560000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 246 start_va = 0x4580000 end_va = 0x5a28fff entry_point = 0x4580000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 247 start_va = 0x4580000 end_va = 0x5a28fff entry_point = 0x4580000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 248 start_va = 0x4580000 end_va = 0x5a42fff entry_point = 0x4580000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 249 start_va = 0x4580000 end_va = 0x5a42fff entry_point = 0x4580000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 250 start_va = 0x5a50000 end_va = 0x5c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000005a50000" filename = "" Region: id = 251 start_va = 0x4580000 end_va = 0x49a2fff entry_point = 0x4580000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 252 start_va = 0x4580000 end_va = 0x49a2fff entry_point = 0x4580000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 253 start_va = 0x1560000 end_va = 0x15fffff entry_point = 0x1560000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 254 start_va = 0x1560000 end_va = 0x15fffff entry_point = 0x1560000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 255 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 256 start_va = 0x1560000 end_va = 0x15c1fff entry_point = 0x1560000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 257 start_va = 0x3a30000 end_va = 0x3aaffff entry_point = 0x0 region_type = private name = "private_0x0000000003a30000" filename = "" Region: id = 258 start_va = 0x73d80000 end_va = 0x73e7afff entry_point = 0x73d80000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 259 start_va = 0x4580000 end_va = 0x483cfff entry_point = 0x0 region_type = private name = "private_0x0000000004580000" filename = "" Region: id = 260 start_va = 0x4840000 end_va = 0x4a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004840000" filename = "" Region: id = 261 start_va = 0x4e0000 end_va = 0x4e0fff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 262 start_va = 0x4a60000 end_va = 0x538ffff entry_point = 0x4a60000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 263 start_va = 0x73eb0000 end_va = 0x73ec2fff entry_point = 0x73eb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 264 start_va = 0x5a0000 end_va = 0x5a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 265 start_va = 0x5a0000 end_va = 0x5a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 266 start_va = 0x5c0000 end_va = 0x5c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 267 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x5d0000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\System32\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctf.dll.mui") Region: id = 268 start_va = 0x5e0000 end_va = 0x5e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 269 start_va = 0x3ec0000 end_va = 0x3fbffff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 270 start_va = 0x3ff0000 end_va = 0x402ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ff0000" filename = "" Region: id = 271 start_va = 0x5390000 end_va = 0x5663fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005390000" filename = "" Region: id = 272 start_va = 0x5390000 end_va = 0x5663fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005390000" filename = "" Region: id = 273 start_va = 0x4350000 end_va = 0x444ffff entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 274 start_va = 0x752b0000 end_va = 0x752cafff entry_point = 0x752b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 275 start_va = 0x7ffd9000 end_va = 0x7ffd9fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd9000" filename = "" Region: id = 276 start_va = 0x699e0000 end_va = 0x6a0f5fff entry_point = 0x699e0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll") Region: id = 277 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 278 start_va = 0x75380000 end_va = 0x7538afff entry_point = 0x75380000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 279 start_va = 0x74f80000 end_va = 0x74f96fff entry_point = 0x74f80000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 280 start_va = 0x74e50000 end_va = 0x74e65fff entry_point = 0x74e50000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 281 start_va = 0x14e0000 end_va = 0x151bfff entry_point = 0x14e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 282 start_va = 0x14e0000 end_va = 0x151bfff entry_point = 0x14e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 283 start_va = 0x14e0000 end_va = 0x151bfff entry_point = 0x14e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 284 start_va = 0x14e0000 end_va = 0x151bfff entry_point = 0x14e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 285 start_va = 0x14e0000 end_va = 0x151bfff entry_point = 0x14e0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 286 start_va = 0x74bf0000 end_va = 0x74c2afff entry_point = 0x74bf0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 287 start_va = 0x4920000 end_va = 0x4a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 288 start_va = 0x4a20000 end_va = 0x4a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 289 start_va = 0x7ffd8000 end_va = 0x7ffd8fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 290 start_va = 0x5c50000 end_va = 0x6c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 291 start_va = 0x5670000 end_va = 0x57effff entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 292 start_va = 0x57f0000 end_va = 0x58effff entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 293 start_va = 0x6ce0000 end_va = 0x6ddffff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 294 start_va = 0x7ffd6000 end_va = 0x7ffd6fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd6000" filename = "" Region: id = 295 start_va = 0x7ffd7000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd7000" filename = "" Region: id = 296 start_va = 0x6de0000 end_va = 0x7ddffff entry_point = 0x0 region_type = private name = "private_0x0000000006de0000" filename = "" Region: id = 297 start_va = 0x7de0000 end_va = 0x80cffff entry_point = 0x0 region_type = private name = "private_0x0000000007de0000" filename = "" Region: id = 298 start_va = 0x80d0000 end_va = 0x90cffff entry_point = 0x0 region_type = private name = "private_0x00000000080d0000" filename = "" Region: id = 299 start_va = 0x90d0000 end_va = 0xb0cffff entry_point = 0x0 region_type = private name = "private_0x00000000090d0000" filename = "" Region: id = 300 start_va = 0xb0d0000 end_va = 0xc0cffff entry_point = 0x0 region_type = private name = "private_0x000000000b0d0000" filename = "" Region: id = 301 start_va = 0xc0d0000 end_va = 0xc6affff entry_point = 0x0 region_type = private name = "private_0x000000000c0d0000" filename = "" Region: id = 302 start_va = 0xc6b0000 end_va = 0xd6affff entry_point = 0x0 region_type = private name = "private_0x000000000c6b0000" filename = "" Region: id = 303 start_va = 0xd6b0000 end_va = 0x116affff entry_point = 0x0 region_type = private name = "private_0x000000000d6b0000" filename = "" Region: id = 304 start_va = 0x116b0000 end_va = 0x156affff entry_point = 0x0 region_type = private name = "private_0x00000000116b0000" filename = "" Region: id = 305 start_va = 0x80d0000 end_va = 0xc0cffff entry_point = 0x0 region_type = private name = "private_0x00000000080d0000" filename = "" Region: id = 306 start_va = 0x156b0000 end_va = 0x1c6affff entry_point = 0x0 region_type = private name = "private_0x00000000156b0000" filename = "" Region: id = 307 start_va = 0x5c50000 end_va = 0x680ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 308 start_va = 0x1c6b0000 end_va = 0x206affff entry_point = 0x0 region_type = private name = "private_0x000000001c6b0000" filename = "" Region: id = 309 start_va = 0x6810000 end_va = 0x6a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006810000" filename = "" Region: id = 310 start_va = 0x6a10000 end_va = 0x7a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006a10000" filename = "" Region: id = 311 start_va = 0xc0d0000 end_va = 0xd0cffff entry_point = 0x0 region_type = private name = "private_0x000000000c0d0000" filename = "" Region: id = 312 start_va = 0x206b0000 end_va = 0x216affff entry_point = 0x0 region_type = private name = "private_0x00000000206b0000" filename = "" Region: id = 313 start_va = 0x216b0000 end_va = 0x226affff entry_point = 0x0 region_type = private name = "private_0x00000000216b0000" filename = "" Region: id = 314 start_va = 0x226b0000 end_va = 0x246affff entry_point = 0x0 region_type = private name = "private_0x00000000226b0000" filename = "" Region: id = 315 start_va = 0x246b0000 end_va = 0x256affff entry_point = 0x0 region_type = private name = "private_0x00000000246b0000" filename = "" Region: id = 316 start_va = 0x256b0000 end_va = 0x266affff entry_point = 0x0 region_type = private name = "private_0x00000000256b0000" filename = "" Region: id = 317 start_va = 0x266b0000 end_va = 0x276affff entry_point = 0x0 region_type = private name = "private_0x00000000266b0000" filename = "" Region: id = 318 start_va = 0x276b0000 end_va = 0x286affff entry_point = 0x0 region_type = private name = "private_0x00000000276b0000" filename = "" Region: id = 319 start_va = 0x286b0000 end_va = 0x296affff entry_point = 0x0 region_type = private name = "private_0x00000000286b0000" filename = "" Region: id = 320 start_va = 0x296b0000 end_va = 0x2a6affff entry_point = 0x0 region_type = private name = "private_0x00000000296b0000" filename = "" Region: id = 321 start_va = 0x2a6b0000 end_va = 0x2b6affff entry_point = 0x0 region_type = private name = "private_0x000000002a6b0000" filename = "" Region: id = 322 start_va = 0x2b6b0000 end_va = 0x2ce1ffff entry_point = 0x0 region_type = private name = "private_0x000000002b6b0000" filename = "" Region: id = 323 start_va = 0x2ce20000 end_va = 0x2de1ffff entry_point = 0x0 region_type = private name = "private_0x000000002ce20000" filename = "" Region: id = 324 start_va = 0x2de20000 end_va = 0x2ee1ffff entry_point = 0x0 region_type = private name = "private_0x000000002de20000" filename = "" Region: id = 325 start_va = 0x2ee20000 end_va = 0x2fe1ffff entry_point = 0x0 region_type = private name = "private_0x000000002ee20000" filename = "" Region: id = 326 start_va = 0x6e370000 end_va = 0x6e443fff entry_point = 0x6e370000 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll") Region: id = 327 start_va = 0x68d40000 end_va = 0x6927dfff entry_point = 0x68d40000 region_type = mapped_file name = "mscorlib.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorlib.dll") Region: id = 328 start_va = 0x68800000 end_va = 0x68d3dfff entry_point = 0x68800000 region_type = mapped_file name = "mscorlib.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorlib.dll") Region: id = 329 start_va = 0x4840000 end_va = 0x48fffff entry_point = 0x4840000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 330 start_va = 0x68b60000 end_va = 0x69275fff entry_point = 0x68b60000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\427ed7b1258457fdb8be46e9dd87cbd2\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\427ed7b1258457fdb8be46e9dd87cbd2\\system.xml.ni.dll") Region: id = 331 start_va = 0x686c0000 end_va = 0x68b57fff entry_point = 0x686c0000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 332 start_va = 0x68220000 end_va = 0x686b7fff entry_point = 0x68220000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 333 start_va = 0x68800000 end_va = 0x68b51fff entry_point = 0x68800000 region_type = mapped_file name = "system.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system\\v4.0_4.0.0.0__b77a5c561934e089\\system.dll") Region: id = 334 start_va = 0x684a0000 end_va = 0x687f1fff entry_point = 0x684a0000 region_type = mapped_file name = "system.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system\\v4.0_4.0.0.0__b77a5c561934e089\\system.dll") Region: id = 335 start_va = 0x6e2e0000 end_va = 0x6e36ffff entry_point = 0x6e2e0000 region_type = mapped_file name = "system.drawing.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll") Region: id = 336 start_va = 0x6e250000 end_va = 0x6e2dffff entry_point = 0x6e250000 region_type = mapped_file name = "system.drawing.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll") Region: id = 337 start_va = 0x6e220000 end_va = 0x6e361fff entry_point = 0x6e220000 region_type = mapped_file name = "system.core.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.core\\v4.0_4.0.0.0__b77a5c561934e089\\system.core.dll") Region: id = 338 start_va = 0x68a10000 end_va = 0x68b51fff entry_point = 0x68a10000 region_type = mapped_file name = "system.core.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.core\\v4.0_4.0.0.0__b77a5c561934e089\\system.core.dll") Region: id = 339 start_va = 0x5c50000 end_va = 0x6042fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c50000" filename = "" Region: id = 340 start_va = 0x500000 end_va = 0x501fff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 341 start_va = 0x500000 end_va = 0x503fff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 342 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 343 start_va = 0x520000 end_va = 0x53cfff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 344 start_va = 0x500000 end_va = 0x506fff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 345 start_va = 0x520000 end_va = 0x520fff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 346 start_va = 0x75780000 end_va = 0x75802fff entry_point = 0x75780000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 347 start_va = 0x530000 end_va = 0x530fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Thread: id = 1 os_tid = 0x970 [0026.861] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0028.239] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ae7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0028.253] IsAppThemed () returned 0x1 [0028.256] CoTaskMemAlloc (cb=0xf0) returned 0xb3050 [0028.256] CreateActCtxA (pActCtx=0x2aece8) returned 0xb3664 [0028.323] CoTaskMemFree (pv=0xb3050) [0028.332] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13a [0028.332] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc13c [0029.505] CoTaskMemAlloc (cb=0x20c) returned 0xd2138 [0029.505] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xd2138 | out: pszPath="C:\\Users\\EEBsYm5\\AppData\\Roaming") returned 0x0 [0029.507] CoTaskMemFree (pv=0xd2138) [0029.507] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2ae7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0029.510] GetComputerNameW (in: lpBuffer=0x2aeb10, nSize=0x2aed88 | out: lpBuffer="CRH2YWU7", nSize=0x2aed88) returned 1 [0029.519] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0029.859] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6e460000 [0029.868] AdjustWindowRectEx (in: lpRect=0x2aed28, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2aed28) returned 1 [0029.869] GetCurrentProcess () returned 0xffffffff [0029.869] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x2aec40, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2aec40*=0x1e8) returned 1 [0029.881] GetCurrentActCtx (in: lphActCtx=0x2aeba0 | out: lphActCtx=0x2aeba0*=0x0) returned 1 [0029.881] ActivateActCtx (in: hActCtx=0xb3664, lpCookie=0x2aebb0 | out: hActCtx=0xb3664, lpCookie=0x2aebb0) returned 1 [0029.881] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0030.265] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x74360000 [0030.271] GetModuleHandleW (lpModuleName="user32.dll") returned 0x76b40000 [0030.272] GetProcAddress (hModule=0x76b40000, lpProcName="DefWindowProcW") returned 0x76b5507d [0030.272] GetStockObject (i=5) returned 0x1900015 [0030.275] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0030.277] CoTaskMemAlloc (cb=0x5c) returned 0xbf708 [0030.277] RegisterClassW (lpWndClass=0x2aea58) returned 0xc13b [0030.278] CoTaskMemFree (pv=0xbf708) [0030.278] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0030.278] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x50144 [0030.278] SetWindowLongW (hWnd=0x50144, nIndex=-4, dwNewLong=1991594109) returned 23463910 [0030.279] GetWindowLongW (hWnd=0x50144, nIndex=-4) returned 1991594109 [0030.325] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ae38c | out: phkResult=0x2ae38c*=0x204) returned 0x0 [0030.326] RegQueryValueExW (in: hKey=0x204, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x2ae3ac, lpData=0x0, lpcbData=0x2ae3a8*=0x0 | out: lpType=0x2ae3ac*=0x0, lpData=0x0, lpcbData=0x2ae3a8*=0x0) returned 0x2 [0030.326] RegQueryValueExW (in: hKey=0x204, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x2ae3ac, lpData=0x0, lpcbData=0x2ae3a8*=0x0 | out: lpType=0x2ae3ac*=0x0, lpData=0x0, lpcbData=0x2ae3a8*=0x0) returned 0x2 [0030.326] RegCloseKey (hKey=0x204) returned 0x0 [0030.327] SetWindowLongW (hWnd=0x50144, nIndex=-4, dwNewLong=23463950) returned 1991594109 [0030.327] GetWindowLongW (hWnd=0x50144, nIndex=-4) returned 23463950 [0030.328] GetWindowLongW (hWnd=0x50144, nIndex=-16) returned 113311744 [0030.328] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc106 [0030.329] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc138 [0030.329] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x50144, Msg=0x81, wParam=0x0, lParam=0x2ae5e8) returned 0x1 [0030.329] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x50144, Msg=0x83, wParam=0x0, lParam=0x2ae670) returned 0x0 [0030.329] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x50144, Msg=0x1, wParam=0x0, lParam=0x2ae5e8) returned 0x0 [0030.329] GetClientRect (in: hWnd=0x50144, lpRect=0x2ae364 | out: lpRect=0x2ae364) returned 1 [0030.329] GetWindowRect (in: hWnd=0x50144, lpRect=0x2ae364 | out: lpRect=0x2ae364) returned 1 [0030.330] GetParent (hWnd=0x50144) returned 0x0 [0030.330] DeactivateActCtx (dwFlags=0x0, ulCookie=0x115f0001) returned 1 [0030.404] EtwEventRegister (in: ProviderId=0x1919394, EnableCallback=0x1660836, CallbackContext=0x0, RegHandle=0x1919370 | out: RegHandle=0x1919370) returned 0x0 [0030.411] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.411] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.412] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.412] AdjustWindowRectEx (in: lpRect=0x2aea70, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2aea70) returned 1 [0030.428] GdiplusStartup (in: token=0x1a5e78, input=0x2adf60, output=0x2adfb0 | out: token=0x1a5e78, output=0x2adfb0) returned 0x0 [0030.432] GdipCreateFontFamilyFromName (name="Segoe UI", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.446] GdipCreateFont (fontFamily=0x170cdf0, emSize=0x41ae0000, style=1, unit=0x3, font=0x191a308) returned 0x0 [0030.480] GdipGetFontSize (font=0x163fe98, size=0x191a30c) returned 0x0 [0030.525] GetSystemDefaultLCID () returned 0x409 [0030.526] GetStockObject (i=17) returned 0x18a0025 [0030.528] GetObjectW (in: h=0x18a0025, c=92, pv=0x2ae8f4 | out: pv=0x2ae8f4) returned 92 [0030.529] GetDC (hWnd=0x0) returned 0x3010800 [0030.531] CoTaskMemAlloc (cb=0x5c) returned 0xbf708 [0030.531] GdipCreateFontFromLogfontW (hdc=0x3010800, logfont=0xbf708, font=0x2ae9bc) returned 0x0 [0030.606] CoTaskMemFree (pv=0xbf708) [0030.606] CoTaskMemAlloc (cb=0x5c) returned 0xbf708 [0030.606] CoTaskMemFree (pv=0xbf708) [0030.607] CoTaskMemAlloc (cb=0x5c) returned 0xbf708 [0030.607] CoTaskMemFree (pv=0xbf708) [0030.607] GdipGetFontUnit (font=0x1710040, unit=0x2ae988) returned 0x0 [0030.607] GdipGetFontSize (font=0x1710040, size=0x2ae98c) returned 0x0 [0030.607] GdipGetFontStyle (font=0x1710040, style=0x2ae984) returned 0x0 [0030.607] GdipGetFamily (font=0x1710040, family=0x2ae980) returned 0x0 [0030.607] GdipGetFontSize (font=0x1710040, size=0x191a958) returned 0x0 [0030.607] ReleaseDC (hWnd=0x0, hDC=0x3010800) returned 1 [0030.608] GetDC (hWnd=0x0) returned 0x3010800 [0030.608] GdipCreateFromHDC (hdc=0x3010800, graphics=0x2ae9a8) returned 0x0 [0030.609] GdipGetDpiY (graphics=0x17d19a0, dpi=0x191aa60) returned 0x0 [0030.609] GdipGetFontHeight (font=0x1710040, graphics=0x17d19a0, height=0x2ae9a0) returned 0x0 [0030.609] GdipGetEmHeight (family=0x163f690, style=0, EmHeight=0x2ae9a8) returned 0x0 [0030.609] GdipGetLineSpacing (family=0x163f690, style=0, LineSpacing=0x2ae9a8) returned 0x0 [0030.609] GdipDeleteGraphics (graphics=0x17d19a0) returned 0x0 [0030.610] ReleaseDC (hWnd=0x0, hDC=0x3010800) returned 1 [0030.610] GdipCreateFont (fontFamily=0x163f690, emSize=0x41040000, style=0, unit=0x3, font=0x191aa20) returned 0x0 [0030.610] GdipGetFontSize (font=0x5a95f10, size=0x191aa24) returned 0x0 [0030.610] GdipDeleteFont (font=0x1710040) returned 0x0 [0030.614] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.614] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.632] GetUserObjectInformationA (in: hObj=0x40, nIndex=1, pvInfo=0x191b1a0, nLength=0xc, lpnLengthNeeded=0x2ae8ac | out: pvInfo=0x191b1a0, lpnLengthNeeded=0x2ae8ac) returned 1 [0030.634] SetConsoleCtrlHandler (HandlerRoutine=0x166085e, Add=1) returned 1 [0030.635] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0030.635] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0030.636] GetClassInfoW (in: hInstance=0x1350000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x191b204 | out: lpWndClass=0x191b204) returned 0 [0030.637] CoTaskMemAlloc (cb=0x58) returned 0x9f9e0 [0030.637] RegisterClassW (lpWndClass=0x2ae7fc) returned 0xc136 [0030.638] CoTaskMemFree (pv=0x9f9e0) [0030.638] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x60138 [0030.639] DefWindowProcW (hWnd=0x60138, Msg=0x83, wParam=0x0, lParam=0x2ae3e8) returned 0x0 [0030.639] DefWindowProcW (hWnd=0x60138, Msg=0x1, wParam=0x0, lParam=0x2ae304) returned 0x0 [0030.639] DefWindowProcW (hWnd=0x60138, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0030.639] DefWindowProcW (hWnd=0x60138, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0030.643] GetSysColor (nIndex=10) returned 0xb4b4b4 [0030.643] GetSysColor (nIndex=2) returned 0xd1b499 [0030.643] GetSysColor (nIndex=9) returned 0x0 [0030.643] GetSysColor (nIndex=12) returned 0xababab [0030.643] GetSysColor (nIndex=15) returned 0xf0f0f0 [0030.643] GetSysColor (nIndex=20) returned 0xffffff [0030.643] GetSysColor (nIndex=16) returned 0xa0a0a0 [0030.643] GetSysColor (nIndex=15) returned 0xf0f0f0 [0030.643] GetSysColor (nIndex=16) returned 0xa0a0a0 [0030.643] GetSysColor (nIndex=21) returned 0x696969 [0030.643] GetSysColor (nIndex=22) returned 0xe3e3e3 [0030.643] GetSysColor (nIndex=20) returned 0xffffff [0030.643] GetSysColor (nIndex=18) returned 0x0 [0030.643] GetSysColor (nIndex=1) returned 0x0 [0030.643] GetSysColor (nIndex=27) returned 0xead1b9 [0030.643] GetSysColor (nIndex=28) returned 0xf2e4d7 [0030.643] GetSysColor (nIndex=17) returned 0x6d6d6d [0030.643] GetSysColor (nIndex=13) returned 0xff9933 [0030.643] GetSysColor (nIndex=14) returned 0xffffff [0030.643] GetSysColor (nIndex=26) returned 0xcc6600 [0030.643] GetSysColor (nIndex=11) returned 0xfcf7f4 [0030.643] GetSysColor (nIndex=3) returned 0xdbcdbf [0030.643] GetSysColor (nIndex=19) returned 0x544e43 [0030.644] GetSysColor (nIndex=24) returned 0xe1ffff [0030.644] GetSysColor (nIndex=23) returned 0x0 [0030.644] GetSysColor (nIndex=4) returned 0xf0f0f0 [0030.644] GetSysColor (nIndex=30) returned 0xf0f0f0 [0030.644] GetSysColor (nIndex=29) returned 0xff9933 [0030.644] GetSysColor (nIndex=7) returned 0x0 [0030.644] GetSysColor (nIndex=0) returned 0xc8c8c8 [0030.644] GetSysColor (nIndex=5) returned 0xffffff [0030.644] GetSysColor (nIndex=6) returned 0x646464 [0030.644] GetSysColor (nIndex=8) returned 0x0 [0030.644] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.644] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.644] GdipCreateFontFamilyFromName (name="Segoe UI", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.644] GdipCreateFont (fontFamily=0x170cdf0, emSize=0x41ae0000, style=1, unit=0x3, font=0x191b73c) returned 0x0 [0030.644] GdipGetFontSize (font=0x1710040, size=0x191b740) returned 0x0 [0030.644] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.644] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.645] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.645] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.645] GdipCreateFontFamilyFromName (name="Segoe UI", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.645] GdipCreateFont (fontFamily=0x170cdf0, emSize=0x41ae0000, style=1, unit=0x3, font=0x191b954) returned 0x0 [0030.645] GdipGetFontSize (font=0x5a95f38, size=0x191b958) returned 0x0 [0030.645] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.645] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.645] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.645] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.645] GdipCreateFontFamilyFromName (name="Segoe UI", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.645] GdipCreateFont (fontFamily=0x170cdf0, emSize=0x41ae0000, style=1, unit=0x3, font=0x191bb6c) returned 0x0 [0030.645] GdipGetFontSize (font=0x5a95f60, size=0x191bb70) returned 0x0 [0030.645] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.645] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.645] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.645] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.645] GdipCreateFontFamilyFromName (name="Segoe UI", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.645] GdipCreateFont (fontFamily=0x170cdf0, emSize=0x41ae0000, style=1, unit=0x3, font=0x191bd84) returned 0x0 [0030.646] GdipGetFontSize (font=0x5a95f88, size=0x191bd88) returned 0x0 [0030.646] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.646] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.646] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.646] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.646] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.646] GdipCreateFont (fontFamily=0x163f690, emSize=0x41d20000, style=3, unit=0x3, font=0x191bfd0) returned 0x0 [0030.646] GdipGetFontSize (font=0x5a95fb0, size=0x191bfd4) returned 0x0 [0030.647] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.647] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.647] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.647] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.647] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.648] GdipCreateFont (fontFamily=0x163f690, emSize=0x41d20000, style=3, unit=0x3, font=0x191c22c) returned 0x0 [0030.648] GdipGetFontSize (font=0x17544e8, size=0x191c230) returned 0x0 [0030.648] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.648] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.648] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.648] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.648] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x2aea4c) returned 0x0 [0030.648] GdipCreateFont (fontFamily=0x163f690, emSize=0x417c0000, style=0, unit=0x3, font=0x191c444) returned 0x0 [0030.648] GdipGetFontSize (font=0x1754510, size=0x191c448) returned 0x0 [0030.648] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.648] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.648] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0030.648] AdjustWindowRectEx (in: lpRect=0x2ae9d0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae9d0) returned 1 [0030.654] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", nBufferLength=0x105, lpBuffer=0x2ae340, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", lpFilePart=0x0) returned 0x37 [0030.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae7d4) returned 1 [0030.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config" (normalized: "c:\\users\\eebsym5\\desktop\\qinynore ransomware.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2ae850 | out: lpFileInformation=0x2ae850*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0030.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae7d0) returned 1 [0031.111] GdipLoadImageFromStream (stream=0x3a0030, image=0x2ae4d0) returned 0x0 [0031.232] GdipImageForceValidation (image=0x17d19a0) returned 0x0 [0031.272] GdipGetImageType (image=0x17d19a0, type=0x2ae4cc) returned 0x0 [0031.273] GdipGetImageRawFormat (image=0x17d19a0, format=0x2ae450*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0031.277] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.277] AdjustWindowRectEx (in: lpRect=0x2aea30, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2aea30) returned 1 [0031.277] GetSystemMetrics (nIndex=59) returned 1460 [0031.278] GetSystemMetrics (nIndex=60) returned 920 [0031.278] GetSystemMetrics (nIndex=34) returned 132 [0031.278] GetSystemMetrics (nIndex=35) returned 38 [0031.278] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.278] AdjustWindowRectEx (in: lpRect=0x2ae930, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ae930) returned 1 [0031.279] GetCurrentThreadId () returned 0x970 [0031.279] GetCurrentThreadId () returned 0x970 [0031.279] GetCurrentThreadId () returned 0x970 [0031.279] GetCurrentThreadId () returned 0x970 [0031.280] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.280] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.281] GdipGetFamilyName (in: family=0x163f690, name=0x2ae7f8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0031.282] CreateCompatibleDC (hdc=0x0) returned 0x21010238 [0031.282] GetCurrentObject (hdc=0x21010238, type=0x1) returned 0x1b00017 [0031.282] GetCurrentObject (hdc=0x21010238, type=0x2) returned 0x1900010 [0031.282] GetCurrentObject (hdc=0x21010238, type=0x7) returned 0x185000f [0031.282] GetCurrentObject (hdc=0x21010238, type=0x6) returned 0x18a002e [0031.284] SaveDC (hdc=0x21010238) returned 1 [0031.284] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.286] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.286] CreateFontIndirectW (lplf=0xbf770) returned 0x1e0a01ba [0031.286] CoTaskMemFree (pv=0xbf770) [0031.286] GetObjectW (in: h=0x1e0a01ba, c=92, pv=0x2ae7d0 | out: pv=0x2ae7d0) returned 92 [0031.291] GetCurrentObject (hdc=0x21010238, type=0x6) returned 0x18a002e [0031.291] GetObjectW (in: h=0x18a002e, c=92, pv=0x2ae7b8 | out: pv=0x2ae7b8) returned 92 [0031.292] SelectObject (hdc=0x21010238, h=0x1e0a01ba) returned 0x18a002e [0031.292] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x1931f2c | out: psizl=0x1931f2c) returned 1 [0031.299] GetCurrentThreadId () returned 0x970 [0031.299] GetCurrentThreadId () returned 0x970 [0031.299] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.299] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.302] GdipGetFamilyName (in: family=0x163f690, name=0x2ae71c, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0031.303] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.303] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.303] CreateFontIndirectW (lplf=0xbf770) returned 0x600a0230 [0031.303] CoTaskMemFree (pv=0xbf770) [0031.303] GetObjectW (in: h=0x600a0230, c=92, pv=0x2ae6f4 | out: pv=0x2ae6f4) returned 92 [0031.304] GetMapMode (hdc=0x21010238) returned 1 [0031.304] GetTextMetricsW (in: hdc=0x21010238, lptm=0x2ae700 | out: lptm=0x2ae700) returned 1 [0031.305] DrawTextExW (in: hdc=0x21010238, lpchText="5", cchText=1, lprc=0x2ae814, format=0x2400, lpdtp=0x1932324 | out: lpchText="5", lprc=0x2ae814) returned 39 [0031.320] GetCurrentThreadId () returned 0x970 [0031.320] GetCurrentThreadId () returned 0x970 [0031.320] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.320] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.320] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae7f8, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.320] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.320] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.320] CreateFontIndirectW (lplf=0xbf770) returned 0x450a0272 [0031.320] CoTaskMemFree (pv=0xbf770) [0031.320] GetObjectW (in: h=0x450a0272, c=92, pv=0x2ae7d0 | out: pv=0x2ae7d0) returned 92 [0031.320] SelectObject (hdc=0x21010238, h=0x450a0272) returned 0x1e0a01ba [0031.322] DeleteObject (ho=0x1e0a01ba) returned 1 [0031.322] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x1932570 | out: psizl=0x1932570) returned 1 [0031.323] GetCurrentThreadId () returned 0x970 [0031.323] GetCurrentThreadId () returned 0x970 [0031.323] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.323] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.323] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae7f8, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.324] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.324] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.324] CreateFontIndirectW (lplf=0xbf770) returned 0x1f0a01ba [0031.324] CoTaskMemFree (pv=0xbf770) [0031.324] GetObjectW (in: h=0x1f0a01ba, c=92, pv=0x2ae7d0 | out: pv=0x2ae7d0) returned 92 [0031.324] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x19327e4 | out: psizl=0x19327e4) returned 1 [0031.324] DeleteObject (ho=0x1f0a01ba) returned 1 [0031.324] GetCurrentThreadId () returned 0x970 [0031.324] GetCurrentThreadId () returned 0x970 [0031.324] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.324] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.324] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae7f8, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.324] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.324] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.324] CreateFontIndirectW (lplf=0xbf770) returned 0x200a01ba [0031.324] CoTaskMemFree (pv=0xbf770) [0031.324] GetObjectW (in: h=0x200a01ba, c=92, pv=0x2ae7d0 | out: pv=0x2ae7d0) returned 92 [0031.325] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x1932a2c | out: psizl=0x1932a2c) returned 1 [0031.325] DeleteObject (ho=0x200a01ba) returned 1 [0031.325] GetCurrentThreadId () returned 0x970 [0031.325] GetCurrentThreadId () returned 0x970 [0031.325] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.325] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.325] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae7f8, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.325] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.325] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.325] CreateFontIndirectW (lplf=0xbf770) returned 0x210a01ba [0031.325] CoTaskMemFree (pv=0xbf770) [0031.325] GetObjectW (in: h=0x210a01ba, c=92, pv=0x2ae7d0 | out: pv=0x2ae7d0) returned 92 [0031.325] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x1932c74 | out: psizl=0x1932c74) returned 1 [0031.325] DeleteObject (ho=0x210a01ba) returned 1 [0031.325] GetCurrentThreadId () returned 0x970 [0031.325] GetCurrentThreadId () returned 0x970 [0031.325] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.325] AdjustWindowRectEx (in: lpRect=0x2ae82c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae82c) returned 1 [0031.325] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae7f8, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.326] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.326] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.326] CreateFontIndirectW (lplf=0xbf770) returned 0x220a01ba [0031.326] CoTaskMemFree (pv=0xbf770) [0031.326] GetObjectW (in: h=0x220a01ba, c=92, pv=0x2ae7d0 | out: pv=0x2ae7d0) returned 92 [0031.326] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x1932ebc | out: psizl=0x1932ebc) returned 1 [0031.326] DeleteObject (ho=0x220a01ba) returned 1 [0031.367] GetSystemMetrics (nIndex=11) returned 32 [0031.367] GetSystemMetrics (nIndex=12) returned 32 [0031.367] GetDC (hWnd=0x0) returned 0x3010800 [0031.367] GetDeviceCaps (hdc=0x3010800, index=12) returned 32 [0031.367] GetDeviceCaps (hdc=0x3010800, index=14) returned 1 [0031.367] ReleaseDC (hWnd=0x0, hDC=0x3010800) returned 1 [0031.368] CreateIconFromResourceEx (presbits=0x1938ee0, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x60163 [0031.369] CreateCompatibleDC (hdc=0x0) returned 0xd0107f3 [0031.369] GetDC (hWnd=0x0) returned 0x3010800 [0031.369] GdipCreateFromHDC (hdc=0x3010800, graphics=0x2ae86c) returned 0x0 [0031.369] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.369] GdipGetLogFontW (font=0x5a95f10, graphics=0x1755128, logfontW=0xbf770) returned 0x0 [0031.369] CoTaskMemFree (pv=0xbf770) [0031.369] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.369] CoTaskMemFree (pv=0xbf770) [0031.370] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.370] CoTaskMemFree (pv=0xbf770) [0031.370] GdipDeleteGraphics (graphics=0x1755128) returned 0x0 [0031.370] ReleaseDC (hWnd=0x0, hDC=0x3010800) returned 1 [0031.370] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.370] CreateFontIndirectW (lplf=0xbf770) returned 0x130a0726 [0031.370] CoTaskMemFree (pv=0xbf770) [0031.370] SelectObject (hdc=0xd0107f3, h=0x130a0726) returned 0x18a002e [0031.371] GetTextMetricsW (in: hdc=0xd0107f3, lptm=0x2ae978 | out: lptm=0x2ae978) returned 1 [0031.371] GetTextExtentPoint32W (in: hdc=0xd0107f3, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x193a480 | out: psizl=0x193a480) returned 1 [0031.371] SelectObject (hdc=0xd0107f3, h=0x18a002e) returned 0x130a0726 [0031.371] DeleteDC (hdc=0xd0107f3) returned 1 [0031.371] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.371] AdjustWindowRectEx (in: lpRect=0x2ae6e4, dwStyle=0x2c70000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ae6e4) returned 1 [0031.371] AdjustWindowRectEx (in: lpRect=0x2ae904, dwStyle=0x2c70000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ae904) returned 1 [0031.372] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae65c, dwStyle=0x2c70000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ae65c) returned 1 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae73c, dwStyle=0x2c70000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ae73c) returned 1 [0031.372] GetSystemMetrics (nIndex=34) returned 132 [0031.372] GetSystemMetrics (nIndex=35) returned 38 [0031.372] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.372] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.372] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.372] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.372] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.372] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.372] GdipGetFamilyName (in: family=0x163f690, name=0x2ae588, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0031.373] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.373] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.373] CreateFontIndirectW (lplf=0xbf770) returned 0xe0a07f3 [0031.373] CoTaskMemFree (pv=0xbf770) [0031.373] GetObjectW (in: h=0xe0a07f3, c=92, pv=0x2ae560 | out: pv=0x2ae560) returned 92 [0031.373] SelectObject (hdc=0x21010238, h=0xe0a07f3) returned 0x450a0272 [0031.373] DeleteObject (ho=0x450a0272) returned 1 [0031.373] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x193a6b8 | out: psizl=0x193a6b8) returned 1 [0031.373] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.373] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.373] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.373] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.373] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.374] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.374] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.374] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.374] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.374] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.374] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.374] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.374] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae588, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.374] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.374] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.374] CreateFontIndirectW (lplf=0xbf770) returned 0x460a0272 [0031.374] CoTaskMemFree (pv=0xbf770) [0031.374] GetObjectW (in: h=0x460a0272, c=92, pv=0x2ae560 | out: pv=0x2ae560) returned 92 [0031.374] SelectObject (hdc=0x21010238, h=0x460a0272) returned 0xe0a07f3 [0031.374] DeleteObject (ho=0xe0a07f3) returned 1 [0031.374] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x193a880 | out: psizl=0x193a880) returned 1 [0031.375] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.375] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.375] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.375] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.375] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.375] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.375] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae588, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.375] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.375] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.375] CreateFontIndirectW (lplf=0xbf770) returned 0xf0a07f3 [0031.375] CoTaskMemFree (pv=0xbf770) [0031.375] GetObjectW (in: h=0xf0a07f3, c=92, pv=0x2ae560 | out: pv=0x2ae560) returned 92 [0031.375] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x193aa28 | out: psizl=0x193aa28) returned 1 [0031.375] DeleteObject (ho=0xf0a07f3) returned 1 [0031.375] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.376] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.376] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.376] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.376] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.376] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.376] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae588, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.376] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.376] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.376] CreateFontIndirectW (lplf=0xbf770) returned 0x100a07f3 [0031.376] CoTaskMemFree (pv=0xbf770) [0031.376] GetObjectW (in: h=0x100a07f3, c=92, pv=0x2ae560 | out: pv=0x2ae560) returned 92 [0031.376] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x193abd0 | out: psizl=0x193abd0) returned 1 [0031.376] DeleteObject (ho=0x100a07f3) returned 1 [0031.376] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.376] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.376] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.376] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.377] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.377] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.377] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae588, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.377] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.377] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.377] CreateFontIndirectW (lplf=0xbf770) returned 0x110a07f3 [0031.377] CoTaskMemFree (pv=0xbf770) [0031.377] GetObjectW (in: h=0x110a07f3, c=92, pv=0x2ae560 | out: pv=0x2ae560) returned 92 [0031.377] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x193ad78 | out: psizl=0x193ad78) returned 1 [0031.377] DeleteObject (ho=0x110a07f3) returned 1 [0031.377] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.377] AdjustWindowRectEx (in: lpRect=0x2ae8fc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae8fc) returned 1 [0031.377] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.377] AdjustWindowRectEx (in: lpRect=0x2ae760, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae760) returned 1 [0031.378] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6e460000 [0031.378] AdjustWindowRectEx (in: lpRect=0x2ae5bc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae5bc) returned 1 [0031.378] GdipGetFamilyName (in: family=0x170cdf0, name=0x2ae588, language=0x409 | out: name="Segoe UI") returned 0x0 [0031.378] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0031.378] CoTaskMemAlloc (cb=0x5c) returned 0xbf770 [0031.378] CreateFontIndirectW (lplf=0xbf770) returned 0x120a07f3 [0031.378] CoTaskMemFree (pv=0xbf770) [0031.378] GetObjectW (in: h=0x120a07f3, c=92, pv=0x2ae560 | out: pv=0x2ae560) returned 92 [0031.378] GetTextExtentPoint32W (in: hdc=0x21010238, lpString="0", c=1, psizl=0x193af20 | out: psizl=0x193af20) returned 1 [0031.378] DeleteObject (ho=0x120a07f3) returned 1 [0031.378] GetCurrentActCtx (in: lphActCtx=0x2aed5c | out: lphActCtx=0x2aed5c*=0x0) returned 1 [0031.378] ActivateActCtx (in: hActCtx=0xb3664, lpCookie=0x2aed6c | out: hActCtx=0xb3664, lpCookie=0x2aed6c) returned 1 [0031.379] GetCurrentActCtx (in: lphActCtx=0x2aeb7c | out: lphActCtx=0x2aeb7c*=0xb3664) returned 1 [0031.379] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.379] AdjustWindowRectEx (in: lpRect=0x2aeae0, dwStyle=0x2c70000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2aeae0) returned 1 [0031.379] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.379] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Qinynore Ransomware", dwStyle=0x2c70000, X=-2147483648, Y=-2147483648, nWidth=1070, nHeight=692, hWndParent=0x0, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x30194 [0031.379] SetWindowLongW (hWnd=0x30194, nIndex=-4, dwNewLong=1991594109) returned 23463910 [0031.379] GetWindowLongW (hWnd=0x30194, nIndex=-4) returned 1991594109 [0031.379] SetWindowLongW (hWnd=0x30194, nIndex=-4, dwNewLong=23464798) returned 1991594109 [0031.379] GetWindowLongW (hWnd=0x30194, nIndex=-4) returned 23464798 [0031.379] GetWindowLongW (hWnd=0x30194, nIndex=-16) returned 113704960 [0031.379] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x81, wParam=0x0, lParam=0x2ae5c4) returned 0x1 [0031.379] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x83, wParam=0x0, lParam=0x2ae64c) returned 0x0 [0031.469] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x1, wParam=0x0, lParam=0x2ae594) returned 0x0 [0031.469] GetClientRect (in: hWnd=0x30194, lpRect=0x2ae2e0 | out: lpRect=0x2ae2e0) returned 1 [0031.469] GetWindowRect (in: hWnd=0x30194, lpRect=0x2ae2e0 | out: lpRect=0x2ae2e0) returned 1 [0031.470] SetWindowTextW (hWnd=0x30194, lpString="Qinynore Ransomware") returned 1 [0031.470] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xc, wParam=0x0, lParam=0x1918fa4) returned 0x1 [0031.470] GetStartupInfoW (in: lpStartupInfo=0x193b1d8 | out: lpStartupInfo=0x193b1d8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0031.471] GetParent (hWnd=0x30194) returned 0x0 [0031.471] SetWindowLongW (hWnd=0x30194, nIndex=-8, dwNewLong=0) returned 0 [0031.471] GetSystemMetrics (nIndex=49) returned 16 [0031.471] GetSystemMetrics (nIndex=50) returned 16 [0031.471] CreateIconFromResourceEx (presbits=0x193b258, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x30199 [0031.471] SendMessageW (hWnd=0x30194, Msg=0x80, wParam=0x0, lParam=0x30199) returned 0x0 [0031.471] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x80, wParam=0x0, lParam=0x30199) returned 0x0 [0031.472] SendMessageW (hWnd=0x30194, Msg=0x80, wParam=0x1, lParam=0x60163) returned 0x0 [0031.472] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x80, wParam=0x1, lParam=0x60163) returned 0x0 [0031.476] GetSystemMenu (hWnd=0x30194, bRevert=0) returned 0x0 [0031.476] GetWindowPlacement (in: hWnd=0x30194, lpwndpl=0x2aeb8c | out: lpwndpl=0x2aeb8c) returned 1 [0031.476] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0031.476] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0031.477] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0031.477] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0031.477] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0031.477] GetClientRect (in: hWnd=0x30194, lpRect=0x2aebd0 | out: lpRect=0x2aebd0) returned 1 [0031.477] GetClientRect (in: hWnd=0x30194, lpRect=0x2aeb30 | out: lpRect=0x2aeb30) returned 1 [0031.477] GetWindowRect (in: hWnd=0x30194, lpRect=0x2aeb30 | out: lpRect=0x2aeb30) returned 1 [0031.477] SetWindowPos (hWnd=0x30194, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.477] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x46, wParam=0x0, lParam=0x2aeb4c) returned 0x0 [0031.477] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x46, wParam=0x0, lParam=0x2aeb4c) returned 0x0 [0031.478] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0031.478] DefWindowProcW (hWnd=0x60138, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0031.478] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0031.480] OleInitialize (pvReserved=0x0) returned 0x0 [0031.480] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x2ae924 | out: lplpMessageFilter=0x2ae924*=0x0) returned 0x0 [0031.494] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0031.495] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0031.495] GetParent (hWnd=0x30194) returned 0x0 [0031.495] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0031.495] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0031.495] GetWindowPlacement (in: hWnd=0x30194, lpwndpl=0x2ae914 | out: lpwndpl=0x2ae914) returned 1 [0031.495] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x47, wParam=0x0, lParam=0x2aeb4c) returned 0x0 [0031.495] GetClientRect (in: hWnd=0x30194, lpRect=0x2ae8c4 | out: lpRect=0x2ae8c4) returned 1 [0031.495] GetWindowRect (in: hWnd=0x30194, lpRect=0x2ae8c4 | out: lpRect=0x2ae8c4) returned 1 [0031.496] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x83, wParam=0x1, lParam=0x2ae748) returned 0x0 [0031.502] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.502] GetWindowLongW (hWnd=0x30194, nIndex=-16) returned 113704960 [0031.502] GetWindowTextLengthW (hWnd=0x30194) returned 19 [0031.502] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.502] GetSystemMetrics (nIndex=42) returned 0 [0031.502] GetWindowTextW (in: hWnd=0x30194, lpString=0x2aeab8, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.502] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xd, wParam=0x14, lParam=0x2aeab8) returned 0x13 [0031.503] GetWindowTextLengthW (hWnd=0x30194) returned 19 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.503] GetSystemMetrics (nIndex=42) returned 0 [0031.503] GetWindowTextW (in: hWnd=0x30194, lpString=0x2aeab8, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xd, wParam=0x14, lParam=0x2aeab8) returned 0x13 [0031.503] GetWindowLongW (hWnd=0x30194, nIndex=-16) returned 113704960 [0031.503] GetWindowLongW (hWnd=0x30194, nIndex=-20) returned 327944 [0031.503] SetWindowLongW (hWnd=0x30194, nIndex=-16, dwNewLong=46596096) returned 113704960 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7c, wParam=0xfffffff0, lParam=0x2aeb2c) returned 0x0 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7d, wParam=0xfffffff0, lParam=0x2aeb2c) returned 0x0 [0031.503] SetWindowLongW (hWnd=0x30194, nIndex=-20, dwNewLong=327680) returned 327944 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7c, wParam=0xffffffec, lParam=0x2aeb2c) returned 0x0 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7d, wParam=0xffffffec, lParam=0x2aeb2c) returned 0x0 [0031.503] SetWindowPos (hWnd=0x30194, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0031.503] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x46, wParam=0x0, lParam=0x2aeb48) returned 0x0 [0031.504] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x83, wParam=0x1, lParam=0x2aeb1c) returned 0x0 [0031.504] GetWindowPlacement (in: hWnd=0x30194, lpwndpl=0x2ae910 | out: lpwndpl=0x2ae910) returned 1 [0031.504] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x47, wParam=0x0, lParam=0x2aeb48) returned 0x0 [0031.504] GetClientRect (in: hWnd=0x30194, lpRect=0x2ae8c0 | out: lpRect=0x2ae8c0) returned 1 [0031.504] GetWindowRect (in: hWnd=0x30194, lpRect=0x2ae8c0 | out: lpRect=0x2ae8c0) returned 1 [0031.505] RedrawWindow (hWnd=0x30194, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.505] GetSystemMenu (hWnd=0x30194, bRevert=0) returned 0x0 [0031.505] GetWindowPlacement (in: hWnd=0x30194, lpwndpl=0x2aeb7c | out: lpwndpl=0x2aeb7c) returned 1 [0031.505] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0031.505] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0031.505] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0031.505] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0031.505] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0031.505] ShowWindow (hWnd=0x30194, nCmdShow=5) returned 0 [0031.505] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.505] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.505] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.505] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x193bc04 | out: lpWndClass=0x193bc04) returned 1 [0031.506] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.506] CoTaskMemAlloc (cb=0x58) returned 0x9fb60 [0031.506] RegisterClassW (lpWndClass=0x2ae71c) returned 0xc135 [0031.506] CoTaskMemFree (pv=0x9fb60) [0031.506] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.506] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName="NOTE: IF YOU TRY TO SHUTDOWN OR REMOVE THIS VIRUS FROM YOUR PC WE WILL DELETE EVERY POSSIBLE FILE IN YOUR SYSTEM!!!", dwStyle=0x5600000d, X=488, Y=102, nWidth=427, nHeight=97, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x30192 [0031.506] SetWindowLongW (hWnd=0x30192, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.506] GetWindowLongW (hWnd=0x30192, nIndex=-4) returned 1949808841 [0031.506] SetWindowLongW (hWnd=0x30192, nIndex=-4, dwNewLong=23464878) returned 1949808841 [0031.506] GetWindowLongW (hWnd=0x30192, nIndex=-4) returned 23464878 [0031.506] GetWindowLongW (hWnd=0x30192, nIndex=-16) returned 1174405133 [0031.506] GetWindowLongW (hWnd=0x30192, nIndex=-12) returned 0 [0031.507] SetWindowLongW (hWnd=0x30192, nIndex=-12, dwNewLong=197010) returned 0 [0031.507] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.507] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.507] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x1, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.507] GetWindow (hWnd=0x30192, uCmd=0x3) returned 0x0 [0031.507] GetClientRect (in: hWnd=0x30192, lpRect=0x2adefc | out: lpRect=0x2adefc) returned 1 [0031.507] GetWindowRect (in: hWnd=0x30192, lpRect=0x2adefc | out: lpRect=0x2adefc) returned 1 [0031.507] GetParent (hWnd=0x30192) returned 0x30194 [0031.507] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adefc, cPoints=0x2 | out: lpPoints=0x2adefc) returned -10092677 [0031.508] SetWindowTextW (hWnd=0x30192, lpString="NOTE: IF YOU TRY TO SHUTDOWN OR REMOVE THIS VIRUS FROM YOUR PC WE WILL DELETE EVERY POSSIBLE FILE IN YOUR SYSTEM!!!") returned 1 [0031.508] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0xc, wParam=0x0, lParam=0x1918e38) returned 0x1 [0031.508] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x5, wParam=0x0, lParam=0x6101ab) returned 0x0 [0031.508] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x3, wParam=0x0, lParam=0x6601e8) returned 0x0 [0031.508] GetClientRect (in: hWnd=0x30192, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.508] GetWindowRect (in: hWnd=0x30192, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.508] GetParent (hWnd=0x30192) returned 0x30194 [0031.508] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.508] SendMessageW (hWnd=0x30192, Msg=0x2210, wParam=0x1920001, lParam=0x30192) returned 0x0 [0031.508] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x2210, wParam=0x1920001, lParam=0x30192) returned 0x0 [0031.508] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.508] GetParent (hWnd=0x30192) returned 0x30194 [0031.508] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.508] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.508] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.508] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=99, Y=421, nWidth=0, nHeight=39, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x30190 [0031.508] SetWindowLongW (hWnd=0x30190, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.508] GetWindowLongW (hWnd=0x30190, nIndex=-4) returned 1949808841 [0031.509] SetWindowLongW (hWnd=0x30190, nIndex=-4, dwNewLong=23464918) returned 1949808841 [0031.509] GetWindowLongW (hWnd=0x30190, nIndex=-4) returned 23464918 [0031.509] GetWindowLongW (hWnd=0x30190, nIndex=-16) returned 1174405133 [0031.509] GetWindowLongW (hWnd=0x30190, nIndex=-12) returned 0 [0031.509] SetWindowLongW (hWnd=0x30190, nIndex=-12, dwNewLong=197008) returned 0 [0031.509] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.509] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.509] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x1, wParam=0x0, lParam=0x2ae2b0) returned 0x0 [0031.509] GetWindow (hWnd=0x30190, uCmd=0x3) returned 0x30192 [0031.509] GetClientRect (in: hWnd=0x30190, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.509] GetWindowRect (in: hWnd=0x30190, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.509] GetParent (hWnd=0x30190) returned 0x30194 [0031.509] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adff0, cPoints=0x2 | out: lpPoints=0x2adff0) returned -10092677 [0031.509] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x5, wParam=0x0, lParam=0x270000) returned 0x0 [0031.509] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x3, wParam=0x0, lParam=0x1a50063) returned 0x0 [0031.509] GetClientRect (in: hWnd=0x30190, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.509] GetWindowRect (in: hWnd=0x30190, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.509] GetParent (hWnd=0x30190) returned 0x30194 [0031.509] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.509] SendMessageW (hWnd=0x30190, Msg=0x2210, wParam=0x1900001, lParam=0x30190) returned 0x0 [0031.509] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x2210, wParam=0x1900001, lParam=0x30190) returned 0x0 [0031.510] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.510] GetParent (hWnd=0x30190) returned 0x30194 [0031.510] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.510] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.510] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.510] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName="5", dwStyle=0x5600000d, X=203, Y=290, nWidth=37, nHeight=39, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x60196 [0031.510] SetWindowLongW (hWnd=0x60196, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.510] GetWindowLongW (hWnd=0x60196, nIndex=-4) returned 1949808841 [0031.510] SetWindowLongW (hWnd=0x60196, nIndex=-4, dwNewLong=23464958) returned 1949808841 [0031.510] GetWindowLongW (hWnd=0x60196, nIndex=-4) returned 23464958 [0031.510] GetWindowLongW (hWnd=0x60196, nIndex=-16) returned 1174405133 [0031.510] GetWindowLongW (hWnd=0x60196, nIndex=-12) returned 0 [0031.510] SetWindowLongW (hWnd=0x60196, nIndex=-12, dwNewLong=393622) returned 0 [0031.510] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.510] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.511] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x1, wParam=0x0, lParam=0x2ae2a4) returned 0x0 [0031.511] GetWindow (hWnd=0x60196, uCmd=0x3) returned 0x30190 [0031.511] GetClientRect (in: hWnd=0x60196, lpRect=0x2adfe4 | out: lpRect=0x2adfe4) returned 1 [0031.511] GetWindowRect (in: hWnd=0x60196, lpRect=0x2adfe4 | out: lpRect=0x2adfe4) returned 1 [0031.511] GetParent (hWnd=0x60196) returned 0x30194 [0031.511] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adfe4, cPoints=0x2 | out: lpPoints=0x2adfe4) returned -10092677 [0031.511] SetWindowTextW (hWnd=0x60196, lpString="5") returned 1 [0031.511] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0xc, wParam=0x0, lParam=0x1918df0) returned 0x1 [0031.511] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x5, wParam=0x0, lParam=0x270025) returned 0x0 [0031.511] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x3, wParam=0x0, lParam=0x12200cb) returned 0x0 [0031.511] GetClientRect (in: hWnd=0x60196, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.511] GetWindowRect (in: hWnd=0x60196, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.511] GetParent (hWnd=0x60196) returned 0x30194 [0031.511] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.511] SendMessageW (hWnd=0x60196, Msg=0x2210, wParam=0x1960001, lParam=0x60196) returned 0x0 [0031.511] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x2210, wParam=0x1960001, lParam=0x60196) returned 0x0 [0031.511] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.511] GetParent (hWnd=0x60196) returned 0x30194 [0031.511] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.511] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.511] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.512] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=209, Y=520, nWidth=0, nHeight=40, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201c8 [0031.512] SetWindowLongW (hWnd=0x201c8, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.512] GetWindowLongW (hWnd=0x201c8, nIndex=-4) returned 1949808841 [0031.512] SetWindowLongW (hWnd=0x201c8, nIndex=-4, dwNewLong=23464998) returned 1949808841 [0031.512] GetWindowLongW (hWnd=0x201c8, nIndex=-4) returned 23464998 [0031.512] GetWindowLongW (hWnd=0x201c8, nIndex=-16) returned 1174405133 [0031.512] GetWindowLongW (hWnd=0x201c8, nIndex=-12) returned 0 [0031.512] SetWindowLongW (hWnd=0x201c8, nIndex=-12, dwNewLong=131528) returned 0 [0031.512] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.512] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.512] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x1, wParam=0x0, lParam=0x2ae2b0) returned 0x0 [0031.512] GetWindow (hWnd=0x201c8, uCmd=0x3) returned 0x60196 [0031.512] GetClientRect (in: hWnd=0x201c8, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.512] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.512] GetParent (hWnd=0x201c8) returned 0x30194 [0031.512] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adff0, cPoints=0x2 | out: lpPoints=0x2adff0) returned -10092677 [0031.512] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.512] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x3, wParam=0x0, lParam=0x20800d1) returned 0x0 [0031.513] GetClientRect (in: hWnd=0x201c8, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.513] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.513] GetParent (hWnd=0x201c8) returned 0x30194 [0031.513] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.513] SendMessageW (hWnd=0x201c8, Msg=0x2210, wParam=0x1c80001, lParam=0x201c8) returned 0x0 [0031.513] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x2210, wParam=0x1c80001, lParam=0x201c8) returned 0x0 [0031.513] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.513] GetParent (hWnd=0x201c8) returned 0x30194 [0031.513] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.513] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.513] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.513] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=139, Y=520, nWidth=0, nHeight=40, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201c6 [0031.513] SetWindowLongW (hWnd=0x201c6, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.513] GetWindowLongW (hWnd=0x201c6, nIndex=-4) returned 1949808841 [0031.513] SetWindowLongW (hWnd=0x201c6, nIndex=-4, dwNewLong=23465038) returned 1949808841 [0031.513] GetWindowLongW (hWnd=0x201c6, nIndex=-4) returned 23465038 [0031.513] GetWindowLongW (hWnd=0x201c6, nIndex=-16) returned 1174405133 [0031.513] GetWindowLongW (hWnd=0x201c6, nIndex=-12) returned 0 [0031.513] SetWindowLongW (hWnd=0x201c6, nIndex=-12, dwNewLong=131526) returned 0 [0031.513] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.514] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.514] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x1, wParam=0x0, lParam=0x2ae2b0) returned 0x0 [0031.514] GetWindow (hWnd=0x201c6, uCmd=0x3) returned 0x201c8 [0031.514] GetClientRect (in: hWnd=0x201c6, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.514] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.514] GetParent (hWnd=0x201c6) returned 0x30194 [0031.514] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adff0, cPoints=0x2 | out: lpPoints=0x2adff0) returned -10092677 [0031.514] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.514] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x3, wParam=0x0, lParam=0x208008b) returned 0x0 [0031.514] GetClientRect (in: hWnd=0x201c6, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.514] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.514] GetParent (hWnd=0x201c6) returned 0x30194 [0031.514] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.514] SendMessageW (hWnd=0x201c6, Msg=0x2210, wParam=0x1c60001, lParam=0x201c6) returned 0x0 [0031.514] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x2210, wParam=0x1c60001, lParam=0x201c6) returned 0x0 [0031.514] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.514] GetParent (hWnd=0x201c6) returned 0x30194 [0031.514] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.514] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.514] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.515] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=240, Y=520, nWidth=0, nHeight=40, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x30198 [0031.515] SetWindowLongW (hWnd=0x30198, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.515] GetWindowLongW (hWnd=0x30198, nIndex=-4) returned 1949808841 [0031.515] SetWindowLongW (hWnd=0x30198, nIndex=-4, dwNewLong=23465078) returned 1949808841 [0031.515] GetWindowLongW (hWnd=0x30198, nIndex=-4) returned 23465078 [0031.515] GetWindowLongW (hWnd=0x30198, nIndex=-16) returned 1174405133 [0031.515] GetWindowLongW (hWnd=0x30198, nIndex=-12) returned 0 [0031.515] SetWindowLongW (hWnd=0x30198, nIndex=-12, dwNewLong=197016) returned 0 [0031.515] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.515] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.515] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x1, wParam=0x0, lParam=0x2ae2b0) returned 0x0 [0031.515] GetWindow (hWnd=0x30198, uCmd=0x3) returned 0x201c6 [0031.515] GetClientRect (in: hWnd=0x30198, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.515] GetWindowRect (in: hWnd=0x30198, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.515] GetParent (hWnd=0x30198) returned 0x30194 [0031.515] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adff0, cPoints=0x2 | out: lpPoints=0x2adff0) returned -10092677 [0031.515] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.515] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x3, wParam=0x0, lParam=0x20800f0) returned 0x0 [0031.515] GetClientRect (in: hWnd=0x30198, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.516] GetWindowRect (in: hWnd=0x30198, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.516] GetParent (hWnd=0x30198) returned 0x30194 [0031.516] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.516] SendMessageW (hWnd=0x30198, Msg=0x2210, wParam=0x1980001, lParam=0x30198) returned 0x0 [0031.516] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x2210, wParam=0x1980001, lParam=0x30198) returned 0x0 [0031.516] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.516] GetParent (hWnd=0x30198) returned 0x30194 [0031.516] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.516] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.516] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.516] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=169, Y=520, nWidth=0, nHeight=40, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x3019a [0031.516] SetWindowLongW (hWnd=0x3019a, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.516] GetWindowLongW (hWnd=0x3019a, nIndex=-4) returned 1949808841 [0031.516] SetWindowLongW (hWnd=0x3019a, nIndex=-4, dwNewLong=23465118) returned 1949808841 [0031.516] GetWindowLongW (hWnd=0x3019a, nIndex=-4) returned 23465118 [0031.516] GetWindowLongW (hWnd=0x3019a, nIndex=-16) returned 1174405133 [0031.516] GetWindowLongW (hWnd=0x3019a, nIndex=-12) returned 0 [0031.516] SetWindowLongW (hWnd=0x3019a, nIndex=-12, dwNewLong=197018) returned 0 [0031.516] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.517] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.517] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x1, wParam=0x0, lParam=0x2ae2b0) returned 0x0 [0031.517] GetWindow (hWnd=0x3019a, uCmd=0x3) returned 0x30198 [0031.517] GetClientRect (in: hWnd=0x3019a, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.517] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.517] GetParent (hWnd=0x3019a) returned 0x30194 [0031.517] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adff0, cPoints=0x2 | out: lpPoints=0x2adff0) returned -10092677 [0031.517] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.517] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x3, wParam=0x0, lParam=0x20800a9) returned 0x0 [0031.517] GetClientRect (in: hWnd=0x3019a, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.517] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.517] GetParent (hWnd=0x3019a) returned 0x30194 [0031.517] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.517] SendMessageW (hWnd=0x3019a, Msg=0x2210, wParam=0x19a0001, lParam=0x3019a) returned 0x0 [0031.517] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x2210, wParam=0x19a0001, lParam=0x3019a) returned 0x0 [0031.517] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.517] GetParent (hWnd=0x3019a) returned 0x30194 [0031.517] GetCurrentActCtx (in: lphActCtx=0x2ae864 | out: lphActCtx=0x2ae864*=0xb3664) returned 1 [0031.517] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.517] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.517] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=99, Y=520, nWidth=0, nHeight=40, hWndParent=0x30194, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x301bc [0031.518] SetWindowLongW (hWnd=0x301bc, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.518] GetWindowLongW (hWnd=0x301bc, nIndex=-4) returned 1949808841 [0031.518] SetWindowLongW (hWnd=0x301bc, nIndex=-4, dwNewLong=23465158) returned 1949808841 [0031.518] GetWindowLongW (hWnd=0x301bc, nIndex=-4) returned 23465158 [0031.518] GetWindowLongW (hWnd=0x301bc, nIndex=-16) returned 1174405133 [0031.518] GetWindowLongW (hWnd=0x301bc, nIndex=-12) returned 0 [0031.518] SetWindowLongW (hWnd=0x301bc, nIndex=-12, dwNewLong=197052) returned 0 [0031.518] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x81, wParam=0x0, lParam=0x2ae2b0) returned 0x1 [0031.518] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x83, wParam=0x0, lParam=0x2ae334) returned 0x0 [0031.518] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x1, wParam=0x0, lParam=0x2ae2b0) returned 0x0 [0031.518] GetWindow (hWnd=0x301bc, uCmd=0x3) returned 0x3019a [0031.518] GetClientRect (in: hWnd=0x301bc, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.518] GetWindowRect (in: hWnd=0x301bc, lpRect=0x2adff0 | out: lpRect=0x2adff0) returned 1 [0031.518] GetParent (hWnd=0x301bc) returned 0x30194 [0031.518] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2adff0, cPoints=0x2 | out: lpPoints=0x2adff0) returned -10092677 [0031.519] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.519] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x3, wParam=0x0, lParam=0x2080063) returned 0x0 [0031.519] GetClientRect (in: hWnd=0x301bc, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.519] GetWindowRect (in: hWnd=0x301bc, lpRect=0x2ae0a8 | out: lpRect=0x2ae0a8) returned 1 [0031.519] GetParent (hWnd=0x301bc) returned 0x30194 [0031.519] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30194, lpPoints=0x2ae0a8, cPoints=0x2 | out: lpPoints=0x2ae0a8) returned -10092677 [0031.519] SendMessageW (hWnd=0x301bc, Msg=0x2210, wParam=0x1bc0001, lParam=0x301bc) returned 0x0 [0031.519] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x2210, wParam=0x1bc0001, lParam=0x301bc) returned 0x0 [0031.519] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.519] GetParent (hWnd=0x301bc) returned 0x30194 [0031.519] GetWindowTextLengthW (hWnd=0x30194) returned 19 [0031.519] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.519] GetSystemMetrics (nIndex=42) returned 0 [0031.519] GetWindowTextW (in: hWnd=0x30194, lpString=0x2ae7f4, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.519] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xd, wParam=0x14, lParam=0x2ae7f4) returned 0x13 [0031.524] ShowWindow (hWnd=0x30194, nCmdShow=0) returned 0 [0031.526] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.526] GetWindowLongW (hWnd=0x30194, nIndex=-16) returned 113704960 [0031.526] GetWindowTextLengthW (hWnd=0x30194) returned 19 [0031.526] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.526] GetSystemMetrics (nIndex=42) returned 0 [0031.526] GetWindowTextW (in: hWnd=0x30194, lpString=0x2ae6f4, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.526] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xd, wParam=0x14, lParam=0x2ae6f4) returned 0x13 [0031.526] GetWindowTextLengthW (hWnd=0x30194) returned 19 [0031.526] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.526] GetSystemMetrics (nIndex=42) returned 0 [0031.526] GetWindowTextW (in: hWnd=0x30194, lpString=0x2ae6f4, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.526] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xd, wParam=0x14, lParam=0x2ae6f4) returned 0x13 [0031.526] GetWindowLongW (hWnd=0x30194, nIndex=-16) returned 113704960 [0031.526] GetWindowLongW (hWnd=0x30194, nIndex=-20) returned 327944 [0031.526] SetWindowLongW (hWnd=0x30194, nIndex=-16, dwNewLong=46596096) returned 113704960 [0031.527] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7c, wParam=0xfffffff0, lParam=0x2ae768) returned 0x0 [0031.527] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7d, wParam=0xfffffff0, lParam=0x2ae768) returned 0x0 [0031.527] SetWindowLongW (hWnd=0x30194, nIndex=-20, dwNewLong=851968) returned 327944 [0031.527] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7c, wParam=0xffffffec, lParam=0x2ae768) returned 0x0 [0031.527] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x7d, wParam=0xffffffec, lParam=0x2ae768) returned 0x0 [0031.527] SetWindowPos (hWnd=0x30194, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0031.527] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x46, wParam=0x0, lParam=0x2ae784) returned 0x0 [0031.527] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x83, wParam=0x1, lParam=0x2ae758) returned 0x0 [0031.528] GetWindowPlacement (in: hWnd=0x30194, lpwndpl=0x2ae54c | out: lpwndpl=0x2ae54c) returned 1 [0031.528] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x47, wParam=0x0, lParam=0x2ae784) returned 0x0 [0031.528] GetClientRect (in: hWnd=0x30194, lpRect=0x2ae4fc | out: lpRect=0x2ae4fc) returned 1 [0031.528] GetWindowRect (in: hWnd=0x30194, lpRect=0x2ae4fc | out: lpRect=0x2ae4fc) returned 1 [0031.528] RedrawWindow (hWnd=0x30194, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.529] InvalidateRect (hWnd=0x30192, lpRect=0x2ae718, bErase=1) returned 1 [0031.529] InvalidateRect (hWnd=0x201c8, lpRect=0x2ae718, bErase=1) returned 1 [0031.529] InvalidateRect (hWnd=0x201c6, lpRect=0x2ae718, bErase=1) returned 1 [0031.529] InvalidateRect (hWnd=0x30198, lpRect=0x2ae718, bErase=1) returned 1 [0031.529] InvalidateRect (hWnd=0x3019a, lpRect=0x2ae718, bErase=1) returned 1 [0031.529] InvalidateRect (hWnd=0x301bc, lpRect=0x2ae718, bErase=1) returned 1 [0031.529] GetSystemMenu (hWnd=0x30194, bRevert=0) returned 0x0 [0031.529] GetWindowPlacement (in: hWnd=0x30194, lpwndpl=0x2ae7b8 | out: lpwndpl=0x2ae7b8) returned 1 [0031.529] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0031.529] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0031.529] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0031.529] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0031.529] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0031.533] SetLayeredWindowAttributes (hwnd=0x30194, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0031.563] GetCurrentThreadId () returned 0x970 [0031.567] EnumThreadWindows (dwThreadId=0x970, lpfn=0x1660cee, lParam=0x30194) returned 1 [0031.588] GetWindowLongW (hWnd=0x30194, nIndex=-8) returned 0 [0031.588] GetWindowLongW (hWnd=0x60138, nIndex=-8) returned 0 [0031.588] GetWindowLongW (hWnd=0x3018c, nIndex=-8) returned 327928 [0031.588] GetWindowLongW (hWnd=0x500f8, nIndex=-8) returned 197012 [0031.624] SetWindowLongW (hWnd=0x500f8, nIndex=-8, dwNewLong=0) returned 197012 [0031.626] GetFocus () returned 0x30194 [0031.626] GetParent (hWnd=0x30194) returned 0x0 [0031.626] GetWindowThreadProcessId (in: hWnd=0x30192, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.628] GetCurrentActCtx (in: lphActCtx=0x2ae738 | out: lphActCtx=0x2ae738*=0xb3664) returned 1 [0031.629] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.629] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.629] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201c2 [0031.629] SetWindowLongW (hWnd=0x201c2, nIndex=-4, dwNewLong=1991594109) returned 23463910 [0031.629] GetWindowLongW (hWnd=0x201c2, nIndex=-4) returned 1991594109 [0031.629] SetWindowLongW (hWnd=0x201c2, nIndex=-4, dwNewLong=23465238) returned 1991594109 [0031.629] GetWindowLongW (hWnd=0x201c2, nIndex=-4) returned 23465238 [0031.629] GetWindowLongW (hWnd=0x201c2, nIndex=-16) returned 113311744 [0031.629] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c2, Msg=0x24, wParam=0x0, lParam=0x2ae1e8) returned 0x0 [0031.629] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c2, Msg=0x81, wParam=0x0, lParam=0x2ae180) returned 0x1 [0031.629] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c2, Msg=0x83, wParam=0x0, lParam=0x2ae208) returned 0x0 [0031.629] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c2, Msg=0x1, wParam=0x0, lParam=0x2ae144) returned 0x0 [0031.629] GetClientRect (in: hWnd=0x201c2, lpRect=0x2adea4 | out: lpRect=0x2adea4) returned 1 [0031.629] GetWindowRect (in: hWnd=0x201c2, lpRect=0x2adea4 | out: lpRect=0x2adea4) returned 1 [0031.630] SetWindowTextW (hWnd=0x201c2, lpString="WindowsFormsParkingWindow") returned 1 [0031.630] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c2, Msg=0xc, wParam=0x0, lParam=0x193cc6c) returned 0x1 [0031.630] GetParent (hWnd=0x201c2) returned 0x0 [0031.630] SetParent (hWndChild=0x30192, hWndNewParent=0x201c2) returned 0x30194 [0031.630] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.630] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.630] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.630] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.630] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x3, wParam=0x0, lParam=0x6601e8) returned 0x0 [0031.630] GetClientRect (in: hWnd=0x30192, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.630] GetWindowRect (in: hWnd=0x30192, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.631] GetParent (hWnd=0x30192) returned 0x201c2 [0031.631] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.631] GetClientRect (in: hWnd=0x30192, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.631] GetWindowRect (in: hWnd=0x30192, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.631] GetParent (hWnd=0x30192) returned 0x201c2 [0031.631] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.631] GetParent (hWnd=0x30192) returned 0x201c2 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.631] GetWindowThreadProcessId (in: hWnd=0x30190, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.631] SetParent (hWndChild=0x30190, hWndNewParent=0x201c2) returned 0x30194 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x3, wParam=0x0, lParam=0x1a50063) returned 0x0 [0031.631] GetClientRect (in: hWnd=0x30190, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.631] GetWindowRect (in: hWnd=0x30190, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.631] GetParent (hWnd=0x30190) returned 0x201c2 [0031.631] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.631] GetClientRect (in: hWnd=0x30190, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.631] GetWindowRect (in: hWnd=0x30190, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.631] GetParent (hWnd=0x30190) returned 0x201c2 [0031.631] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.631] GetParent (hWnd=0x30190) returned 0x201c2 [0031.631] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.632] GetWindowThreadProcessId (in: hWnd=0x60196, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.632] SetParent (hWndChild=0x60196, hWndNewParent=0x201c2) returned 0x30194 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x3, wParam=0x0, lParam=0x12200cb) returned 0x0 [0031.632] GetClientRect (in: hWnd=0x60196, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.632] GetWindowRect (in: hWnd=0x60196, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.632] GetParent (hWnd=0x60196) returned 0x201c2 [0031.632] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.632] GetClientRect (in: hWnd=0x60196, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.632] GetWindowRect (in: hWnd=0x60196, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.632] GetParent (hWnd=0x60196) returned 0x201c2 [0031.632] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.632] GetParent (hWnd=0x60196) returned 0x201c2 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.632] GetWindowThreadProcessId (in: hWnd=0x201c8, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.632] SetParent (hWndChild=0x201c8, hWndNewParent=0x201c2) returned 0x30194 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.632] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x3, wParam=0x0, lParam=0x20800d1) returned 0x0 [0031.633] GetClientRect (in: hWnd=0x201c8, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.633] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.633] GetParent (hWnd=0x201c8) returned 0x201c2 [0031.633] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.633] GetClientRect (in: hWnd=0x201c8, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.633] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.633] GetParent (hWnd=0x201c8) returned 0x201c2 [0031.633] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.633] GetParent (hWnd=0x201c8) returned 0x201c2 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.633] GetWindowThreadProcessId (in: hWnd=0x201c6, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.633] SetParent (hWndChild=0x201c6, hWndNewParent=0x201c2) returned 0x30194 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.633] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x3, wParam=0x0, lParam=0x208008b) returned 0x0 [0031.634] GetClientRect (in: hWnd=0x201c6, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.634] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.634] GetParent (hWnd=0x201c6) returned 0x201c2 [0031.634] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.634] GetClientRect (in: hWnd=0x201c6, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.634] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.634] GetParent (hWnd=0x201c6) returned 0x201c2 [0031.634] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.634] GetParent (hWnd=0x201c6) returned 0x201c2 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.634] GetWindowThreadProcessId (in: hWnd=0x30198, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.634] SetParent (hWndChild=0x30198, hWndNewParent=0x201c2) returned 0x30194 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x3, wParam=0x0, lParam=0x20800f0) returned 0x0 [0031.634] GetClientRect (in: hWnd=0x30198, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.634] GetWindowRect (in: hWnd=0x30198, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.634] GetParent (hWnd=0x30198) returned 0x201c2 [0031.634] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.634] GetClientRect (in: hWnd=0x30198, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.634] GetWindowRect (in: hWnd=0x30198, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.634] GetParent (hWnd=0x30198) returned 0x201c2 [0031.634] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.634] GetParent (hWnd=0x30198) returned 0x201c2 [0031.634] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.635] GetWindowThreadProcessId (in: hWnd=0x3019a, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.635] SetParent (hWndChild=0x3019a, hWndNewParent=0x201c2) returned 0x30194 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x3, wParam=0x0, lParam=0x20800a9) returned 0x0 [0031.635] GetClientRect (in: hWnd=0x3019a, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.635] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.635] GetParent (hWnd=0x3019a) returned 0x201c2 [0031.635] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.635] GetClientRect (in: hWnd=0x3019a, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.635] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.635] GetParent (hWnd=0x3019a) returned 0x201c2 [0031.635] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.635] GetParent (hWnd=0x3019a) returned 0x201c2 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.635] GetWindowThreadProcessId (in: hWnd=0x301bc, lpdwProcessId=0x2ae7d0 | out: lpdwProcessId=0x2ae7d0) returned 0x970 [0031.635] SetParent (hWndChild=0x301bc, hWndNewParent=0x201c2) returned 0x30194 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.635] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x46, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.636] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.636] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x47, wParam=0x0, lParam=0x2ae744) returned 0x0 [0031.636] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x3, wParam=0x0, lParam=0x2080063) returned 0x0 [0031.636] GetClientRect (in: hWnd=0x301bc, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.636] GetWindowRect (in: hWnd=0x301bc, lpRect=0x2adf88 | out: lpRect=0x2adf88) returned 1 [0031.636] GetParent (hWnd=0x301bc) returned 0x201c2 [0031.636] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf88, cPoints=0x2 | out: lpPoints=0x2adf88) returned -1900552 [0031.636] GetClientRect (in: hWnd=0x301bc, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.636] GetWindowRect (in: hWnd=0x301bc, lpRect=0x2ae4a0 | out: lpRect=0x2ae4a0) returned 1 [0031.636] GetParent (hWnd=0x301bc) returned 0x201c2 [0031.636] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae4a0, cPoints=0x2 | out: lpPoints=0x2ae4a0) returned -1900552 [0031.636] GetParent (hWnd=0x301bc) returned 0x201c2 [0031.636] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301bc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.636] GetWindowLongW (hWnd=0x30194, nIndex=-20) returned 852232 [0031.636] DestroyWindow (hWnd=0x30194) returned 1 [0031.636] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.637] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0031.637] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0031.637] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0031.639] GetWindowTextLengthW (hWnd=0x30194) returned 19 [0031.639] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.639] GetSystemMetrics (nIndex=42) returned 0 [0031.639] GetWindowTextW (in: hWnd=0x30194, lpString=0x2ae348, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.639] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0xd, wParam=0x14, lParam=0x2ae348) returned 0x13 [0031.639] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.639] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x30194, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.675] GetCurrentActCtx (in: lphActCtx=0x2ae718 | out: lphActCtx=0x2ae718*=0xb3664) returned 1 [0031.675] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.675] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.675] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Qinynore Ransomware", dwStyle=0x2c70000, X=125, Y=125, nWidth=1070, nHeight=692, hWndParent=0x0, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201c4 [0031.675] SetWindowLongW (hWnd=0x201c4, nIndex=-4, dwNewLong=1991594109) returned 23463910 [0031.675] GetWindowLongW (hWnd=0x201c4, nIndex=-4) returned 1991594109 [0031.676] SetWindowLongW (hWnd=0x201c4, nIndex=-4, dwNewLong=23508390) returned 1991594109 [0031.676] GetWindowLongW (hWnd=0x201c4, nIndex=-4) returned 23508390 [0031.676] GetWindowLongW (hWnd=0x201c4, nIndex=-16) returned 113704960 [0031.676] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x81, wParam=0x0, lParam=0x2ae160) returned 0x1 [0031.677] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x83, wParam=0x0, lParam=0x2ae1e8) returned 0x0 [0031.677] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x1, wParam=0x0, lParam=0x2ae130) returned 0x0 [0031.677] GetClientRect (in: hWnd=0x201c4, lpRect=0x2ade7c | out: lpRect=0x2ade7c) returned 1 [0031.677] GetWindowRect (in: hWnd=0x201c4, lpRect=0x2ade7c | out: lpRect=0x2ade7c) returned 1 [0031.677] SetWindowTextW (hWnd=0x201c4, lpString="Qinynore Ransomware") returned 1 [0031.677] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xc, wParam=0x0, lParam=0x193cf94) returned 0x1 [0031.679] SetLayeredWindowAttributes (hwnd=0x201c4, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0031.706] GetStartupInfoW (in: lpStartupInfo=0x193d280 | out: lpStartupInfo=0x193d280*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0031.706] GetParent (hWnd=0x201c4) returned 0x0 [0031.706] GetStockObject (i=5) returned 0x1900015 [0031.707] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.707] CoTaskMemAlloc (cb=0x5c) returned 0xbf8a8 [0031.707] RegisterClassW (lpWndClass=0x2ae5f8) returned 0xc134 [0031.707] CoTaskMemFree (pv=0xbf8a8) [0031.707] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.707] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201b6 [0031.707] SetWindowLongW (hWnd=0x201b6, nIndex=-4, dwNewLong=1991594109) returned 23508454 [0031.707] GetWindowLongW (hWnd=0x201b6, nIndex=-4) returned 1991594109 [0031.708] SetWindowLongW (hWnd=0x201b6, nIndex=-4, dwNewLong=23508494) returned 1991594109 [0031.708] GetWindowLongW (hWnd=0x201b6, nIndex=-4) returned 23508494 [0031.708] GetWindowLongW (hWnd=0x201b6, nIndex=-16) returned 79691776 [0031.709] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x24, wParam=0x0, lParam=0x2ae1f0) returned 0x0 [0031.709] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x81, wParam=0x0, lParam=0x2ae188) returned 0x1 [0031.709] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x83, wParam=0x0, lParam=0x2ae210) returned 0x0 [0031.709] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x1, wParam=0x0, lParam=0x2ae188) returned 0x0 [0031.709] SetWindowLongW (hWnd=0x201c4, nIndex=-8, dwNewLong=131510) returned 0 [0031.709] SendMessageW (hWnd=0x201c4, Msg=0x80, wParam=0x0, lParam=0x30199) returned 0x0 [0031.709] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x80, wParam=0x0, lParam=0x30199) returned 0x0 [0031.710] SendMessageW (hWnd=0x201c4, Msg=0x80, wParam=0x1, lParam=0x60163) returned 0x0 [0031.710] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x80, wParam=0x1, lParam=0x60163) returned 0x0 [0031.711] GetSystemMenu (hWnd=0x201c4, bRevert=0) returned 0x0 [0031.711] GetWindowPlacement (in: hWnd=0x201c4, lpwndpl=0x2ae728 | out: lpwndpl=0x2ae728) returned 1 [0031.711] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0031.711] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0031.711] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0031.711] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0031.711] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0031.711] GetClientRect (in: hWnd=0x201c4, lpRect=0x2ae76c | out: lpRect=0x2ae76c) returned 1 [0031.711] GetClientRect (in: hWnd=0x201c4, lpRect=0x2ae6cc | out: lpRect=0x2ae6cc) returned 1 [0031.711] GetWindowRect (in: hWnd=0x201c4, lpRect=0x2ae6cc | out: lpRect=0x2ae6cc) returned 1 [0031.711] SetWindowLongW (hWnd=0x201c4, nIndex=-8, dwNewLong=131510) returned 131510 [0031.711] SendMessageW (hWnd=0x201b6, Msg=0x80, wParam=0x1, lParam=0x60163) returned 0x0 [0031.711] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x80, wParam=0x1, lParam=0x60163) returned 0x0 [0031.711] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0xd, wParam=0x104, lParam=0x3ffc5e0) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0xd, wParam=0x104, lParam=0x3ffc5f8) returned 0x0 [0031.712] SetWindowPos (hWnd=0x201c4, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x46, wParam=0x0, lParam=0x2ae6e8) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x46, wParam=0x0, lParam=0x2ae6e8) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x46, wParam=0x0, lParam=0x2ae6e8) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x46, wParam=0x0, lParam=0x2ae6e8) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0031.712] DefWindowProcW (hWnd=0x60138, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0031.712] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0031.713] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0031.713] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0031.714] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0031.714] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0031.714] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0031.714] GetWindowPlacement (in: hWnd=0x201c4, lpwndpl=0x2ae4b0 | out: lpwndpl=0x2ae4b0) returned 1 [0031.714] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x47, wParam=0x0, lParam=0x2ae6e8) returned 0x0 [0031.714] GetClientRect (in: hWnd=0x201c4, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.714] GetWindowRect (in: hWnd=0x201c4, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.714] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x83, wParam=0x1, lParam=0x2ae2e4) returned 0x0 [0031.715] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.715] GetWindowLongW (hWnd=0x201c4, nIndex=-16) returned 113704960 [0031.715] GetWindowTextLengthW (hWnd=0x201c4) returned 19 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.715] GetSystemMetrics (nIndex=42) returned 0 [0031.715] GetWindowTextW (in: hWnd=0x201c4, lpString=0x2ae654, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xd, wParam=0x14, lParam=0x2ae654) returned 0x13 [0031.715] GetWindowTextLengthW (hWnd=0x201c4) returned 19 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.715] GetSystemMetrics (nIndex=42) returned 0 [0031.715] GetWindowTextW (in: hWnd=0x201c4, lpString=0x2ae654, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xd, wParam=0x14, lParam=0x2ae654) returned 0x13 [0031.715] GetWindowLongW (hWnd=0x201c4, nIndex=-16) returned 113704960 [0031.715] GetWindowLongW (hWnd=0x201c4, nIndex=-20) returned 590088 [0031.715] SetWindowLongW (hWnd=0x201c4, nIndex=-16, dwNewLong=46596096) returned 113704960 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x7c, wParam=0xfffffff0, lParam=0x2ae6c8) returned 0x0 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x7d, wParam=0xfffffff0, lParam=0x2ae6c8) returned 0x0 [0031.715] SetWindowLongW (hWnd=0x201c4, nIndex=-20, dwNewLong=589824) returned 590088 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x7c, wParam=0xffffffec, lParam=0x2ae6c8) returned 0x0 [0031.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x7d, wParam=0xffffffec, lParam=0x2ae6c8) returned 0x0 [0031.716] SetWindowPos (hWnd=0x201c4, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0031.716] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x46, wParam=0x0, lParam=0x2ae6e4) returned 0x0 [0031.716] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x83, wParam=0x1, lParam=0x2ae6b8) returned 0x0 [0031.716] GetWindowPlacement (in: hWnd=0x201c4, lpwndpl=0x2ae4ac | out: lpwndpl=0x2ae4ac) returned 1 [0031.716] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x47, wParam=0x0, lParam=0x2ae6e4) returned 0x0 [0031.716] GetClientRect (in: hWnd=0x201c4, lpRect=0x2ae45c | out: lpRect=0x2ae45c) returned 1 [0031.716] GetWindowRect (in: hWnd=0x201c4, lpRect=0x2ae45c | out: lpRect=0x2ae45c) returned 1 [0031.716] RedrawWindow (hWnd=0x201c4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.716] InvalidateRect (hWnd=0x30192, lpRect=0x2ae678, bErase=1) returned 1 [0031.716] InvalidateRect (hWnd=0x201c8, lpRect=0x2ae678, bErase=1) returned 1 [0031.716] InvalidateRect (hWnd=0x201c6, lpRect=0x2ae678, bErase=1) returned 1 [0031.716] InvalidateRect (hWnd=0x30198, lpRect=0x2ae678, bErase=1) returned 1 [0031.716] InvalidateRect (hWnd=0x3019a, lpRect=0x2ae678, bErase=1) returned 1 [0031.716] InvalidateRect (hWnd=0x301bc, lpRect=0x2ae678, bErase=1) returned 1 [0031.716] GetSystemMenu (hWnd=0x201c4, bRevert=0) returned 0x0 [0031.716] GetWindowPlacement (in: hWnd=0x201c4, lpwndpl=0x2ae718 | out: lpwndpl=0x2ae718) returned 1 [0031.716] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0031.717] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0031.717] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0031.717] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0031.717] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x0) returned 1 [0031.717] SetParent (hWndChild=0x30192, hWndNewParent=0x201c4) returned 0x201c2 [0031.717] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.717] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.717] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.717] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.717] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x3, wParam=0x0, lParam=0x6601e8) returned 0x0 [0031.717] GetClientRect (in: hWnd=0x30192, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.717] GetWindowRect (in: hWnd=0x30192, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.717] GetParent (hWnd=0x30192) returned 0x201c4 [0031.717] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.717] GetClientRect (in: hWnd=0x30192, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.717] GetWindowRect (in: hWnd=0x30192, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.717] GetParent (hWnd=0x30192) returned 0x201c4 [0031.717] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.717] GetParent (hWnd=0x30192) returned 0x201c4 [0031.717] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.717] GetWindow (hWnd=0x30192, uCmd=0x3) returned 0x0 [0031.717] GetFocus () returned 0x201c4 [0031.717] IsChild (hWndParent=0x30192, hWnd=0x201c4) returned 0 [0031.718] GetParent (hWnd=0x30192) returned 0x201c4 [0031.718] GetWindowLongW (hWnd=0x30192, nIndex=-20) returned 0 [0031.718] DestroyWindow (hWnd=0x30192) returned 1 [0031.718] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.718] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x1920002, lParam=0x30192) returned 0x0 [0031.718] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.718] GetWindowTextLengthW (hWnd=0x30192) returned 116 [0031.718] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x74 [0031.718] GetSystemMetrics (nIndex=42) returned 0 [0031.718] GetWindowTextW (in: hWnd=0x30192, lpString=0x2ae1f4, nMaxCount=117 | out: lpString="NOTE: IF YOU TRY TO SHUTDOWN OR REMOVE THIS VIRUS FROM YOUR PC WE WILL DELETE EVERY POSSIBLE FILE IN YOUR SYSTEM!!!") returned 116 [0031.718] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0xd, wParam=0x75, lParam=0x2ae1f4) returned 0x74 [0031.718] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.718] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30192, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.719] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.719] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.719] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.719] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName="NOTE: IF YOU TRY TO SHUTDOWN OR REMOVE THIS VIRUS FROM YOUR PC WE WILL DELETE EVERY POSSIBLE FILE IN YOUR SYSTEM!!!", dwStyle=0x5600000d, X=488, Y=102, nWidth=427, nHeight=97, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x40192 [0031.719] SetWindowLongW (hWnd=0x40192, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.719] GetWindowLongW (hWnd=0x40192, nIndex=-4) returned 1949808841 [0031.719] SetWindowLongW (hWnd=0x40192, nIndex=-4, dwNewLong=23508534) returned 1949808841 [0031.719] GetWindowLongW (hWnd=0x40192, nIndex=-4) returned 23508534 [0031.719] GetWindowLongW (hWnd=0x40192, nIndex=-16) returned 1174405133 [0031.719] GetWindowLongW (hWnd=0x40192, nIndex=-12) returned 0 [0031.719] SetWindowLongW (hWnd=0x40192, nIndex=-12, dwNewLong=262546) returned 0 [0031.719] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x81, wParam=0x0, lParam=0x2ae138) returned 0x1 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x83, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x1, wParam=0x0, lParam=0x2ae044) returned 0x0 [0031.720] GetWindow (hWnd=0x40192, uCmd=0x3) returned 0x0 [0031.720] GetClientRect (in: hWnd=0x40192, lpRect=0x2add84 | out: lpRect=0x2add84) returned 1 [0031.720] GetWindowRect (in: hWnd=0x40192, lpRect=0x2add84 | out: lpRect=0x2add84) returned 1 [0031.720] GetParent (hWnd=0x40192) returned 0x201c4 [0031.720] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2add84, cPoints=0x2 | out: lpPoints=0x2add84) returned -10092677 [0031.720] SetWindowTextW (hWnd=0x40192, lpString="NOTE: IF YOU TRY TO SHUTDOWN OR REMOVE THIS VIRUS FROM YOUR PC WE WILL DELETE EVERY POSSIBLE FILE IN YOUR SYSTEM!!!") returned 1 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0xc, wParam=0x0, lParam=0x193da68) returned 0x1 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x5, wParam=0x0, lParam=0x6101ab) returned 0x0 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x3, wParam=0x0, lParam=0x6601e8) returned 0x0 [0031.720] GetClientRect (in: hWnd=0x40192, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.720] GetWindowRect (in: hWnd=0x40192, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.720] GetParent (hWnd=0x40192) returned 0x201c4 [0031.720] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adf30, cPoints=0x2 | out: lpPoints=0x2adf30) returned -10092677 [0031.720] SendMessageW (hWnd=0x40192, Msg=0x2210, wParam=0x1920001, lParam=0x40192) returned 0x0 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x2210, wParam=0x1920001, lParam=0x40192) returned 0x0 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.720] GetParent (hWnd=0x40192) returned 0x201c4 [0031.720] SetParent (hWndChild=0x30190, hWndNewParent=0x201c4) returned 0x201c2 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.720] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x3, wParam=0x0, lParam=0x1a50063) returned 0x0 [0031.721] GetClientRect (in: hWnd=0x30190, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.721] GetWindowRect (in: hWnd=0x30190, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.721] GetParent (hWnd=0x30190) returned 0x201c4 [0031.721] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.721] GetClientRect (in: hWnd=0x30190, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.721] GetWindowRect (in: hWnd=0x30190, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.721] GetParent (hWnd=0x30190) returned 0x201c4 [0031.721] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.721] GetParent (hWnd=0x30190) returned 0x201c4 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.721] GetWindow (hWnd=0x30190, uCmd=0x3) returned 0x0 [0031.721] SetWindowPos (hWnd=0x30190, hWndInsertAfter=0x40192, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.721] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.722] GetClientRect (in: hWnd=0x30190, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.722] GetWindowRect (in: hWnd=0x30190, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.722] GetParent (hWnd=0x30190) returned 0x201c4 [0031.722] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.722] GetParent (hWnd=0x30190) returned 0x201c4 [0031.722] GetWindow (hWnd=0x30190, uCmd=0x3) returned 0x40192 [0031.722] GetFocus () returned 0x201c4 [0031.722] IsChild (hWndParent=0x30190, hWnd=0x201c4) returned 0 [0031.722] GetParent (hWnd=0x30190) returned 0x201c4 [0031.722] GetWindowLongW (hWnd=0x30190, nIndex=-20) returned 0 [0031.722] DestroyWindow (hWnd=0x30190) returned 1 [0031.722] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x1900002, lParam=0x30190) returned 0x0 [0031.722] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.722] GetWindowTextLengthW (hWnd=0x30190) returned 0 [0031.722] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.722] GetSystemMetrics (nIndex=42) returned 0 [0031.722] GetWindowTextW (in: hWnd=0x30190, lpString=0x2ae2dc, nMaxCount=1 | out: lpString="") returned 0 [0031.722] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0xd, wParam=0x1, lParam=0x2ae2dc) returned 0x0 [0031.722] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.722] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30190, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.723] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.723] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.723] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.723] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=99, Y=421, nWidth=0, nHeight=39, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x40190 [0031.723] SetWindowLongW (hWnd=0x40190, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.723] GetWindowLongW (hWnd=0x40190, nIndex=-4) returned 1949808841 [0031.723] SetWindowLongW (hWnd=0x40190, nIndex=-4, dwNewLong=23508574) returned 1949808841 [0031.723] GetWindowLongW (hWnd=0x40190, nIndex=-4) returned 23508574 [0031.723] GetWindowLongW (hWnd=0x40190, nIndex=-16) returned 1174405133 [0031.723] GetWindowLongW (hWnd=0x40190, nIndex=-12) returned 0 [0031.723] SetWindowLongW (hWnd=0x40190, nIndex=-12, dwNewLong=262544) returned 0 [0031.723] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x81, wParam=0x0, lParam=0x2ae138) returned 0x1 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x83, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x1, wParam=0x0, lParam=0x2ae138) returned 0x0 [0031.724] GetWindow (hWnd=0x40190, uCmd=0x3) returned 0x40192 [0031.724] GetClientRect (in: hWnd=0x40190, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.724] GetWindowRect (in: hWnd=0x40190, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.724] GetParent (hWnd=0x40190) returned 0x201c4 [0031.724] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ade78, cPoints=0x2 | out: lpPoints=0x2ade78) returned -10092677 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x5, wParam=0x0, lParam=0x270000) returned 0x0 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x3, wParam=0x0, lParam=0x1a50063) returned 0x0 [0031.724] GetClientRect (in: hWnd=0x40190, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.724] GetWindowRect (in: hWnd=0x40190, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.724] GetParent (hWnd=0x40190) returned 0x201c4 [0031.724] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adf30, cPoints=0x2 | out: lpPoints=0x2adf30) returned -10092677 [0031.724] SendMessageW (hWnd=0x40190, Msg=0x2210, wParam=0x1900001, lParam=0x40190) returned 0x0 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x2210, wParam=0x1900001, lParam=0x40190) returned 0x0 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.724] GetParent (hWnd=0x40190) returned 0x201c4 [0031.724] SetParent (hWndChild=0x60196, hWndNewParent=0x201c4) returned 0x201c2 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.724] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x3, wParam=0x0, lParam=0x12200cb) returned 0x0 [0031.725] GetClientRect (in: hWnd=0x60196, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.725] GetWindowRect (in: hWnd=0x60196, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.725] GetParent (hWnd=0x60196) returned 0x201c4 [0031.725] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.725] GetClientRect (in: hWnd=0x60196, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.725] GetWindowRect (in: hWnd=0x60196, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.725] GetParent (hWnd=0x60196) returned 0x201c4 [0031.725] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.725] GetParent (hWnd=0x60196) returned 0x201c4 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.725] GetWindow (hWnd=0x60196, uCmd=0x3) returned 0x0 [0031.725] SetWindowPos (hWnd=0x60196, hWndInsertAfter=0x40190, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.725] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.725] GetClientRect (in: hWnd=0x60196, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.725] GetWindowRect (in: hWnd=0x60196, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.725] GetParent (hWnd=0x60196) returned 0x201c4 [0031.726] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.726] GetParent (hWnd=0x60196) returned 0x201c4 [0031.726] GetWindow (hWnd=0x60196, uCmd=0x3) returned 0x40190 [0031.726] GetFocus () returned 0x201c4 [0031.726] IsChild (hWndParent=0x60196, hWnd=0x201c4) returned 0 [0031.726] GetParent (hWnd=0x60196) returned 0x201c4 [0031.726] GetWindowLongW (hWnd=0x60196, nIndex=-20) returned 0 [0031.726] DestroyWindow (hWnd=0x60196) returned 1 [0031.726] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.726] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x1960002, lParam=0x60196) returned 0x0 [0031.726] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.726] GetWindowTextLengthW (hWnd=0x60196) returned 1 [0031.726] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1 [0031.726] GetSystemMetrics (nIndex=42) returned 0 [0031.726] GetWindowTextW (in: hWnd=0x60196, lpString=0x2ae2dc, nMaxCount=2 | out: lpString="5") returned 1 [0031.726] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0xd, wParam=0x2, lParam=0x2ae2dc) returned 0x1 [0031.726] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.726] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x60196, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.727] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.727] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.727] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.727] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName="5", dwStyle=0x5600000d, X=203, Y=290, nWidth=37, nHeight=39, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x70196 [0031.727] SetWindowLongW (hWnd=0x70196, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.727] GetWindowLongW (hWnd=0x70196, nIndex=-4) returned 1949808841 [0031.727] SetWindowLongW (hWnd=0x70196, nIndex=-4, dwNewLong=23508614) returned 1949808841 [0031.727] GetWindowLongW (hWnd=0x70196, nIndex=-4) returned 23508614 [0031.727] GetWindowLongW (hWnd=0x70196, nIndex=-16) returned 1174405133 [0031.727] GetWindowLongW (hWnd=0x70196, nIndex=-12) returned 0 [0031.727] SetWindowLongW (hWnd=0x70196, nIndex=-12, dwNewLong=459158) returned 0 [0031.727] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x81, wParam=0x0, lParam=0x2ae138) returned 0x1 [0031.727] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x83, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x1, wParam=0x0, lParam=0x2ae12c) returned 0x0 [0031.728] GetWindow (hWnd=0x70196, uCmd=0x3) returned 0x40190 [0031.728] GetClientRect (in: hWnd=0x70196, lpRect=0x2ade6c | out: lpRect=0x2ade6c) returned 1 [0031.728] GetWindowRect (in: hWnd=0x70196, lpRect=0x2ade6c | out: lpRect=0x2ade6c) returned 1 [0031.728] GetParent (hWnd=0x70196) returned 0x201c4 [0031.728] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ade6c, cPoints=0x2 | out: lpPoints=0x2ade6c) returned -10092677 [0031.728] SetWindowTextW (hWnd=0x70196, lpString="5") returned 1 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0xc, wParam=0x0, lParam=0x193e0d8) returned 0x1 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x5, wParam=0x0, lParam=0x270025) returned 0x0 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x3, wParam=0x0, lParam=0x12200cb) returned 0x0 [0031.728] GetClientRect (in: hWnd=0x70196, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.728] GetWindowRect (in: hWnd=0x70196, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.728] GetParent (hWnd=0x70196) returned 0x201c4 [0031.728] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adf30, cPoints=0x2 | out: lpPoints=0x2adf30) returned -10092677 [0031.728] SendMessageW (hWnd=0x70196, Msg=0x2210, wParam=0x1960001, lParam=0x70196) returned 0x0 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x2210, wParam=0x1960001, lParam=0x70196) returned 0x0 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.728] GetParent (hWnd=0x70196) returned 0x201c4 [0031.728] SetParent (hWndChild=0x201c8, hWndNewParent=0x201c4) returned 0x201c2 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.728] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x3, wParam=0x0, lParam=0x20800d1) returned 0x0 [0031.729] GetClientRect (in: hWnd=0x201c8, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.729] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.729] GetParent (hWnd=0x201c8) returned 0x201c4 [0031.729] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.729] GetClientRect (in: hWnd=0x201c8, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.729] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.729] GetParent (hWnd=0x201c8) returned 0x201c4 [0031.729] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.729] GetParent (hWnd=0x201c8) returned 0x201c4 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.729] GetWindow (hWnd=0x201c8, uCmd=0x3) returned 0x0 [0031.729] SetWindowPos (hWnd=0x201c8, hWndInsertAfter=0x70196, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.729] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.729] GetClientRect (in: hWnd=0x201c8, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.729] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.729] GetParent (hWnd=0x201c8) returned 0x201c4 [0031.729] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.729] GetParent (hWnd=0x201c8) returned 0x201c4 [0031.730] GetWindow (hWnd=0x201c8, uCmd=0x3) returned 0x70196 [0031.730] GetFocus () returned 0x201c4 [0031.730] IsChild (hWndParent=0x201c8, hWnd=0x201c4) returned 0 [0031.730] GetParent (hWnd=0x201c8) returned 0x201c4 [0031.730] GetWindowLongW (hWnd=0x201c8, nIndex=-20) returned 0 [0031.730] DestroyWindow (hWnd=0x201c8) returned 1 [0031.730] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.730] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x1c80002, lParam=0x201c8) returned 0x0 [0031.730] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.730] GetWindowTextLengthW (hWnd=0x201c8) returned 0 [0031.730] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.730] GetSystemMetrics (nIndex=42) returned 0 [0031.730] GetWindowTextW (in: hWnd=0x201c8, lpString=0x2ae2dc, nMaxCount=1 | out: lpString="") returned 0 [0031.730] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0xd, wParam=0x1, lParam=0x2ae2dc) returned 0x0 [0031.730] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.730] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.730] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.731] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.731] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.731] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=209, Y=520, nWidth=0, nHeight=40, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x301c8 [0031.731] SetWindowLongW (hWnd=0x301c8, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.731] GetWindowLongW (hWnd=0x301c8, nIndex=-4) returned 1949808841 [0031.731] SetWindowLongW (hWnd=0x301c8, nIndex=-4, dwNewLong=23508654) returned 1949808841 [0031.731] GetWindowLongW (hWnd=0x301c8, nIndex=-4) returned 23508654 [0031.731] GetWindowLongW (hWnd=0x301c8, nIndex=-16) returned 1174405133 [0031.731] GetWindowLongW (hWnd=0x301c8, nIndex=-12) returned 0 [0031.731] SetWindowLongW (hWnd=0x301c8, nIndex=-12, dwNewLong=197064) returned 0 [0031.731] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x81, wParam=0x0, lParam=0x2ae138) returned 0x1 [0031.731] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x83, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.731] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x1, wParam=0x0, lParam=0x2ae138) returned 0x0 [0031.731] GetWindow (hWnd=0x301c8, uCmd=0x3) returned 0x70196 [0031.731] GetClientRect (in: hWnd=0x301c8, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.731] GetWindowRect (in: hWnd=0x301c8, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.732] GetParent (hWnd=0x301c8) returned 0x201c4 [0031.732] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ade78, cPoints=0x2 | out: lpPoints=0x2ade78) returned -10092677 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x3, wParam=0x0, lParam=0x20800d1) returned 0x0 [0031.732] GetClientRect (in: hWnd=0x301c8, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.732] GetWindowRect (in: hWnd=0x301c8, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.732] GetParent (hWnd=0x301c8) returned 0x201c4 [0031.732] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adf30, cPoints=0x2 | out: lpPoints=0x2adf30) returned -10092677 [0031.732] SendMessageW (hWnd=0x301c8, Msg=0x2210, wParam=0x1c80001, lParam=0x301c8) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x2210, wParam=0x1c80001, lParam=0x301c8) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.732] GetParent (hWnd=0x301c8) returned 0x201c4 [0031.732] SetParent (hWndChild=0x201c6, hWndNewParent=0x201c4) returned 0x201c2 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.732] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x3, wParam=0x0, lParam=0x208008b) returned 0x0 [0031.732] GetClientRect (in: hWnd=0x201c6, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.733] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.733] GetParent (hWnd=0x201c6) returned 0x201c4 [0031.733] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.733] GetClientRect (in: hWnd=0x201c6, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.733] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.733] GetParent (hWnd=0x201c6) returned 0x201c4 [0031.733] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.733] GetParent (hWnd=0x201c6) returned 0x201c4 [0031.733] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.733] GetWindow (hWnd=0x201c6, uCmd=0x3) returned 0x0 [0031.733] SetWindowPos (hWnd=0x201c6, hWndInsertAfter=0x301c8, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.733] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.733] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.733] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.733] GetClientRect (in: hWnd=0x201c6, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.733] GetWindowRect (in: hWnd=0x201c6, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.733] GetParent (hWnd=0x201c6) returned 0x201c4 [0031.733] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.733] GetParent (hWnd=0x201c6) returned 0x201c4 [0031.733] GetWindow (hWnd=0x201c6, uCmd=0x3) returned 0x301c8 [0031.733] GetFocus () returned 0x201c4 [0031.733] IsChild (hWndParent=0x201c6, hWnd=0x201c4) returned 0 [0031.733] GetParent (hWnd=0x201c6) returned 0x201c4 [0031.733] GetWindowLongW (hWnd=0x201c6, nIndex=-20) returned 0 [0031.733] DestroyWindow (hWnd=0x201c6) returned 1 [0031.733] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.734] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x1c60002, lParam=0x201c6) returned 0x0 [0031.734] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.734] GetWindowTextLengthW (hWnd=0x201c6) returned 0 [0031.734] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.734] GetSystemMetrics (nIndex=42) returned 0 [0031.734] GetWindowTextW (in: hWnd=0x201c6, lpString=0x2ae2dc, nMaxCount=1 | out: lpString="") returned 0 [0031.734] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0xd, wParam=0x1, lParam=0x2ae2dc) returned 0x0 [0031.734] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.734] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201c6, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.734] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.734] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.734] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.734] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=139, Y=520, nWidth=0, nHeight=40, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x301c6 [0031.734] SetWindowLongW (hWnd=0x301c6, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.735] GetWindowLongW (hWnd=0x301c6, nIndex=-4) returned 1949808841 [0031.735] SetWindowLongW (hWnd=0x301c6, nIndex=-4, dwNewLong=23508694) returned 1949808841 [0031.735] GetWindowLongW (hWnd=0x301c6, nIndex=-4) returned 23508694 [0031.735] GetWindowLongW (hWnd=0x301c6, nIndex=-16) returned 1174405133 [0031.735] GetWindowLongW (hWnd=0x301c6, nIndex=-12) returned 0 [0031.735] SetWindowLongW (hWnd=0x301c6, nIndex=-12, dwNewLong=197062) returned 0 [0031.735] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x81, wParam=0x0, lParam=0x2ae138) returned 0x1 [0031.735] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x83, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.735] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x1, wParam=0x0, lParam=0x2ae138) returned 0x0 [0031.735] GetWindow (hWnd=0x301c6, uCmd=0x3) returned 0x301c8 [0031.735] GetClientRect (in: hWnd=0x301c6, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.735] GetWindowRect (in: hWnd=0x301c6, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.735] GetParent (hWnd=0x301c6) returned 0x201c4 [0031.735] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ade78, cPoints=0x2 | out: lpPoints=0x2ade78) returned -10092677 [0031.735] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.735] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x3, wParam=0x0, lParam=0x208008b) returned 0x0 [0031.735] GetClientRect (in: hWnd=0x301c6, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.735] GetWindowRect (in: hWnd=0x301c6, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.736] GetParent (hWnd=0x301c6) returned 0x201c4 [0031.736] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adf30, cPoints=0x2 | out: lpPoints=0x2adf30) returned -10092677 [0031.736] SendMessageW (hWnd=0x301c6, Msg=0x2210, wParam=0x1c60001, lParam=0x301c6) returned 0x0 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x2210, wParam=0x1c60001, lParam=0x301c6) returned 0x0 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.736] GetParent (hWnd=0x301c6) returned 0x201c4 [0031.736] SetParent (hWndChild=0x30198, hWndNewParent=0x201c4) returned 0x201c2 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.736] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x3, wParam=0x0, lParam=0x20800f0) returned 0x0 [0031.736] GetClientRect (in: hWnd=0x30198, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.736] GetWindowRect (in: hWnd=0x30198, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.736] GetParent (hWnd=0x30198) returned 0x201c4 [0031.736] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.736] GetClientRect (in: hWnd=0x30198, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.737] GetWindowRect (in: hWnd=0x30198, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.737] GetParent (hWnd=0x30198) returned 0x201c4 [0031.737] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.737] GetParent (hWnd=0x30198) returned 0x201c4 [0031.737] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.737] GetWindow (hWnd=0x30198, uCmd=0x3) returned 0x0 [0031.737] SetWindowPos (hWnd=0x30198, hWndInsertAfter=0x301c6, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0031.737] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.737] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.737] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.737] GetClientRect (in: hWnd=0x30198, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.737] GetWindowRect (in: hWnd=0x30198, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.737] GetParent (hWnd=0x30198) returned 0x201c4 [0031.737] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.737] GetParent (hWnd=0x30198) returned 0x201c4 [0031.737] GetWindow (hWnd=0x30198, uCmd=0x3) returned 0x301c6 [0031.737] GetFocus () returned 0x201c4 [0031.737] IsChild (hWndParent=0x30198, hWnd=0x201c4) returned 0 [0031.737] GetParent (hWnd=0x30198) returned 0x201c4 [0031.737] GetWindowLongW (hWnd=0x30198, nIndex=-20) returned 0 [0031.737] DestroyWindow (hWnd=0x30198) returned 1 [0031.737] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.737] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x1980002, lParam=0x30198) returned 0x0 [0031.737] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.738] GetWindowTextLengthW (hWnd=0x30198) returned 0 [0031.738] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.738] GetSystemMetrics (nIndex=42) returned 0 [0031.738] GetWindowTextW (in: hWnd=0x30198, lpString=0x2ae2dc, nMaxCount=1 | out: lpString="") returned 0 [0031.738] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0xd, wParam=0x1, lParam=0x2ae2dc) returned 0x0 [0031.738] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.738] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x30198, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.738] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.738] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.738] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.738] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=240, Y=520, nWidth=0, nHeight=40, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x40198 [0031.738] SetWindowLongW (hWnd=0x40198, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.739] GetWindowLongW (hWnd=0x40198, nIndex=-4) returned 1949808841 [0031.739] SetWindowLongW (hWnd=0x40198, nIndex=-4, dwNewLong=23508734) returned 1949808841 [0031.739] GetWindowLongW (hWnd=0x40198, nIndex=-4) returned 23508734 [0031.739] GetWindowLongW (hWnd=0x40198, nIndex=-16) returned 1174405133 [0031.739] GetWindowLongW (hWnd=0x40198, nIndex=-12) returned 0 [0031.739] SetWindowLongW (hWnd=0x40198, nIndex=-12, dwNewLong=262552) returned 0 [0031.739] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x81, wParam=0x0, lParam=0x2ae138) returned 0x1 [0031.739] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x83, wParam=0x0, lParam=0x2ae1bc) returned 0x0 [0031.739] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x1, wParam=0x0, lParam=0x2ae138) returned 0x0 [0031.739] GetWindow (hWnd=0x40198, uCmd=0x3) returned 0x301c6 [0031.739] GetClientRect (in: hWnd=0x40198, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.739] GetWindowRect (in: hWnd=0x40198, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.739] GetParent (hWnd=0x40198) returned 0x201c4 [0031.739] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ade78, cPoints=0x2 | out: lpPoints=0x2ade78) returned -10092677 [0031.739] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x5, wParam=0x0, lParam=0x280000) returned 0x0 [0031.739] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x3, wParam=0x0, lParam=0x20800f0) returned 0x0 [0031.740] GetClientRect (in: hWnd=0x40198, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.740] GetWindowRect (in: hWnd=0x40198, lpRect=0x2adf30 | out: lpRect=0x2adf30) returned 1 [0031.740] GetParent (hWnd=0x40198) returned 0x201c4 [0031.740] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adf30, cPoints=0x2 | out: lpPoints=0x2adf30) returned -10092677 [0031.740] SendMessageW (hWnd=0x40198, Msg=0x2210, wParam=0x1980001, lParam=0x40198) returned 0x0 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x2210, wParam=0x1980001, lParam=0x40198) returned 0x0 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.740] GetParent (hWnd=0x40198) returned 0x201c4 [0031.740] SetParent (hWndChild=0x3019a, hWndNewParent=0x201c4) returned 0x201c2 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x46, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x47, wParam=0x0, lParam=0x2ae75c) returned 0x0 [0031.740] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x3, wParam=0x0, lParam=0x20800a9) returned 0x0 [0031.740] GetClientRect (in: hWnd=0x3019a, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.740] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2adfa0 | out: lpRect=0x2adfa0) returned 1 [0031.740] GetParent (hWnd=0x3019a) returned 0x201c4 [0031.740] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2adfa0, cPoints=0x2 | out: lpPoints=0x2adfa0) returned -10092677 [0031.740] GetClientRect (in: hWnd=0x3019a, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.740] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2ae4b8 | out: lpRect=0x2ae4b8) returned 1 [0031.740] GetParent (hWnd=0x3019a) returned 0x201c4 [0031.740] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae4b8, cPoints=0x2 | out: lpPoints=0x2ae4b8) returned -10092677 [0031.740] GetParent (hWnd=0x3019a) returned 0x201c4 [0031.741] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0031.741] GetWindow (hWnd=0x3019a, uCmd=0x3) returned 0x0 [0031.741] SetWindowPos (hWnd=0x3019a, hWndInsertAfter=0x40198, X=0, Y=0, cx=0, cy=0, uFlags=0x3) [0031.741] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.741] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0031.741] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.741] GetClientRect (in: hWnd=0x3019a, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.741] GetWindowRect (in: hWnd=0x3019a, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.741] GetParent (hWnd=0x3019a) returned 0x201c4 [0031.741] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.741] GetParent (hWnd=0x3019a) returned 0x201c4 [0031.741] GetWindow (hWnd=0x3019a, uCmd=0x3) returned 0x40198 [0031.741] GetFocus () returned 0x201c4 [0031.741] IsChild (hWndParent=0x3019a, hWnd=0x201c4) returned 0 [0031.742] GetParent (hWnd=0x3019a) returned 0x201c4 [0031.742] GetWindowLongW (hWnd=0x3019a, nIndex=-20) returned 0 [0031.742] DestroyWindow (hWnd=0x3019a) [0031.742] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.742] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x210, wParam=0x19a0002, lParam=0x3019a) returned 0x0 [0031.742] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0031.742] GetWindowTextLengthW (hWnd=0x3019a) [0031.742] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.742] GetWindowTextW (hWnd=0x3019a, lpString=0x2ae2dc, nMaxCount=1) [0031.742] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0xd, wParam=0x1, lParam=0x2ae2dc) returned 0x0 [0031.742] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0031.742] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x3019a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0031.743] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.743] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.743] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.743] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=169, Y=520, nWidth=0, nHeight=40, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) [0031.743] SetWindowLongW (hWnd=0x4019a, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.743] GetWindowLongW (hWnd=0x4019a, nIndex=-4) returned 1949808841 [0031.743] SetWindowLongW (hWnd=0x4019a, nIndex=-4, dwNewLong=23508774) returned 1949808841 [0031.743] GetWindowLongW (hWnd=0x4019a, nIndex=-4) returned 23508774 [0031.743] GetWindowLongW (hWnd=0x4019a, nIndex=-16) returned 1174405133 [0031.743] GetWindowLongW (hWnd=0x4019a, nIndex=-12) returned 0 [0031.743] SetWindowLongW (hWnd=0x4019a, nIndex=-12, dwNewLong=262554) returned 0 [0031.744] GetWindow (hWnd=0x4019a, uCmd=0x3) returned 0x40198 [0031.744] GetClientRect (in: hWnd=0x4019a, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.744] GetWindowRect (in: hWnd=0x4019a, lpRect=0x2ade78 | out: lpRect=0x2ade78) returned 1 [0031.744] GetParent (hWnd=0x4019a) returned 0x201c4 [0031.744] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ade78, cPoints=0x2 | out: lpPoints=0x2ade78) returned -10092677 [0031.744] SendMessageW (hWnd=0x4019a, Msg=0x2210, wParam=0x19a0001, lParam=0x4019a) [0031.747] GetWindowTextLengthW (hWnd=0x301bc) [0031.747] GetCurrentActCtx (in: lphActCtx=0x2ae6ec | out: lphActCtx=0x2ae6ec*=0xb3664) returned 1 [0031.748] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.748] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0031.748] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=99, Y=520, nWidth=0, nHeight=40, hWndParent=0x201c4, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) [0031.748] SetWindowLongW (hWnd=0x401bc, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0031.748] GetWindowLongW (hWnd=0x401bc, nIndex=-4) returned 1949808841 [0031.748] SetWindowLongW (hWnd=0x401bc, nIndex=-4, dwNewLong=23508814) returned 1949808841 [0031.748] GetWindowLongW (hWnd=0x401bc, nIndex=-4) returned 23508814 [0031.748] GetWindowLongW (hWnd=0x401bc, nIndex=-16) returned 1174405133 [0031.748] GetWindowLongW (hWnd=0x401bc, nIndex=-12) returned 0 [0031.748] SetWindowLongW (hWnd=0x401bc, nIndex=-12, dwNewLong=262588) returned 0 [0031.749] SendMessageW (hWnd=0x401bc, Msg=0x2210, wParam=0x1bc0001, lParam=0x401bc) [0031.749] IsWindowVisible (hWnd=0x201c4) returned 0 [0031.749] IsWindowEnabled (hWnd=0x201c4) returned 1 [0031.749] GetFocus () returned 0x201c4 [0031.749] GetFocus () returned 0x201c4 [0031.749] SetWindowLongW (hWnd=0x500f8, nIndex=-8, dwNewLong=131524) returned 131524 [0031.749] GetWindowTextLengthW (hWnd=0x40190) returned 0 [0031.749] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.749] GetSystemMetrics (nIndex=42) returned 0 [0031.749] GetWindowTextW (in: hWnd=0x40190, lpString=0x2ae7f8, nMaxCount=1 | out: lpString="") returned 0 [0031.749] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xd, wParam=0x1, lParam=0x2ae7f8) returned 0x0 [0031.750] GetWindowTextLengthW (hWnd=0x40190) returned 0 [0031.750] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0031.750] GetSystemMetrics (nIndex=42) returned 0 [0031.750] GetWindowTextW (in: hWnd=0x40190, lpString=0x2ae7f4, nMaxCount=1 | out: lpString="") returned 0 [0031.750] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xd, wParam=0x1, lParam=0x2ae7f4) returned 0x0 [0031.750] SetWindowTextW (hWnd=0x40190, lpString="849276484682917374946382") returned 1 [0031.750] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xc, wParam=0x0, lParam=0x193c5cc) returned 0x1 [0031.750] GetWindowTextLengthW (hWnd=0x40190) returned 24 [0031.750] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0031.750] GetSystemMetrics (nIndex=42) returned 0 [0031.750] GetWindowTextW (in: hWnd=0x40190, lpString=0x2ae6e8, nMaxCount=25 | out: lpString="849276484682917374946382") returned 24 [0031.750] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xd, wParam=0x19, lParam=0x2ae6e8) returned 0x18 [0031.750] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0031.750] AdjustWindowRectEx (in: lpRect=0x2ae69c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae69c) returned 1 [0031.750] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2ae718, fWinIni=0x0 | out: pvParam=0x2ae718) returned 1 [0031.750] SendMessageW (hWnd=0x201c4, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0031.750] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0031.750] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.750] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40192, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x40192, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x40190, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x70196, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x70196, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c8, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x301c8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x301c6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x301c6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40198, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x40198, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x4019a, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x4019a, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x401bc, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0031.751] RedrawWindow (hWnd=0x401bc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] RedrawWindow (hWnd=0x201c4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0031.751] InvalidateRect (hWnd=0x40192, lpRect=0x2adf70, bErase=1) returned 1 [0031.751] InvalidateRect (hWnd=0x301c8, lpRect=0x2adf70, bErase=1) returned 1 [0031.751] InvalidateRect (hWnd=0x301c6, lpRect=0x2adf70, bErase=1) returned 1 [0031.751] InvalidateRect (hWnd=0x40198, lpRect=0x2adf70, bErase=1) returned 1 [0031.751] InvalidateRect (hWnd=0x4019a, lpRect=0x2adf70, bErase=1) returned 1 [0031.751] InvalidateRect (hWnd=0x401bc, lpRect=0x2adf70, bErase=1) returned 1 [0031.751] SelectObject (hdc=0x21010238, h=0x600a0230) returned 0x460a0272 [0031.751] DeleteObject (ho=0x460a0272) returned 1 [0031.751] DrawTextExW (in: hdc=0x21010238, lpchText="849276484682917374946382", cchText=24, lprc=0x2ae684, format=0x102400, lpdtp=0x193f584 | out: lpchText="849276484682917374946382", lprc=0x2ae684) returned 39 [0031.752] SetWindowPos (hWnd=0x40190, hWndInsertAfter=0x0, X=99, Y=421, cx=497, cy=39, uFlags=0x16) returned 1 [0031.752] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x46, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.752] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x83, wParam=0x1, lParam=0x2ae6d8) returned 0x0 [0031.752] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x47, wParam=0x0, lParam=0x2ae704) returned 0x0 [0031.752] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0x5, wParam=0x0, lParam=0x2701f1) returned 0x0 [0031.752] GetClientRect (in: hWnd=0x40190, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.752] GetWindowRect (in: hWnd=0x40190, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0031.752] GetParent (hWnd=0x40190) returned 0x201c4 [0031.752] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c4, lpPoints=0x2ae460, cPoints=0x2 | out: lpPoints=0x2ae460) returned -10092677 [0031.753] InvalidateRect (hWnd=0x40190, lpRect=0x0, bErase=1) returned 1 [0031.753] GetWindowTextLengthW (hWnd=0x40190) returned 24 [0031.753] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0031.753] GetSystemMetrics (nIndex=42) returned 0 [0031.753] GetWindowTextW (in: hWnd=0x40190, lpString=0x2ae2c0, nMaxCount=25 | out: lpString="849276484682917374946382") returned 24 [0031.753] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x40190, Msg=0xd, wParam=0x19, lParam=0x2ae2c0) returned 0x18 [0031.753] GetParent (hWnd=0x40190) returned 0x201c4 [0031.753] InvalidateRect (hWnd=0x40190, lpRect=0x0, bErase=1) returned 1 [0031.753] GetWindowTextLengthW (hWnd=0x201c4) returned 19 [0031.753] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0031.753] GetSystemMetrics (nIndex=42) returned 0 [0031.753] GetWindowTextW (in: hWnd=0x201c4, lpString=0x2ae718, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0031.753] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xd, wParam=0x14, lParam=0x2ae718) returned 0x13 [0032.295] GetUserNameW (in: lpBuffer=0x2ae600, pcbBuffer=0x2ae878 | out: lpBuffer="EEBsYm5", pcbBuffer=0x2ae878) returned 1 [0032.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae7b8) returned 1 [0032.540] GetFullPathNameW (in: lpFileName="\\", nBufferLength=0x105, lpBuffer=0x2ae2c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0032.541] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2ae294, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0032.758] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ae4e0 | out: lpFindFileData=0x2ae4e0) returned 0xbe7d8 [0032.758] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.759] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.760] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 0 [0032.760] FindClose (in: hFindFile=0xbe7d8 | out: hFindFile=0xbe7d8) returned 1 [0032.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae778) returned 1 [0032.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae784) returned 1 [0032.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae7b8) returned 1 [0032.761] GetFullPathNameW (in: lpFileName="\\", nBufferLength=0x105, lpBuffer=0x2ae2c0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0032.761] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2ae294, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0032.761] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ae4e0 | out: lpFindFileData=0x2ae4e0) returned 0xbe7d8 [0032.761] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.761] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.761] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.761] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.762] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.763] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.763] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.763] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.763] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 1 [0032.763] FindNextFileW (in: hFindFile=0xbe7d8, lpFindFileData=0x2ae4f0 | out: lpFindFileData=0x2ae4f0) returned 0 [0032.763] FindClose (in: hFindFile=0xbe7d8 | out: hFindFile=0xbe7d8) returned 1 [0032.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae778) returned 1 [0032.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae784) returned 1 [0032.905] GetFullPathNameW (in: lpFileName="\\autoexec.bat", nBufferLength=0x105, lpBuffer=0x2ae188, lpFilePart=0x0 | out: lpBuffer="C:\\autoexec.bat", lpFilePart=0x0) returned 0xf [0032.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae67c) returned 1 [0032.906] CreateFileW (lpFileName="C:\\autoexec.bat" (normalized: "c:\\autoexec.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x248 [0032.907] GetFileType (hFile=0x248) returned 0x1 [0032.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae678) returned 1 [0032.907] GetFileType (hFile=0x248) returned 0x1 [0032.907] GetFileSize (in: hFile=0x248, lpFileSizeHigh=0x2ae784 | out: lpFileSizeHigh=0x2ae784*=0x0) returned 0x18 [0032.907] ReadFile (in: hFile=0x248, lpBuffer=0x1942588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae730, lpOverlapped=0x0 | out: lpBuffer=0x1942588*, lpNumberOfBytesRead=0x2ae730*=0x18, lpOverlapped=0x0) returned 1 [0032.908] CloseHandle (hObject=0x248) returned 1 [0032.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ae13c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0032.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ae1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0032.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae600) returned 1 [0032.979] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x2ae67c | out: lpFileInformation=0x2ae67c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56012300, ftCreationTime.dwHighDateTime=0x1cd5d59, ftLastAccessTime.dwLowDateTime=0x50f67aa0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x56012300, ftLastWriteTime.dwHighDateTime=0x1cd5d59, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0032.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5fc) returned 1 [0033.266] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x2ae38c | out: pfEnabled=0x2ae38c) returned 0x0 [0033.610] GetFullPathNameW (in: lpFileName="\\autoexec.bat", nBufferLength=0x105, lpBuffer=0x2ae174, lpFilePart=0x0 | out: lpBuffer="C:\\autoexec.bat", lpFilePart=0x0) returned 0xf [0033.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae668) returned 1 [0033.610] CreateFileW (lpFileName="C:\\autoexec.bat" (normalized: "c:\\autoexec.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.612] GetFileType (hFile=0x264) returned 0x1 [0033.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae664) returned 1 [0033.612] GetFileType (hFile=0x264) returned 0x1 [0033.612] WriteFile (in: hFile=0x264, lpBuffer=0x19ba884*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ae6f8, lpOverlapped=0x0 | out: lpBuffer=0x19ba884*, lpNumberOfBytesWritten=0x2ae6f8*=0x20, lpOverlapped=0x0) returned 1 [0033.613] CloseHandle (hObject=0x264) returned 1 [0033.614] GetFullPathNameW (in: lpFileName="\\autoexec.bat", nBufferLength=0x105, lpBuffer=0x2ae2a8, lpFilePart=0x0 | out: lpBuffer="C:\\autoexec.bat", lpFilePart=0x0) returned 0xf [0033.614] GetFullPathNameW (in: lpFileName="\\autoexec.bat.anonymous", nBufferLength=0x105, lpBuffer=0x2ae2a8, lpFilePart=0x0 | out: lpBuffer="C:\\autoexec.bat.anonymous", lpFilePart=0x0) returned 0x19 [0033.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae708) returned 1 [0033.614] GetFileAttributesExW (in: lpFileName="C:\\autoexec.bat" (normalized: "c:\\autoexec.bat"), fInfoLevelId=0x0, lpFileInformation=0x2ae784 | out: lpFileInformation=0x2ae784*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cdb0de4, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5cdb0de4, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xb2fe74b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20)) returned 1 [0033.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.617] MoveFileW (lpExistingFileName="C:\\autoexec.bat" (normalized: "c:\\autoexec.bat"), lpNewFileName="C:\\autoexec.bat.anonymous" (normalized: "c:\\autoexec.bat.anonymous")) returned 1 [0033.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.617] GetFullPathNameW (in: lpFileName="\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0033.617] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0033.617] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbe9d8 [0033.617] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.618] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.618] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0033.618] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0033.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.618] GetFullPathNameW (in: lpFileName="\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0033.618] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0033.618] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbe9d8 [0033.618] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.618] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.619] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0033.619] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0033.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.619] GetFullPathNameW (in: lpFileName="\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000", lpFilePart=0x0) returned 0x3d [0033.619] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000\\", lpFilePart=0x0) returned 0x3e [0033.619] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.619] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.619] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.619] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.619] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.620] GetFullPathNameW (in: lpFileName="\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000", lpFilePart=0x0) returned 0x3d [0033.620] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000\\", lpFilePart=0x0) returned 0x3e [0033.620] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3785418085-2572485238-895829336-1000\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.620] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.620] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.620] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.620] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.620] GetFullPathNameW (in: lpFileName="\\Boot", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0033.620] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0033.621] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbe9d8 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.621] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.622] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.623] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.624] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.624] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.624] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.624] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.624] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.624] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0033.625] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0033.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.625] GetFullPathNameW (in: lpFileName="\\Boot", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0033.625] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0033.625] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbe9d8 [0033.625] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.626] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.626] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.626] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.626] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.626] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.626] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.627] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.627] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.627] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.627] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.627] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.627] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.628] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.629] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.630] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.630] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.630] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0033.630] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0033.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.630] GetFullPathNameW (in: lpFileName="\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0033.630] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0033.630] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.632] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.632] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.632] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.632] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.632] GetFullPathNameW (in: lpFileName="\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0033.632] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0033.632] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.633] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.633] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.633] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.633] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.633] GetFullPathNameW (in: lpFileName="\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0033.633] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0033.634] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.634] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.635] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.635] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.635] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.635] GetFullPathNameW (in: lpFileName="\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0033.635] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0033.635] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.636] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.636] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.636] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.636] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.636] GetFullPathNameW (in: lpFileName="\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0033.636] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0033.637] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.637] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.638] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.638] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.638] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.638] GetFullPathNameW (in: lpFileName="\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0033.638] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0033.638] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.639] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.639] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.639] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.639] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.639] GetFullPathNameW (in: lpFileName="\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0033.639] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0033.640] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.640] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.640] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.640] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.640] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.641] GetFullPathNameW (in: lpFileName="\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0033.641] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0033.641] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.641] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.642] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.642] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.642] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.642] GetFullPathNameW (in: lpFileName="\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0033.642] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0033.642] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.643] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.643] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.643] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.644] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.644] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.644] GetFullPathNameW (in: lpFileName="\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0033.644] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0033.644] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.644] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.645] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.645] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.645] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.645] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.645] GetFullPathNameW (in: lpFileName="\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0033.645] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0033.645] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.646] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.646] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.646] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.646] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.646] GetFullPathNameW (in: lpFileName="\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0033.646] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0033.646] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.647] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.647] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.647] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.647] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.647] GetFullPathNameW (in: lpFileName="\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0033.647] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0033.648] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.648] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.648] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.648] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.648] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.648] GetFullPathNameW (in: lpFileName="\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0033.648] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0033.649] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.649] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.649] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.649] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.649] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.649] GetFullPathNameW (in: lpFileName="\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0033.649] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0033.650] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.651] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.651] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.651] GetFullPathNameW (in: lpFileName="\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0033.651] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0033.651] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.652] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.652] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.652] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.652] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.652] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.652] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.653] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.653] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.653] GetFullPathNameW (in: lpFileName="\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0033.653] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0033.653] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.653] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.653] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.654] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.654] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.654] GetFullPathNameW (in: lpFileName="\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0033.654] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0033.654] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.654] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.654] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.654] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.654] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.655] GetFullPathNameW (in: lpFileName="\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0033.655] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0033.655] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.656] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.656] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.656] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.656] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.656] GetFullPathNameW (in: lpFileName="\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0033.656] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0033.656] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.657] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.657] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.657] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.657] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.657] GetFullPathNameW (in: lpFileName="\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0033.657] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0033.657] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.657] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.658] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.658] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.658] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.658] GetFullPathNameW (in: lpFileName="\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0033.658] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0033.658] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.658] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.658] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.658] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.658] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.659] GetFullPathNameW (in: lpFileName="\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0033.659] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0033.659] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.659] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.659] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.660] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.660] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.660] GetFullPathNameW (in: lpFileName="\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0033.660] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0033.660] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.660] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.660] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.660] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.660] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.660] GetFullPathNameW (in: lpFileName="\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0033.661] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0033.661] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.661] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.661] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.661] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.661] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.661] GetFullPathNameW (in: lpFileName="\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0033.661] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0033.662] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.662] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.662] GetFullPathNameW (in: lpFileName="\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0033.662] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0033.663] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.663] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.663] GetFullPathNameW (in: lpFileName="\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0033.663] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0033.663] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.664] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.664] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.664] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.664] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.664] GetFullPathNameW (in: lpFileName="\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0033.664] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0033.664] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.665] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.665] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.665] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.665] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.665] GetFullPathNameW (in: lpFileName="\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0033.665] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0033.665] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.665] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.666] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.666] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.666] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.666] GetFullPathNameW (in: lpFileName="\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0033.666] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0033.666] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.667] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.667] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.667] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.667] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.667] GetFullPathNameW (in: lpFileName="\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0033.667] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0033.667] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.667] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.668] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.668] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.668] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.668] GetFullPathNameW (in: lpFileName="\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0033.668] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0033.668] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.668] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.668] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.668] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.668] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.669] GetFullPathNameW (in: lpFileName="\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0033.669] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0033.669] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.669] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.669] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.669] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.669] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.669] GetFullPathNameW (in: lpFileName="\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0033.669] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0033.669] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.670] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.670] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.670] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.670] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.670] GetFullPathNameW (in: lpFileName="\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0033.670] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0033.670] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.670] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.670] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.670] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.671] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.671] GetFullPathNameW (in: lpFileName="\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0033.671] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0033.671] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.671] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.671] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.671] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.672] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.672] GetFullPathNameW (in: lpFileName="\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0033.672] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0033.672] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.672] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.672] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.672] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.672] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.672] GetFullPathNameW (in: lpFileName="\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0033.672] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0033.672] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.673] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.673] GetFullPathNameW (in: lpFileName="\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0033.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0033.673] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.673] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.673] GetFullPathNameW (in: lpFileName="\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0033.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0033.673] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.674] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.674] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.674] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.674] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.674] GetFullPathNameW (in: lpFileName="\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0033.675] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0033.675] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.675] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.675] GetFullPathNameW (in: lpFileName="\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0033.675] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0033.675] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.676] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.676] GetFullPathNameW (in: lpFileName="\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0033.676] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0033.676] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.676] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.676] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.676] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.676] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.676] GetFullPathNameW (in: lpFileName="\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0033.676] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0033.676] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.678] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.678] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.678] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.678] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.678] GetFullPathNameW (in: lpFileName="\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0033.678] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0033.678] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.678] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.678] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.678] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.678] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.678] GetFullPathNameW (in: lpFileName="\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0033.678] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0033.678] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.679] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.679] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.679] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.679] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.679] GetFullPathNameW (in: lpFileName="\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0033.679] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0033.679] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.679] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.679] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.679] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.679] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.679] GetFullPathNameW (in: lpFileName="\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0033.679] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a [0033.679] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xffffffff [0033.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae708) returned 1 [0033.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.705] GetFullPathNameW (in: lpFileName="\\MSOCache", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0033.705] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0033.705] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbe9d8 [0033.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0033.706] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0033.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0033.706] GetFullPathNameW (in: lpFileName="\\MSOCache", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0033.706] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0033.706] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbe9d8 [0033.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0033.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0033.706] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0033.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0033.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.707] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0033.707] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0033.707] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.716] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.716] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.716] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.716] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.716] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.716] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.717] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.717] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0033.718] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0033.718] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0033.718] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0033.719] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.719] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.719] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.719] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0033.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0033.721] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0033.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0033.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0033.722] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.722] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.722] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe9d8 [0033.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0033.728] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0033.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0033.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0033.728] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.728] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe9d8 [0033.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0033.729] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0033.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0033.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0033.729] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0033.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0033.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.730] GetFileType (hFile=0x264) returned 0x1 [0033.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0033.730] GetFileType (hFile=0x264) returned 0x1 [0033.730] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x61d [0033.730] ReadFile (in: hFile=0x264, lpBuffer=0x19de9dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19de9dc*, lpNumberOfBytesRead=0x2ae5d4*=0x61d, lpOverlapped=0x0) returned 1 [0033.736] CloseHandle (hObject=0x264) returned 1 [0033.775] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0033.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0033.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.777] GetFileType (hFile=0x264) returned 0x1 [0033.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0033.777] GetFileType (hFile=0x264) returned 0x1 [0033.777] WriteFile (in: hFile=0x264, lpBuffer=0x1a2e79c*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a2e79c*, lpNumberOfBytesWritten=0x2ae59c*=0x620, lpOverlapped=0x0) returned 1 [0033.778] CloseHandle (hObject=0x264) returned 1 [0033.779] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0033.779] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.anonymous", lpFilePart=0x0) returned 0x55 [0033.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0033.779] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3164270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x620)) returned 1 [0033.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0033.779] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\excelmui.xml.anonymous")) returned 1 [0033.781] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0033.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.782] GetFileType (hFile=0x264) returned 0x1 [0033.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0033.782] GetFileType (hFile=0x264) returned 0x1 [0033.782] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x8f8 [0033.782] ReadFile (in: hFile=0x264, lpBuffer=0x1a303f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a303f0*, lpNumberOfBytesRead=0x2ae5d4*=0x8f8, lpOverlapped=0x0) returned 1 [0033.790] CloseHandle (hObject=0x264) returned 1 [0033.807] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0033.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.808] GetFileType (hFile=0x264) returned 0x1 [0033.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0033.808] GetFileType (hFile=0x264) returned 0x1 [0033.809] WriteFile (in: hFile=0x264, lpBuffer=0x1a81008*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a81008*, lpNumberOfBytesWritten=0x2ae59c*=0x900, lpOverlapped=0x0) returned 1 [0033.810] CloseHandle (hObject=0x264) returned 1 [0033.810] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.810] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0033.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0033.810] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb31b0530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x900)) returned 1 [0033.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0033.811] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0033.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0033.811] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.811] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.811] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0033.823] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.823] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.823] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.823] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.823] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.823] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0033.823] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0033.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0033.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0033.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0033.824] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.824] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.825] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0033.826] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.826] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.826] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.826] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.826] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.826] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0033.826] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0033.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0033.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0033.827] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0033.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0033.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.828] GetFileType (hFile=0x264) returned 0x1 [0033.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0033.829] GetFileType (hFile=0x264) returned 0x1 [0033.829] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x615 [0033.829] ReadFile (in: hFile=0x264, lpBuffer=0x1a84bdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a84bdc*, lpNumberOfBytesRead=0x2ae5d4*=0x615, lpOverlapped=0x0) returned 1 [0033.834] CloseHandle (hObject=0x264) returned 1 [0033.855] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0033.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0033.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.856] GetFileType (hFile=0x264) returned 0x1 [0033.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0033.857] GetFileType (hFile=0x264) returned 0x1 [0033.857] WriteFile (in: hFile=0x264, lpBuffer=0x1ad49b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ad49b8*, lpNumberOfBytesWritten=0x2ae59c*=0x620, lpOverlapped=0x0) returned 1 [0033.858] CloseHandle (hObject=0x264) returned 1 [0033.858] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0033.858] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.anonymous", lpFilePart=0x0) returned 0x5a [0033.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0033.858] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3248ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x620)) returned 1 [0033.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0033.859] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\powerpointmui.xml.anonymous")) returned 1 [0033.859] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0033.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.860] GetFileType (hFile=0x264) returned 0x1 [0033.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0033.860] GetFileType (hFile=0x264) returned 0x1 [0033.860] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x75e [0033.860] ReadFile (in: hFile=0x264, lpBuffer=0x1ad64b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ad64b0*, lpNumberOfBytesRead=0x2ae5d4*=0x75e, lpOverlapped=0x0) returned 1 [0033.862] CloseHandle (hObject=0x264) returned 1 [0033.934] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0033.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.940] GetFileType (hFile=0x264) returned 0x1 [0033.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0033.940] GetFileType (hFile=0x264) returned 0x1 [0033.940] WriteFile (in: hFile=0x264, lpBuffer=0x1941d38*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1941d38*, lpNumberOfBytesWritten=0x2ae59c*=0x760, lpOverlapped=0x0) returned 1 [0033.941] CloseHandle (hObject=0x264) returned 1 [0033.942] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.942] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0033.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0033.942] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3307190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0033.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0033.943] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0033.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0033.943] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.943] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.943] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0033.955] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.955] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.955] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.955] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.955] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.955] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0033.955] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0033.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0033.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0033.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0033.956] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.956] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.956] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0033.957] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.958] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.958] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.958] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.958] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0033.958] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0033.958] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0033.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0033.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0033.959] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0033.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0033.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.960] GetFileType (hFile=0x264) returned 0x1 [0033.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0033.960] GetFileType (hFile=0x264) returned 0x1 [0033.960] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x5aa [0033.960] ReadFile (in: hFile=0x264, lpBuffer=0x194587c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x194587c*, lpNumberOfBytesRead=0x2ae5d4*=0x5aa, lpOverlapped=0x0) returned 1 [0033.962] CloseHandle (hObject=0x264) returned 1 [0033.974] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0033.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0033.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.975] GetFileType (hFile=0x264) returned 0x1 [0033.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0033.975] GetFileType (hFile=0x264) returned 0x1 [0033.975] WriteFile (in: hFile=0x264, lpBuffer=0x199557c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x199557c*, lpNumberOfBytesWritten=0x2ae59c*=0x5b0, lpOverlapped=0x0) returned 1 [0033.976] CloseHandle (hObject=0x264) returned 1 [0033.977] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0033.977] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.anonymous", lpFilePart=0x0) returned 0x59 [0033.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0033.977] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3353450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0033.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0033.977] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\publishermui.xml.anonymous")) returned 1 [0033.979] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0033.979] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0033.979] GetFileType (hFile=0x264) returned 0x1 [0033.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0033.980] GetFileType (hFile=0x264) returned 0x1 [0033.980] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x648 [0033.980] ReadFile (in: hFile=0x264, lpBuffer=0x1996f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1996f50*, lpNumberOfBytesRead=0x2ae5d4*=0x648, lpOverlapped=0x0) returned 1 [0033.995] CloseHandle (hObject=0x264) returned 1 [0034.007] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.008] GetFileType (hFile=0x264) returned 0x1 [0034.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.008] GetFileType (hFile=0x264) returned 0x1 [0034.008] WriteFile (in: hFile=0x264, lpBuffer=0x19e6df8*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x19e6df8*, lpNumberOfBytesWritten=0x2ae59c*=0x650, lpOverlapped=0x0) returned 1 [0034.009] CloseHandle (hObject=0x264) returned 1 [0034.010] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.010] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.010] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb339f710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1 [0034.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.010] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.011] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.011] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.011] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0034.022] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.022] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.022] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.022] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.022] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.022] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.022] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0034.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.023] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.023] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.024] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0034.025] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.025] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.025] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.025] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.025] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.025] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.025] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0034.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.026] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0034.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.028] GetFileType (hFile=0x264) returned 0x1 [0034.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.028] GetFileType (hFile=0x264) returned 0x1 [0034.028] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xc72 [0034.028] ReadFile (in: hFile=0x264, lpBuffer=0x19eaffc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19eaffc*, lpNumberOfBytesRead=0x2ae5d4*=0xc72, lpOverlapped=0x0) returned 1 [0034.053] CloseHandle (hObject=0x264) returned 1 [0034.065] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0034.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.066] GetFileType (hFile=0x264) returned 0x1 [0034.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.066] GetFileType (hFile=0x264) returned 0x1 [0034.066] WriteFile (in: hFile=0x264, lpBuffer=0x1a3cdb0*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a3cdb0*, lpNumberOfBytesWritten=0x2ae59c*=0xc80, lpOverlapped=0x0) returned 1 [0034.067] CloseHandle (hObject=0x264) returned 1 [0034.068] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0034.068] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.anonymous", lpFilePart=0x0) returned 0x57 [0034.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.068] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3437c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1 [0034.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.068] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\outlookmui.xml.anonymous")) returned 1 [0034.069] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.069] GetFileType (hFile=0x264) returned 0x1 [0034.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.069] GetFileType (hFile=0x264) returned 0x1 [0034.069] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x106f [0034.069] ReadFile (in: hFile=0x264, lpBuffer=0x1a3e10c, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a3e10c*, lpNumberOfBytesRead=0x2ae5d4*=0x106f, lpOverlapped=0x0) returned 1 [0034.080] CloseHandle (hObject=0x264) returned 1 [0034.092] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.093] GetFileType (hFile=0x264) returned 0x1 [0034.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.093] GetFileType (hFile=0x264) returned 0x1 [0034.093] WriteFile (in: hFile=0x264, lpBuffer=0x1a90128*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a90128*, lpNumberOfBytesWritten=0x2ae5c8*=0x1070, lpOverlapped=0x0) returned 1 [0034.094] CloseHandle (hObject=0x264) returned 1 [0034.095] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.095] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.095] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3483f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1070)) returned 1 [0034.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.095] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.096] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.096] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.096] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbebd8 [0034.096] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.096] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.096] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.096] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.097] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.097] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.097] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0034.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.097] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.097] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.097] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbebd8 [0034.097] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.097] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.097] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.098] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.098] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.098] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.098] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0034.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.098] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.101] GetFileType (hFile=0x264) returned 0x1 [0034.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.101] GetFileType (hFile=0x264) returned 0x1 [0034.101] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x978 [0034.102] ReadFile (in: hFile=0x264, lpBuffer=0x1a9408c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a9408c*, lpNumberOfBytesRead=0x2ae5d4*=0x978, lpOverlapped=0x0) returned 1 [0034.109] CloseHandle (hObject=0x264) returned 1 [0034.121] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.122] GetFileType (hFile=0x264) returned 0x1 [0034.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.122] GetFileType (hFile=0x264) returned 0x1 [0034.122] WriteFile (in: hFile=0x264, lpBuffer=0x1ae4f24*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ae4f24*, lpNumberOfBytesWritten=0x2ae59c*=0x980, lpOverlapped=0x0) returned 1 [0034.124] CloseHandle (hObject=0x264) returned 1 [0034.124] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.124] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.124] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb34d0210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x980)) returned 1 [0034.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.125] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.126] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0034.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.127] GetFileType (hFile=0x264) returned 0x1 [0034.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.127] GetFileType (hFile=0x264) returned 0x1 [0034.127] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x708 [0034.127] ReadFile (in: hFile=0x264, lpBuffer=0x1ae69b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ae69b4*, lpNumberOfBytesRead=0x2ae5d4*=0x708, lpOverlapped=0x0) returned 1 [0034.133] CloseHandle (hObject=0x264) returned 1 [0034.173] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0034.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.174] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.176] GetFileType (hFile=0x264) returned 0x1 [0034.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.176] GetFileType (hFile=0x264) returned 0x1 [0034.176] WriteFile (in: hFile=0x264, lpBuffer=0x1938a24*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1938a24*, lpNumberOfBytesWritten=0x2ae59c*=0x710, lpOverlapped=0x0) returned 1 [0034.177] CloseHandle (hObject=0x264) returned 1 [0034.178] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0034.178] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml.anonymous", lpFilePart=0x0) returned 0x54 [0034.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.178] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3542630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x710)) returned 1 [0034.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.178] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-0000-0000000ff1ce}-c\\wordmui.xml.anonymous")) returned 1 [0034.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.179] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.179] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.179] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0034.191] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.191] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.191] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.191] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.191] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.191] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.192] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.192] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.192] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0034.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.193] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.193] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.193] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0034.194] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.194] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.194] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.194] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.194] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.194] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.195] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.195] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.195] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0034.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.196] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0034.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.197] GetFileType (hFile=0x264) returned 0x1 [0034.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.197] GetFileType (hFile=0x264) returned 0x1 [0034.197] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x32b [0034.197] ReadFile (in: hFile=0x264, lpBuffer=0x193c810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x193c810*, lpNumberOfBytesRead=0x2ae5d4*=0x32b, lpOverlapped=0x0) returned 1 [0034.204] CloseHandle (hObject=0x264) returned 1 [0034.216] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0034.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.218] GetFileType (hFile=0x264) returned 0x1 [0034.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.218] GetFileType (hFile=0x264) returned 0x1 [0034.218] WriteFile (in: hFile=0x264, lpBuffer=0x198b880*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x198b880*, lpNumberOfBytesWritten=0x2ae59c*=0x330, lpOverlapped=0x0) returned 1 [0034.219] CloseHandle (hObject=0x264) returned 1 [0034.219] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0034.220] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml.anonymous", lpFilePart=0x0) returned 0x55 [0034.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.220] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30e5bc00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x30e5bc00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb35b4a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0034.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.220] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proofing.xml.anonymous")) returned 1 [0034.220] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.221] GetFileType (hFile=0x264) returned 0x1 [0034.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.221] GetFileType (hFile=0x264) returned 0x1 [0034.221] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x16fc [0034.221] ReadFile (in: hFile=0x264, lpBuffer=0x198cbd0, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x198cbd0*, lpNumberOfBytesRead=0x2ae5d4*=0x16fc, lpOverlapped=0x0) returned 1 [0034.232] CloseHandle (hObject=0x264) returned 1 [0034.243] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.245] GetFileType (hFile=0x264) returned 0x1 [0034.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.245] GetFileType (hFile=0x264) returned 0x1 [0034.245] WriteFile (in: hFile=0x264, lpBuffer=0x19e0cb8*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19e0cb8*, lpNumberOfBytesWritten=0x2ae5c8*=0x1700, lpOverlapped=0x0) returned 1 [0034.246] CloseHandle (hObject=0x264) returned 1 [0034.246] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.247] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.247] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c210800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2c210800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb35dabb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1700)) returned 1 [0034.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.247] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.247] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0034.247] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0034.247] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0034.249] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.249] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.249] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.249] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.249] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0034.249] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0034.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0034.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.249] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0034.249] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0034.249] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0034.250] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.250] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.250] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.250] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.250] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0034.250] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0034.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0034.250] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0034.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.251] GetFileType (hFile=0x264) returned 0x1 [0034.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0034.251] GetFileType (hFile=0x264) returned 0x1 [0034.251] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x543 [0034.251] ReadFile (in: hFile=0x264, lpBuffer=0x19e4ddc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e4ddc*, lpNumberOfBytesRead=0x2ae560*=0x543, lpOverlapped=0x0) returned 1 [0034.254] CloseHandle (hObject=0x264) returned 1 [0034.266] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0034.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.268] GetFileType (hFile=0x264) returned 0x1 [0034.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0034.268] GetFileType (hFile=0x264) returned 0x1 [0034.268] WriteFile (in: hFile=0x264, lpBuffer=0x1a3479c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a3479c*, lpNumberOfBytesWritten=0x2ae528*=0x550, lpOverlapped=0x0) returned 1 [0034.269] CloseHandle (hObject=0x264) returned 1 [0034.270] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.270] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml.anonymous", lpFilePart=0x0) returned 0x5b [0034.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0034.270] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb56d1600, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xb56d1600, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xb3626e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0034.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0034.270] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.en\\proof.xml.anonymous")) returned 1 [0034.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.270] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0034.270] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0034.270] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea58 [0034.273] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.273] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.273] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.273] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.273] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0034.273] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0034.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0034.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.274] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0034.274] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0034.274] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea58 [0034.274] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.274] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.274] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.274] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.274] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0034.274] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0034.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0034.274] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0034.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.275] GetFileType (hFile=0x264) returned 0x1 [0034.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0034.275] GetFileType (hFile=0x264) returned 0x1 [0034.275] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5b1 [0034.275] ReadFile (in: hFile=0x264, lpBuffer=0x1a38144, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a38144*, lpNumberOfBytesRead=0x2ae560*=0x5b1, lpOverlapped=0x0) returned 1 [0034.276] CloseHandle (hObject=0x264) returned 1 [0034.288] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0034.288] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.289] GetFileType (hFile=0x264) returned 0x1 [0034.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0034.289] GetFileType (hFile=0x264) returned 0x1 [0034.289] WriteFile (in: hFile=0x264, lpBuffer=0x1a87d34*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a87d34*, lpNumberOfBytesWritten=0x2ae528*=0x5c0, lpOverlapped=0x0) returned 1 [0034.290] CloseHandle (hObject=0x264) returned 1 [0034.291] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.291] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml.anonymous", lpFilePart=0x0) returned 0x5b [0034.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0034.291] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb364cfd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0034.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0034.291] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.es\\proof.xml.anonymous")) returned 1 [0034.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.292] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0034.292] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0034.292] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbead8 [0034.293] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.293] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.293] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.293] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.293] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0034.293] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0034.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0034.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.293] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0034.293] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0034.294] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbead8 [0034.294] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.294] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.294] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.294] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0034.294] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0034.294] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0034.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0034.294] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0034.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.295] GetFileType (hFile=0x264) returned 0x1 [0034.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0034.295] GetFileType (hFile=0x264) returned 0x1 [0034.295] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5b2 [0034.295] ReadFile (in: hFile=0x264, lpBuffer=0x1a8b6dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a8b6dc*, lpNumberOfBytesRead=0x2ae560*=0x5b2, lpOverlapped=0x0) returned 1 [0034.297] CloseHandle (hObject=0x264) returned 1 [0034.308] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0034.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.309] GetFileType (hFile=0x264) returned 0x1 [0034.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0034.309] GetFileType (hFile=0x264) returned 0x1 [0034.310] WriteFile (in: hFile=0x264, lpBuffer=0x1adb2cc*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1adb2cc*, lpNumberOfBytesWritten=0x2ae528*=0x5c0, lpOverlapped=0x0) returned 1 [0034.311] CloseHandle (hObject=0x264) returned 1 [0034.311] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.311] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.anonymous", lpFilePart=0x0) returned 0x5b [0034.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0034.311] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3673130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0034.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0034.312] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-0000-0000000ff1ce}-c\\proof.fr\\proof.xml.anonymous")) returned 1 [0034.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.312] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.312] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.312] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbecd8 [0034.321] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.321] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.321] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.321] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.321] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.321] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.321] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0034.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.323] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.323] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.323] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbecd8 [0034.324] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.324] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.324] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.324] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.324] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.324] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.324] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0034.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.325] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0034.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.326] GetFileType (hFile=0x264) returned 0x1 [0034.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.326] GetFileType (hFile=0x264) returned 0x1 [0034.326] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x4cf [0034.327] ReadFile (in: hFile=0x264, lpBuffer=0x1aded68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1aded68*, lpNumberOfBytesRead=0x2ae5d4*=0x4cf, lpOverlapped=0x0) returned 1 [0034.338] CloseHandle (hObject=0x264) returned 1 [0034.351] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0034.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.353] GetFileType (hFile=0x264) returned 0x1 [0034.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.353] GetFileType (hFile=0x264) returned 0x1 [0034.363] WriteFile (in: hFile=0x264, lpBuffer=0x192c504*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x192c504*, lpNumberOfBytesWritten=0x2ae59c*=0x4d0, lpOverlapped=0x0) returned 1 [0034.364] CloseHandle (hObject=0x264) returned 1 [0034.364] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0034.364] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml.anonymous", lpFilePart=0x0) returned 0x58 [0034.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.364] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb370b6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0034.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.365] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\InfoPathMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\infopathmui.xml.anonymous")) returned 1 [0034.365] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.365] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.366] GetFileType (hFile=0x264) returned 0x1 [0034.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.366] GetFileType (hFile=0x264) returned 0x1 [0034.366] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x73c [0034.366] ReadFile (in: hFile=0x264, lpBuffer=0x192dfb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x192dfb4*, lpNumberOfBytesRead=0x2ae5d4*=0x73c, lpOverlapped=0x0) returned 1 [0034.375] CloseHandle (hObject=0x264) returned 1 [0034.410] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.411] GetFileType (hFile=0x264) returned 0x1 [0034.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.411] GetFileType (hFile=0x264) returned 0x1 [0034.411] WriteFile (in: hFile=0x264, lpBuffer=0x197e464*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x197e464*, lpNumberOfBytesWritten=0x2ae59c*=0x740, lpOverlapped=0x0) returned 1 [0034.412] CloseHandle (hObject=0x264) returned 1 [0034.413] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.413] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.413] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb377dad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x740)) returned 1 [0034.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.413] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.414] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.414] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.414] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbecd8 [0034.415] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.415] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.415] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.415] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.415] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.415] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.415] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0034.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.416] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.416] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.416] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbecd8 [0034.416] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.416] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.416] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.416] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.416] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.416] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.417] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0034.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.417] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.417] GetFileType (hFile=0x264) returned 0x1 [0034.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.417] GetFileType (hFile=0x264) returned 0x1 [0034.417] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1861 [0034.418] ReadFile (in: hFile=0x264, lpBuffer=0x19818dc, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19818dc*, lpNumberOfBytesRead=0x2ae5d4*=0x1861, lpOverlapped=0x0) returned 1 [0034.426] CloseHandle (hObject=0x264) returned 1 [0034.438] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.438] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.439] GetFileType (hFile=0x264) returned 0x1 [0034.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.439] GetFileType (hFile=0x264) returned 0x1 [0034.439] WriteFile (in: hFile=0x264, lpBuffer=0x19d60f8*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19d60f8*, lpNumberOfBytesWritten=0x2ae5c8*=0x1870, lpOverlapped=0x0) returned 1 [0034.440] CloseHandle (hObject=0x264) returned 1 [0034.441] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.441] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.441] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x644b6a20, ftCreationTime.dwHighDateTime=0x1cbe47d, ftLastAccessTime.dwLowDateTime=0x644b6a20, ftLastAccessTime.dwHighDateTime=0x1cbe47d, ftLastWriteTime.dwLowDateTime=0xb37c9d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1870)) returned 1 [0034.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.441] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.443] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0034.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.443] GetFileType (hFile=0x264) returned 0x1 [0034.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.443] GetFileType (hFile=0x264) returned 0x1 [0034.443] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x251e [0034.443] ReadFile (in: hFile=0x264, lpBuffer=0x19d7e04, nNumberOfBytesToRead=0x251e, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19d7e04*, lpNumberOfBytesRead=0x2ae5d4*=0x251e, lpOverlapped=0x0) returned 1 [0034.445] CloseHandle (hObject=0x264) returned 1 [0034.457] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0034.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.458] GetFileType (hFile=0x264) returned 0x1 [0034.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.458] GetFileType (hFile=0x264) returned 0x1 [0034.458] WriteFile (in: hFile=0x264, lpBuffer=0x1a30590*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a30590*, lpNumberOfBytesWritten=0x2ae5c8*=0x2520, lpOverlapped=0x0) returned 1 [0034.459] CloseHandle (hObject=0x264) returned 1 [0034.460] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0034.460] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml.anonymous", lpFilePart=0x0) returned 0x55 [0034.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.460] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60851350, ftCreationTime.dwHighDateTime=0x1cbe47d, ftLastAccessTime.dwLowDateTime=0x60851350, ftLastAccessTime.dwHighDateTime=0x1cbe47d, ftLastWriteTime.dwLowDateTime=0xb37efef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2520)) returned 1 [0034.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.461] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-0000-0000000FF1CE}-C\\VisioMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-0000-0000000ff1ce}-c\\visiomui.xml.anonymous")) returned 1 [0034.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.461] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.461] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbebd8 [0034.472] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.472] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.472] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.472] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.472] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.472] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.472] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0034.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.473] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.473] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbebd8 [0034.474] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.475] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.475] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.475] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.475] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.475] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.475] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0034.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.476] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0034.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.478] GetFileType (hFile=0x264) returned 0x1 [0034.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.478] GetFileType (hFile=0x264) returned 0x1 [0034.478] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x646 [0034.478] ReadFile (in: hFile=0x264, lpBuffer=0x1a357a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a357a4*, lpNumberOfBytesRead=0x2ae5d4*=0x646, lpOverlapped=0x0) returned 1 [0034.479] CloseHandle (hObject=0x264) returned 1 [0034.491] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0034.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.491] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.493] GetFileType (hFile=0x264) returned 0x1 [0034.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.493] GetFileType (hFile=0x264) returned 0x1 [0034.493] WriteFile (in: hFile=0x264, lpBuffer=0x1a85664*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a85664*, lpNumberOfBytesWritten=0x2ae59c*=0x650, lpOverlapped=0x0) returned 1 [0034.494] CloseHandle (hObject=0x264) returned 1 [0034.494] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0034.495] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml.anonymous", lpFilePart=0x0) returned 0x57 [0034.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.495] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb383c1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1 [0034.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.495] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\onenotemui.xml.anonymous")) returned 1 [0034.495] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.495] GetFileType (hFile=0x264) returned 0x1 [0034.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.495] GetFileType (hFile=0x264) returned 0x1 [0034.496] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x7c4 [0034.496] ReadFile (in: hFile=0x264, lpBuffer=0x1a871a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a871a8*, lpNumberOfBytesRead=0x2ae5d4*=0x7c4, lpOverlapped=0x0) returned 1 [0034.497] CloseHandle (hObject=0x264) returned 1 [0034.510] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.512] GetFileType (hFile=0x264) returned 0x1 [0034.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.512] GetFileType (hFile=0x264) returned 0x1 [0034.512] WriteFile (in: hFile=0x264, lpBuffer=0x1ad77d4*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ad77d4*, lpNumberOfBytesWritten=0x2ae59c*=0x7d0, lpOverlapped=0x0) returned 1 [0034.513] CloseHandle (hObject=0x264) returned 1 [0034.514] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.514] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.514] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3888470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0034.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.514] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.515] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.515] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.515] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe9d8 [0034.517] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.517] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.517] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.517] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.517] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.517] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.517] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0034.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.519] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.519] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe9d8 [0034.520] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.520] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.520] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.520] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.520] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.520] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.521] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0034.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.522] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0034.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.523] GetFileType (hFile=0x264) returned 0x1 [0034.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.523] GetFileType (hFile=0x264) returned 0x1 [0034.523] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x5ab [0034.523] ReadFile (in: hFile=0x264, lpBuffer=0x1adb2e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1adb2e8*, lpNumberOfBytesRead=0x2ae5d4*=0x5ab, lpOverlapped=0x0) returned 1 [0034.540] CloseHandle (hObject=0x264) returned 1 [0034.552] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0034.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.553] GetFileType (hFile=0x264) returned 0x1 [0034.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.554] GetFileType (hFile=0x264) returned 0x1 [0034.554] WriteFile (in: hFile=0x264, lpBuffer=0x1b2ae84*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1b2ae84*, lpNumberOfBytesWritten=0x2ae59c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.555] CloseHandle (hObject=0x264) returned 1 [0034.556] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0034.556] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml.anonymous", lpFilePart=0x0) returned 0x57 [0034.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.556] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49e09da0, ftCreationTime.dwHighDateTime=0x1cbe468, ftLastAccessTime.dwLowDateTime=0x49e09da0, ftLastAccessTime.dwHighDateTime=0x1cbe468, ftLastWriteTime.dwLowDateTime=0xb38d4730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0034.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.556] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\ProjectMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\projectmui.xml.anonymous")) returned 1 [0034.557] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.558] GetFileType (hFile=0x264) returned 0x1 [0034.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.558] GetFileType (hFile=0x264) returned 0x1 [0034.558] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x750 [0034.562] ReadFile (in: hFile=0x264, lpBuffer=0x192e1ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x192e1ec*, lpNumberOfBytesRead=0x2ae5d4*=0x750, lpOverlapped=0x0) returned 1 [0034.573] CloseHandle (hObject=0x264) returned 1 [0034.610] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.611] GetFileType (hFile=0x264) returned 0x1 [0034.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.611] GetFileType (hFile=0x264) returned 0x1 [0034.611] WriteFile (in: hFile=0x264, lpBuffer=0x197e748*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x197e748*, lpNumberOfBytesWritten=0x2ae59c*=0x760, lpOverlapped=0x0) returned 1 [0034.612] CloseHandle (hObject=0x264) returned 1 [0034.613] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.613] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.613] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x49de53b0, ftCreationTime.dwHighDateTime=0x1cbe468, ftLastAccessTime.dwLowDateTime=0x49de53b0, ftLastAccessTime.dwHighDateTime=0x1cbe468, ftLastWriteTime.dwLowDateTime=0xb396ccb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0034.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.613] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.616] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.616] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.616] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0034.637] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.637] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.637] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.637] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.637] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.637] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.638] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0034.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.639] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.639] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.639] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0034.641] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.641] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.641] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.641] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.641] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.642] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.642] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0034.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.643] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0034.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.643] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.645] GetFileType (hFile=0x264) returned 0x1 [0034.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.645] GetFileType (hFile=0x264) returned 0x1 [0034.645] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x391 [0034.645] ReadFile (in: hFile=0x264, lpBuffer=0x1982060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1982060*, lpNumberOfBytesRead=0x2ae5d4*=0x391, lpOverlapped=0x0) returned 1 [0034.655] CloseHandle (hObject=0x264) returned 1 [0034.667] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0034.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.668] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.669] GetFileType (hFile=0x264) returned 0x1 [0034.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.669] GetFileType (hFile=0x264) returned 0x1 [0034.669] WriteFile (in: hFile=0x264, lpBuffer=0x19d11b0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x19d11b0*, lpNumberOfBytesWritten=0x2ae59c*=0x3a0, lpOverlapped=0x0) returned 1 [0034.670] CloseHandle (hObject=0x264) returned 1 [0034.671] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0034.671] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml.anonymous", lpFilePart=0x0) returned 0x56 [0034.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.671] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3a05230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0034.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.671] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\GrooveMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\groovemui.xml.anonymous")) returned 1 [0034.671] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.672] GetFileType (hFile=0x264) returned 0x1 [0034.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.672] GetFileType (hFile=0x264) returned 0x1 [0034.672] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x5ac [0034.672] ReadFile (in: hFile=0x264, lpBuffer=0x19d2ac4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19d2ac4*, lpNumberOfBytesRead=0x2ae5d4*=0x5ac, lpOverlapped=0x0) returned 1 [0034.673] CloseHandle (hObject=0x264) returned 1 [0034.685] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.686] GetFileType (hFile=0x264) returned 0x1 [0034.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.686] GetFileType (hFile=0x264) returned 0x1 [0034.686] WriteFile (in: hFile=0x264, lpBuffer=0x1a22648*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a22648*, lpNumberOfBytesWritten=0x2ae59c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.687] CloseHandle (hObject=0x264) returned 1 [0034.688] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.688] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.688] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3a2b390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0034.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.688] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.689] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.689] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.689] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.692] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.693] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.694] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0034.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0034.695] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0034.695] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0034.695] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.696] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.697] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.698] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.698] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0034.698] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0034.698] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0034.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0034.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0034.699] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0034.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.701] GetFileType (hFile=0x264) returned 0x1 [0034.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.701] GetFileType (hFile=0x264) returned 0x1 [0034.701] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x91975 [0034.703] ReadFile (in: hFile=0x264, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae5d4*=0x91975, lpOverlapped=0x0) returned 1 [0034.728] CloseHandle (hObject=0x264) returned 1 [0034.797] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0034.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.804] GetFileType (hFile=0x264) returned 0x1 [0034.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.804] GetFileType (hFile=0x264) returned 0x1 [0034.804] WriteFile (in: hFile=0x264, lpBuffer=0x2aab138*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x2aab138*, lpNumberOfBytesWritten=0x2ae5c8*=0x91980, lpOverlapped=0x0) returned 1 [0034.818] CloseHandle (hObject=0x264) returned 1 [0034.824] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0034.824] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.anonymous", lpFilePart=0x0) returned 0x55 [0034.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.824] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xb3b5be90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x91980)) returned 1 [0034.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.825] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\branding.xml.anonymous")) returned 1 [0034.825] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0034.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.825] GetFileType (hFile=0x264) returned 0x1 [0034.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.826] GetFileType (hFile=0x264) returned 0x1 [0034.826] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x161e [0034.826] ReadFile (in: hFile=0x264, lpBuffer=0x192cd88, nNumberOfBytesToRead=0x161e, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x192cd88*, lpNumberOfBytesRead=0x2ae5d4*=0x161e, lpOverlapped=0x0) returned 1 [0034.839] CloseHandle (hObject=0x264) returned 1 [0034.936] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0034.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.937] GetFileType (hFile=0x264) returned 0x1 [0034.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.937] GetFileType (hFile=0x264) returned 0x1 [0034.937] WriteFile (in: hFile=0x264, lpBuffer=0x1980b70*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1980b70*, lpNumberOfBytesWritten=0x2ae5c8*=0x1620, lpOverlapped=0x0) returned 1 [0034.938] CloseHandle (hObject=0x264) returned 1 [0034.939] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0034.939] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml.anonymous", lpFilePart=0x0) returned 0x56 [0034.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.939] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c210800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2c210800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3c8c990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1620)) returned 1 [0034.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.939] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemui.xml.anonymous")) returned 1 [0034.940] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0034.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.940] GetFileType (hFile=0x264) returned 0x1 [0034.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.940] GetFileType (hFile=0x264) returned 0x1 [0034.940] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x333 [0034.940] ReadFile (in: hFile=0x264, lpBuffer=0x198298c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x198298c*, lpNumberOfBytesRead=0x2ae5d4*=0x333, lpOverlapped=0x0) returned 1 [0034.959] CloseHandle (hObject=0x264) returned 1 [0034.972] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0034.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.973] GetFileType (hFile=0x264) returned 0x1 [0034.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.974] GetFileType (hFile=0x264) returned 0x1 [0034.974] WriteFile (in: hFile=0x264, lpBuffer=0x19d1908*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x19d1908*, lpNumberOfBytesWritten=0x2ae59c*=0x340, lpOverlapped=0x0) returned 1 [0034.975] CloseHandle (hObject=0x264) returned 1 [0034.975] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0034.975] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml.anonymous", lpFilePart=0x0) returned 0x59 [0034.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.975] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3cd8c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0034.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.976] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\officemuiset.xml.anonymous")) returned 1 [0034.976] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0034.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.976] GetFileType (hFile=0x264) returned 0x1 [0034.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0034.976] GetFileType (hFile=0x264) returned 0x1 [0034.976] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x257e [0034.976] ReadFile (in: hFile=0x264, lpBuffer=0x19d2cb8, nNumberOfBytesToRead=0x257e, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19d2cb8*, lpNumberOfBytesRead=0x2ae5d4*=0x257e, lpOverlapped=0x0) returned 1 [0034.981] CloseHandle (hObject=0x264) returned 1 [0034.994] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0034.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0034.995] GetFileType (hFile=0x264) returned 0x1 [0034.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0034.996] GetFileType (hFile=0x264) returned 0x1 [0034.996] WriteFile (in: hFile=0x264, lpBuffer=0x1a2b624*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a2b624*, lpNumberOfBytesWritten=0x2ae5c8*=0x2580, lpOverlapped=0x0) returned 1 [0034.997] CloseHandle (hObject=0x264) returned 1 [0034.998] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.998] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0034.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0034.998] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c210800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2c210800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3d24f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2580)) returned 1 [0034.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0034.998] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0034.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0034.999] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0034.999] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0034.999] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0034.999] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.000] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.000] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.000] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0035.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.000] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0035.000] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0035.000] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0035.000] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.000] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.001] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.001] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0035.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.001] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.001] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.001] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbebd8 [0035.007] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.007] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.007] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.008] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.008] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.008] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.008] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0035.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.009] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.009] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.009] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbebd8 [0035.010] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.010] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.010] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.011] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.011] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.011] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.011] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0035.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.012] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0035.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.013] GetFileType (hFile=0x264) returned 0x1 [0035.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.013] GetFileType (hFile=0x264) returned 0x1 [0035.013] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x333 [0035.013] ReadFile (in: hFile=0x264, lpBuffer=0x1a31f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a31f04*, lpNumberOfBytesRead=0x2ae5d4*=0x333, lpOverlapped=0x0) returned 1 [0035.023] CloseHandle (hObject=0x264) returned 1 [0035.035] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0035.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.037] GetFileType (hFile=0x264) returned 0x1 [0035.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.037] GetFileType (hFile=0x264) returned 0x1 [0035.037] WriteFile (in: hFile=0x264, lpBuffer=0x1a80e80*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a80e80*, lpNumberOfBytesWritten=0x2ae59c*=0x340, lpOverlapped=0x0) returned 1 [0035.038] CloseHandle (hObject=0x264) returned 1 [0035.039] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0035.039] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml.anonymous", lpFilePart=0x0) returned 0x59 [0035.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.039] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3d711d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0035.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.039] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\AccessMUISet.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\accessmuiset.xml.anonymous")) returned 1 [0035.039] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.040] GetFileType (hFile=0x264) returned 0x1 [0035.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.040] GetFileType (hFile=0x264) returned 0x1 [0035.040] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xa40 [0035.040] ReadFile (in: hFile=0x264, lpBuffer=0x1a82c34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a82c34*, lpNumberOfBytesRead=0x2ae5d4*=0xa40, lpOverlapped=0x0) returned 1 [0035.048] CloseHandle (hObject=0x264) returned 1 [0035.061] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.062] GetFileType (hFile=0x264) returned 0x1 [0035.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.062] GetFileType (hFile=0x264) returned 0x1 [0035.062] WriteFile (in: hFile=0x264, lpBuffer=0x1ad3ee4*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ad3ee4*, lpNumberOfBytesWritten=0x2ae59c*=0xa50, lpOverlapped=0x0) returned 1 [0035.063] CloseHandle (hObject=0x264) returned 1 [0035.064] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.064] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0035.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.064] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3dbd490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa50)) returned 1 [0035.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.064] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0035.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.065] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0035.065] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0035.065] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea58 [0035.077] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.077] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.077] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.077] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.077] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.077] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.077] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0035.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.078] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0035.078] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0035.079] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea58 [0035.080] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.080] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.080] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.080] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.080] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.080] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.080] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0035.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.082] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0035.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0035.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.083] GetFileType (hFile=0x264) returned 0x1 [0035.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0035.083] GetFileType (hFile=0x264) returned 0x1 [0035.083] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x545 [0035.083] ReadFile (in: hFile=0x264, lpBuffer=0x1ad7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ad7dd8*, lpNumberOfBytesRead=0x2ae560*=0x545, lpOverlapped=0x0) returned 1 [0035.089] CloseHandle (hObject=0x264) returned 1 [0035.102] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0035.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0035.102] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.103] GetFileType (hFile=0x264) returned 0x1 [0035.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0035.104] GetFileType (hFile=0x264) returned 0x1 [0035.104] WriteFile (in: hFile=0x264, lpBuffer=0x1b277ac*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b277ac*, lpNumberOfBytesWritten=0x2ae528*=0x550, lpOverlapped=0x0) returned 1 [0035.105] CloseHandle (hObject=0x264) returned 1 [0035.106] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0035.106] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.anonymous", lpFilePart=0x0) returned 0x63 [0035.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0035.106] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e836200, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2e836200, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb3e09750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0035.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.106] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.anonymous")) returned 1 [0035.107] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0035.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0035.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x264 [0035.107] GetFileType (hFile=0x264) returned 0x1 [0035.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0035.107] GetFileType (hFile=0x264) returned 0x1 [0035.107] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x91975 [0035.109] ReadFile (in: hFile=0x264, lpBuffer=0x2cf1758, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2cf1758*, lpNumberOfBytesRead=0x2ae560*=0x91975, lpOverlapped=0x0) returned 1 [0035.138] CloseHandle (hObject=0x264) returned 1 [0035.251] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0035.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0035.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.258] GetFileType (hFile=0x274) returned 0x1 [0035.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0035.258] GetFileType (hFile=0x274) returned 0x1 [0035.258] WriteFile (in: hFile=0x274, lpBuffer=0x2d830f0*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2d830f0*, lpNumberOfBytesWritten=0x2ae554*=0x91980, lpOverlapped=0x0) returned 1 [0035.270] CloseHandle (hObject=0x274) returned 1 [0035.274] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0035.274] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml.anonymous", lpFilePart=0x0) returned 0x62 [0035.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0035.274] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xb3fac670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x91980)) returned 1 [0035.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.274] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\branding.xml.anonymous" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-0000-0000000ff1ce}-c\\access.en-us\\branding.xml.anonymous")) returned 1 [0035.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.275] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.275] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.275] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0035.280] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.281] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.282] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.282] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.282] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.282] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.282] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.282] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0035.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.283] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.283] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.283] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0035.284] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.284] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.284] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.285] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.286] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.286] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.286] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.286] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.286] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0035.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.287] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.287] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.295] GetFileType (hFile=0x274) returned 0x1 [0035.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.295] GetFileType (hFile=0x274) returned 0x1 [0035.296] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x124d [0035.296] ReadFile (in: hFile=0x274, lpBuffer=0x19319f8, nNumberOfBytesToRead=0x124d, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19319f8*, lpNumberOfBytesRead=0x2ae5d4*=0x124d, lpOverlapped=0x0) returned 1 [0035.300] CloseHandle (hObject=0x274) returned 1 [0035.336] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.337] GetFileType (hFile=0x274) returned 0x1 [0035.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.337] GetFileType (hFile=0x274) returned 0x1 [0035.337] WriteFile (in: hFile=0x274, lpBuffer=0x1984984*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1984984*, lpNumberOfBytesWritten=0x2ae5c8*=0x1250, lpOverlapped=0x0) returned 1 [0035.338] CloseHandle (hObject=0x274) returned 1 [0035.339] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.339] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous", lpFilePart=0x0) returned 0x57 [0035.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.339] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x979fb100, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x979fb100, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xb4044bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1250)) returned 1 [0035.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.339] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\office64ww.xml.anonymous")) returned 1 [0035.340] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0035.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.341] GetFileType (hFile=0x274) returned 0x1 [0035.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.341] GetFileType (hFile=0x274) returned 0x1 [0035.341] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x4366 [0035.341] ReadFile (in: hFile=0x274, lpBuffer=0x1986108, nNumberOfBytesToRead=0x4366, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1986108*, lpNumberOfBytesRead=0x2ae5d4*=0x4366, lpOverlapped=0x0) returned 1 [0035.349] CloseHandle (hObject=0x274) returned 1 [0035.362] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0035.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.364] GetFileType (hFile=0x274) returned 0x1 [0035.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.364] GetFileType (hFile=0x274) returned 0x1 [0035.364] WriteFile (in: hFile=0x274, lpBuffer=0x19e8024*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19e8024*, lpNumberOfBytesWritten=0x2ae5c8*=0x4370, lpOverlapped=0x0) returned 1 [0035.365] CloseHandle (hObject=0x274) returned 1 [0035.366] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0035.366] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml.anonymous", lpFilePart=0x0) returned 0x57 [0035.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.366] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb4090eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4370)) returned 1 [0035.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.366] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusrWW.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\proplusrww.xml.anonymous")) returned 1 [0035.367] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.368] GetFileType (hFile=0x274) returned 0x1 [0035.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.368] GetFileType (hFile=0x274) returned 0x1 [0035.368] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x7ddb [0035.368] ReadFile (in: hFile=0x274, lpBuffer=0x19ec868, nNumberOfBytesToRead=0x7ddb, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19ec868*, lpNumberOfBytesRead=0x2ae5d4*=0x7ddb, lpOverlapped=0x0) returned 1 [0035.369] CloseHandle (hObject=0x274) returned 1 [0035.382] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.383] GetFileType (hFile=0x274) returned 0x1 [0035.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.383] GetFileType (hFile=0x274) returned 0x1 [0035.383] WriteFile (in: hFile=0x274, lpBuffer=0x1a60bb4*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a60bb4*, lpNumberOfBytesWritten=0x2ae5c8*=0x7de0, lpOverlapped=0x0) returned 1 [0035.385] CloseHandle (hObject=0x274) returned 1 [0035.386] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.386] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0035.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.386] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb40b7010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7de0)) returned 1 [0035.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.386] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0035.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.387] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.387] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.387] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0035.398] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.398] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.398] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.398] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.398] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.399] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.399] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0035.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.401] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.401] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.401] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0035.402] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.402] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.402] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.402] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.402] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.403] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.404] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.404] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0035.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.405] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.405] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.406] GetFileType (hFile=0x274) returned 0x1 [0035.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.406] GetFileType (hFile=0x274) returned 0x1 [0035.406] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x124d [0035.406] ReadFile (in: hFile=0x274, lpBuffer=0x1a6cbc4, nNumberOfBytesToRead=0x124d, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a6cbc4*, lpNumberOfBytesRead=0x2ae5d4*=0x124d, lpOverlapped=0x0) returned 1 [0035.408] CloseHandle (hObject=0x274) returned 1 [0035.420] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.421] GetFileType (hFile=0x274) returned 0x1 [0035.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.421] GetFileType (hFile=0x274) returned 0x1 [0035.421] WriteFile (in: hFile=0x274, lpBuffer=0x1abf540*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1abf540*, lpNumberOfBytesWritten=0x2ae5c8*=0x1250, lpOverlapped=0x0) returned 1 [0035.422] CloseHandle (hObject=0x274) returned 1 [0035.422] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.422] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous", lpFilePart=0x0) returned 0x57 [0035.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.422] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\office64ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x875fb670, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x875fb670, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xb4129430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1250)) returned 1 [0035.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.423] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\office64ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\office64ww.xml.anonymous")) returned 1 [0035.423] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0035.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.423] GetFileType (hFile=0x274) returned 0x1 [0035.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.423] GetFileType (hFile=0x274) returned 0x1 [0035.423] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x19da [0035.423] ReadFile (in: hFile=0x274, lpBuffer=0x1ac0cc0, nNumberOfBytesToRead=0x19da, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ac0cc0*, lpNumberOfBytesRead=0x2ae5d4*=0x19da, lpOverlapped=0x0) returned 1 [0035.425] CloseHandle (hObject=0x274) returned 1 [0035.461] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0035.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.462] GetFileType (hFile=0x274) returned 0x1 [0035.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.462] GetFileType (hFile=0x274) returned 0x1 [0035.462] WriteFile (in: hFile=0x274, lpBuffer=0x19614d0*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19614d0*, lpNumberOfBytesWritten=0x2ae5c8*=0x19e0, lpOverlapped=0x0) returned 1 [0035.463] CloseHandle (hObject=0x274) returned 1 [0035.464] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0035.464] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml.anonymous", lpFilePart=0x0) returned 0x56 [0035.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.464] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca73160, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca73160, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xb41756f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19e0)) returned 1 [0035.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.464] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\PrjProrWW.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\prjprorww.xml.anonymous")) returned 1 [0035.465] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.465] GetFileType (hFile=0x274) returned 0x1 [0035.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.465] GetFileType (hFile=0x274) returned 0x1 [0035.465] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x43c8 [0035.465] ReadFile (in: hFile=0x274, lpBuffer=0x1963368, nNumberOfBytesToRead=0x43c8, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1963368*, lpNumberOfBytesRead=0x2ae5d4*=0x43c8, lpOverlapped=0x0) returned 1 [0035.467] CloseHandle (hObject=0x274) returned 1 [0035.479] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.481] GetFileType (hFile=0x274) returned 0x1 [0035.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.481] GetFileType (hFile=0x274) returned 0x1 [0035.481] WriteFile (in: hFile=0x274, lpBuffer=0x19c55bc*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19c55bc*, lpNumberOfBytesWritten=0x2ae5c8*=0x43d0, lpOverlapped=0x0) returned 1 [0035.482] CloseHandle (hObject=0x274) returned 1 [0035.483] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.483] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0035.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.483] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c968f90, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c968f90, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xb41c19b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x43d0)) returned 1 [0035.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.483] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0035.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.484] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.484] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.484] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.491] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.492] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.492] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0035.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.493] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0035.493] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0035.494] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.495] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.496] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.497] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0035.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.498] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.499] GetFileType (hFile=0x274) returned 0x1 [0035.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.499] GetFileType (hFile=0x274) returned 0x1 [0035.499] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x124d [0035.499] ReadFile (in: hFile=0x274, lpBuffer=0x19cdb04, nNumberOfBytesToRead=0x124d, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19cdb04*, lpNumberOfBytesRead=0x2ae5d4*=0x124d, lpOverlapped=0x0) returned 1 [0035.500] CloseHandle (hObject=0x274) returned 1 [0035.512] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\office64ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.514] GetFileType (hFile=0x274) returned 0x1 [0035.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.514] GetFileType (hFile=0x274) returned 0x1 [0035.514] WriteFile (in: hFile=0x274, lpBuffer=0x1a20480*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a20480*, lpNumberOfBytesWritten=0x2ae5c8*=0x1250, lpOverlapped=0x0) returned 1 [0035.515] CloseHandle (hObject=0x274) returned 1 [0035.515] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml", lpFilePart=0x0) returned 0x4d [0035.515] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous", lpFilePart=0x0) returned 0x57 [0035.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.515] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\office64ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf13501e0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xf13501e0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0xb420dc70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1250)) returned 1 [0035.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.515] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\office64ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Office64WW.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\office64ww.xml.anonymous")) returned 1 [0035.516] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.522] GetFileType (hFile=0x274) returned 0x1 [0035.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.522] GetFileType (hFile=0x274) returned 0x1 [0035.522] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x52fe [0035.522] ReadFile (in: hFile=0x274, lpBuffer=0x1a21bf0, nNumberOfBytesToRead=0x52fe, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a21bf0*, lpNumberOfBytesRead=0x2ae5d4*=0x52fe, lpOverlapped=0x0) returned 1 [0035.533] CloseHandle (hObject=0x274) returned 1 [0035.545] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.546] GetFileType (hFile=0x274) returned 0x1 [0035.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.546] GetFileType (hFile=0x274) returned 0x1 [0035.546] WriteFile (in: hFile=0x274, lpBuffer=0x1a888dc*, nNumberOfBytesToWrite=0x5300, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a888dc*, lpNumberOfBytesWritten=0x2ae5c8*=0x5300, lpOverlapped=0x0) returned 1 [0035.549] CloseHandle (hObject=0x274) returned 1 [0035.550] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0035.550] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous", lpFilePart=0x0) returned 0x52 [0035.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.550] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80af0cc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80af0cc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xb4259f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5300)) returned 1 [0035.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.550] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\Setup.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\setup.xml.anonymous")) returned 1 [0035.557] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0035.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0035.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.558] GetFileType (hFile=0x274) returned 0x1 [0035.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0035.558] GetFileType (hFile=0x274) returned 0x1 [0035.558] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x22d5 [0035.558] ReadFile (in: hFile=0x274, lpBuffer=0x1a8e078, nNumberOfBytesToRead=0x22d5, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a8e078*, lpNumberOfBytesRead=0x2ae5d4*=0x22d5, lpOverlapped=0x0) returned 1 [0035.560] CloseHandle (hObject=0x274) returned 1 [0035.572] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0035.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0035.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.574] GetFileType (hFile=0x274) returned 0x1 [0035.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0035.574] GetFileType (hFile=0x274) returned 0x1 [0035.574] WriteFile (in: hFile=0x274, lpBuffer=0x1ae5cc4*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1ae5cc4*, lpNumberOfBytesWritten=0x2ae5c8*=0x22e0, lpOverlapped=0x0) returned 1 [0035.575] CloseHandle (hObject=0x274) returned 1 [0035.576] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0035.576] GetFullPathNameW (in: lpFileName="\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml.anonymous", lpFilePart=0x0) returned 0x55 [0035.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0035.576] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\visiorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80bfae90, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80bfae90, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xb42a61f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x22e0)) returned 1 [0035.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.576] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-0000-0000000FF1CE}-C\\VisiorWW.xml.anonymous" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-0000-0000000ff1ce}-c\\visiorww.xml.anonymous")) returned 1 [0035.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0035.577] GetFullPathNameW (in: lpFileName="\\PerfLogs", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0035.577] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0035.577] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbea98 [0035.577] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.577] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.577] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0035.577] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0035.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0035.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0035.578] GetFullPathNameW (in: lpFileName="\\PerfLogs", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0035.578] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0035.578] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbea98 [0035.578] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.578] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.578] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0035.578] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0035.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0035.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0035.578] GetFullPathNameW (in: lpFileName="\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0035.578] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0035.578] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0035.579] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0035.579] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0035.579] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0035.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0035.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0035.579] GetFullPathNameW (in: lpFileName="\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0035.579] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0035.579] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0035.579] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0035.580] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0035.580] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0035.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0035.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0035.580] GetFullPathNameW (in: lpFileName="\\Program Files", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0035.580] GetFullPathNameW (in: lpFileName="C:\\Program Files\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\", lpFilePart=0x0) returned 0x11 [0035.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbea98 [0035.580] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.580] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.580] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.581] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.582] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.583] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.584] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.584] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0035.584] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0035.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0035.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0035.584] GetFullPathNameW (in: lpFileName="\\Program Files", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0035.584] GetFullPathNameW (in: lpFileName="C:\\Program Files\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\", lpFilePart=0x0) returned 0x11 [0035.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbea98 [0035.584] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.584] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.584] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.585] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.586] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.587] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.587] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.587] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.587] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.587] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0035.587] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0035.587] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0035.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0035.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0035.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe", lpFilePart=0x0) returned 0x16 [0035.587] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\", lpFilePart=0x0) returned 0x17 [0035.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0035.588] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0035.588] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0035.588] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0035.588] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0035.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0035.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0035.588] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe", lpFilePart=0x0) returned 0x16 [0035.588] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\", lpFilePart=0x0) returned 0x17 [0035.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0035.588] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0035.589] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0035.589] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0035.589] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0035.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0035.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.589] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0", lpFilePart=0x0) returned 0x22 [0035.589] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\", lpFilePart=0x0) returned 0x23 [0035.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0035.589] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.590] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.591] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.591] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0035.592] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0", lpFilePart=0x0) returned 0x22 [0035.592] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\", lpFilePart=0x0) returned 0x23 [0035.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.592] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0035.593] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0035.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0035.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.593] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Esl", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Esl", lpFilePart=0x0) returned 0x26 [0035.593] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Esl\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Esl\\", lpFilePart=0x0) returned 0x27 [0035.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.593] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.593] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Esl", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Esl", lpFilePart=0x0) returned 0x26 [0035.594] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Esl\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Esl\\", lpFilePart=0x0) returned 0x27 [0035.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.594] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader", lpFilePart=0x0) returned 0x29 [0035.594] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\", lpFilePart=0x0) returned 0x2a [0035.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.594] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.595] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.596] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0035.596] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0035.596] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader", lpFilePart=0x0) returned 0x29 [0035.596] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\", lpFilePart=0x0) returned 0x2a [0035.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.597] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0035.598] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0035.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0035.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0035.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", lpFilePart=0x0) returned 0x3e [0035.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0035.598] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.599] GetFileType (hFile=0x274) returned 0x1 [0035.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0035.599] GetFileType (hFile=0x274) returned 0x1 [0035.599] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x724ee [0035.619] CloseHandle (hObject=0x274) returned 1 [0035.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", lpFilePart=0x0) returned 0x3e [0035.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0035.681] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.686] GetFileType (hFile=0x274) returned 0x1 [0035.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0035.686] GetFileType (hFile=0x274) returned 0x1 [0035.687] WriteFile (in: hFile=0x274, lpBuffer=0x2b70680*, nNumberOfBytesToWrite=0x724f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2b70680*, lpNumberOfBytesWritten=0x2ae554*=0x724f0, lpOverlapped=0x0) returned 1 [0035.696] CloseHandle (hObject=0x274) returned 1 [0035.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", lpFilePart=0x0) returned 0x3e [0035.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf.anonymous", lpFilePart=0x0) returned 0x48 [0035.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0035.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcdc74c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb43d6cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x724f0)) returned 1 [0035.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf.anonymous")) returned 1 [0035.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0035.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR", lpFilePart=0x0) returned 0x2d [0035.701] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR\\", lpFilePart=0x0) returned 0x2e [0035.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0035.710] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.710] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.710] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.710] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.710] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.711] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.712] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.713] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0035.713] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0035.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0035.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR", lpFilePart=0x0) returned 0x2d [0035.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR\\", lpFilePart=0x0) returned 0x2e [0035.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0035.715] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.715] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.715] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.715] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.715] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.716] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0035.718] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0035.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0035.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser", lpFilePart=0x0) returned 0x31 [0035.719] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\", lpFilePart=0x0) returned 0x32 [0035.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0035.732] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.732] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.732] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.733] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.734] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.735] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.735] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.735] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0035.735] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0035.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0035.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser", lpFilePart=0x0) returned 0x31 [0035.736] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\", lpFilePart=0x0) returned 0x32 [0035.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0035.737] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.737] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.737] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.738] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.739] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.740] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.740] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.740] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.740] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0035.740] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0035.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0035.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates", lpFilePart=0x0) returned 0x35 [0035.741] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpFilePart=0x0) returned 0x36 [0035.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.751] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.752] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0035.752] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0035.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0035.753] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates", lpFilePart=0x0) returned 0x35 [0035.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpFilePart=0x0) returned 0x36 [0035.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0035.754] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.754] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.755] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.756] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.756] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.756] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0035.756] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0035.756] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0035.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0035.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0035.757] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT", lpFilePart=0x0) returned 0x39 [0035.757] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", lpFilePart=0x0) returned 0x3a [0035.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0035.759] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0035.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0035.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0035.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT", lpFilePart=0x0) returned 0x39 [0035.759] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", lpFilePart=0x0) returned 0x3a [0035.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.759] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0035.760] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0035.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0035.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0035.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0035.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0035.760] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.760] GetFileType (hFile=0x274) returned 0x1 [0035.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0035.760] GetFileType (hFile=0x274) returned 0x1 [0035.760] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x11ff6 [0035.760] ReadFile (in: hFile=0x274, lpBuffer=0x1968230, nNumberOfBytesToRead=0x11ff6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1968230*, lpNumberOfBytesRead=0x2ae478*=0x11ff6, lpOverlapped=0x0) returned 1 [0035.771] CloseHandle (hObject=0x274) returned 1 [0035.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0035.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0035.856] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.858] GetFileType (hFile=0x274) returned 0x1 [0035.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0035.858] GetFileType (hFile=0x274) returned 0x1 [0035.858] WriteFile (in: hFile=0x274, lpBuffer=0x1935e84*, nNumberOfBytesToWrite=0x12000, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1935e84*, lpNumberOfBytesWritten=0x2ae46c*=0x12000, lpOverlapped=0x0) returned 1 [0035.860] CloseHandle (hObject=0x274) returned 1 [0035.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0035.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0035.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0035.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd6b4740, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4553ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12000)) returned 1 [0035.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0035.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf.anonymous")) returned 1 [0035.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0035.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0035.862] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.863] GetFileType (hFile=0x274) returned 0x1 [0035.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0035.863] GetFileType (hFile=0x274) returned 0x1 [0035.863] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x11581 [0035.863] ReadFile (in: hFile=0x274, lpBuffer=0x197a9a0, nNumberOfBytesToRead=0x11581, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197a9a0*, lpNumberOfBytesRead=0x2ae478*=0x11581, lpOverlapped=0x0) returned 1 [0035.865] CloseHandle (hObject=0x274) returned 1 [0035.910] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0035.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0035.910] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.912] GetFileType (hFile=0x274) returned 0x1 [0035.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0035.912] GetFileType (hFile=0x274) returned 0x1 [0035.913] WriteFile (in: hFile=0x274, lpBuffer=0x1a0df64*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a0df64*, lpNumberOfBytesWritten=0x2ae46c*=0x11590, lpOverlapped=0x0) returned 1 [0035.915] CloseHandle (hObject=0x274) returned 1 [0035.917] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0035.917] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0035.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0035.917] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd6b4740, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb45c5ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11590)) returned 1 [0035.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0035.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf.anonymous")) returned 1 [0035.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0035.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS", lpFilePart=0x0) returned 0x39 [0035.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", lpFilePart=0x0) returned 0x3a [0035.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0035.921] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.921] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.921] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.921] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0035.922] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0035.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0035.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0035.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0035.922] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS", lpFilePart=0x0) returned 0x39 [0035.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", lpFilePart=0x0) returned 0x3a [0035.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0035.922] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.923] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.923] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0035.923] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0035.923] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0035.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0035.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0035.923] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0035.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0035.923] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.924] GetFileType (hFile=0x274) returned 0x1 [0035.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0035.924] GetFileType (hFile=0x274) returned 0x1 [0035.924] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x20cc1 [0035.925] ReadFile (in: hFile=0x274, lpBuffer=0x29d3e88, nNumberOfBytesToRead=0x20cc1, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x29d3e88*, lpNumberOfBytesRead=0x2ae478*=0x20cc1, lpOverlapped=0x0) returned 1 [0035.944] CloseHandle (hObject=0x274) returned 1 [0035.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0035.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0035.968] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.971] GetFileType (hFile=0x274) returned 0x1 [0035.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0035.971] GetFileType (hFile=0x274) returned 0x1 [0035.971] WriteFile (in: hFile=0x274, lpBuffer=0x2a9cb00*, nNumberOfBytesToWrite=0x20cd0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2a9cb00*, lpNumberOfBytesWritten=0x2ae46c*=0x20cd0, lpOverlapped=0x0) returned 1 [0035.975] CloseHandle (hObject=0x274) returned 1 [0035.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0035.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0035.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0035.978] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcb65ec0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb465e450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20cd0)) returned 1 [0035.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0035.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf.anonymous")) returned 1 [0035.979] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0035.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0035.979] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0035.979] GetFileType (hFile=0x274) returned 0x1 [0035.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0035.979] GetFileType (hFile=0x274) returned 0x1 [0035.979] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x207b0 [0035.980] ReadFile (in: hFile=0x274, lpBuffer=0x2abd7f0, nNumberOfBytesToRead=0x207b0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2abd7f0*, lpNumberOfBytesRead=0x2ae478*=0x207b0, lpOverlapped=0x0) returned 1 [0036.012] CloseHandle (hObject=0x274) returned 1 [0036.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.062] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.065] GetFileType (hFile=0x274) returned 0x1 [0036.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.065] GetFileType (hFile=0x274) returned 0x1 [0036.065] WriteFile (in: hFile=0x274, lpBuffer=0x2b5fee0*, nNumberOfBytesToWrite=0x207c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2b5fee0*, lpNumberOfBytesWritten=0x2ae46c*=0x207c0, lpOverlapped=0x0) returned 1 [0036.069] CloseHandle (hObject=0x274) returned 1 [0036.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.071] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcb65ec0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4742c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x207c0)) returned 1 [0036.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf.anonymous")) returned 1 [0036.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.072] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT", lpFilePart=0x0) returned 0x39 [0036.072] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", lpFilePart=0x0) returned 0x3a [0036.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.072] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.073] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.073] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.073] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.073] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT", lpFilePart=0x0) returned 0x39 [0036.074] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", lpFilePart=0x0) returned 0x3a [0036.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.074] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.074] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.074] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.075] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.075] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.075] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.075] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.075] GetFileType (hFile=0x274) returned 0x1 [0036.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.076] GetFileType (hFile=0x274) returned 0x1 [0036.076] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x561b [0036.076] ReadFile (in: hFile=0x274, lpBuffer=0x1abd1a4, nNumberOfBytesToRead=0x561b, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1abd1a4*, lpNumberOfBytesRead=0x2ae478*=0x561b, lpOverlapped=0x0) returned 1 [0036.091] CloseHandle (hObject=0x274) returned 1 [0036.131] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.131] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.132] GetFileType (hFile=0x274) returned 0x1 [0036.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.133] GetFileType (hFile=0x274) returned 0x1 [0036.133] WriteFile (in: hFile=0x274, lpBuffer=0x1997ec8*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1997ec8*, lpNumberOfBytesWritten=0x2ae46c*=0x5620, lpOverlapped=0x0) returned 1 [0036.134] CloseHandle (hObject=0x274) returned 1 [0036.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.135] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcb3fd60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb47db210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5620)) returned 1 [0036.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf.anonymous")) returned 1 [0036.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.136] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.136] GetFileType (hFile=0x274) returned 0x1 [0036.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.136] GetFileType (hFile=0x274) returned 0x1 [0036.136] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x510a [0036.137] ReadFile (in: hFile=0x274, lpBuffer=0x199d930, nNumberOfBytesToRead=0x510a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x199d930*, lpNumberOfBytesRead=0x2ae478*=0x510a, lpOverlapped=0x0) returned 1 [0036.138] CloseHandle (hObject=0x274) returned 1 [0036.156] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.156] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.158] GetFileType (hFile=0x274) returned 0x1 [0036.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.158] GetFileType (hFile=0x274) returned 0x1 [0036.158] WriteFile (in: hFile=0x274, lpBuffer=0x1a03dc8*, nNumberOfBytesToWrite=0x5110, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a03dc8*, lpNumberOfBytesWritten=0x2ae46c*=0x5110, lpOverlapped=0x0) returned 1 [0036.160] CloseHandle (hObject=0x274) returned 1 [0036.161] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.161] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.161] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcb65ec0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb48274d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5110)) returned 1 [0036.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf.anonymous")) returned 1 [0036.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE", lpFilePart=0x0) returned 0x39 [0036.162] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", lpFilePart=0x0) returned 0x3a [0036.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0036.163] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.164] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.164] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.164] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.164] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0036.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.164] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE", lpFilePart=0x0) returned 0x39 [0036.164] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", lpFilePart=0x0) returned 0x3a [0036.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0036.165] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.165] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.165] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.165] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.165] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0036.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.166] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.166] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.167] GetFileType (hFile=0x274) returned 0x1 [0036.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.167] GetFileType (hFile=0x274) returned 0x1 [0036.167] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x16057 [0036.167] ReadFile (in: hFile=0x274, lpBuffer=0x2b806c0, nNumberOfBytesToRead=0x16057, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2b806c0*, lpNumberOfBytesRead=0x2ae478*=0x16057, lpOverlapped=0x0) returned 1 [0036.197] CloseHandle (hObject=0x274) returned 1 [0036.225] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.226] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.227] GetFileType (hFile=0x274) returned 0x1 [0036.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.228] GetFileType (hFile=0x274) returned 0x1 [0036.228] WriteFile (in: hFile=0x274, lpBuffer=0x2bee8d8*, nNumberOfBytesToWrite=0x16060, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2bee8d8*, lpNumberOfBytesWritten=0x2ae46c*=0x16060, lpOverlapped=0x0) returned 1 [0036.230] CloseHandle (hObject=0x274) returned 1 [0036.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.232] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1a5880, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb48e5bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16060)) returned 1 [0036.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf.anonymous")) returned 1 [0036.232] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.232] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.232] GetFileType (hFile=0x274) returned 0x1 [0036.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.232] GetFileType (hFile=0x274) returned 0x1 [0036.233] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x155af [0036.233] ReadFile (in: hFile=0x274, lpBuffer=0x2c04958, nNumberOfBytesToRead=0x155af, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2c04958*, lpNumberOfBytesRead=0x2ae478*=0x155af, lpOverlapped=0x0) returned 1 [0036.236] CloseHandle (hObject=0x274) returned 1 [0036.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.254] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.256] GetFileType (hFile=0x274) returned 0x1 [0036.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.256] GetFileType (hFile=0x274) returned 0x1 [0036.256] WriteFile (in: hFile=0x274, lpBuffer=0x2c6f608*, nNumberOfBytesToWrite=0x155b0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2c6f608*, lpNumberOfBytesWritten=0x2ae46c*=0x155b0, lpOverlapped=0x0) returned 1 [0036.258] CloseHandle (hObject=0x274) returned 1 [0036.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.260] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb490bd10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x155b0)) returned 1 [0036.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf.anonymous")) returned 1 [0036.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN", lpFilePart=0x0) returned 0x39 [0036.261] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", lpFilePart=0x0) returned 0x3a [0036.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0036.262] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.262] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.262] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.262] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.263] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0036.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN", lpFilePart=0x0) returned 0x39 [0036.263] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", lpFilePart=0x0) returned 0x3a [0036.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0036.263] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.263] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.263] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.264] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.264] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0036.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.264] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.264] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.264] GetFileType (hFile=0x274) returned 0x1 [0036.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.264] GetFileType (hFile=0x274) returned 0x1 [0036.264] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x106ec [0036.265] ReadFile (in: hFile=0x274, lpBuffer=0x1aa6b78, nNumberOfBytesToRead=0x106ec, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aa6b78*, lpNumberOfBytesRead=0x2ae478*=0x106ec, lpOverlapped=0x0) returned 1 [0036.284] CloseHandle (hObject=0x274) returned 1 [0036.299] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.299] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.301] GetFileType (hFile=0x274) returned 0x1 [0036.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.301] GetFileType (hFile=0x274) returned 0x1 [0036.301] WriteFile (in: hFile=0x274, lpBuffer=0x1b24e44*, nNumberOfBytesToWrite=0x106f0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b24e44*, lpNumberOfBytesWritten=0x2ae46c*=0x106f0, lpOverlapped=0x0) returned 1 [0036.303] CloseHandle (hObject=0x274) returned 1 [0036.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.304] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcb19c00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb497e130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x106f0)) returned 1 [0036.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf.anonymous")) returned 1 [0036.305] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.305] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.305] GetFileType (hFile=0x274) returned 0x1 [0036.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.305] GetFileType (hFile=0x274) returned 0x1 [0036.305] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x101ce [0036.311] ReadFile (in: hFile=0x274, lpBuffer=0x1940e74, nNumberOfBytesToRead=0x101ce, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1940e74*, lpNumberOfBytesRead=0x2ae478*=0x101ce, lpOverlapped=0x0) returned 1 [0036.318] CloseHandle (hObject=0x274) returned 1 [0036.355] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.355] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.357] GetFileType (hFile=0x274) returned 0x1 [0036.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.357] GetFileType (hFile=0x274) returned 0x1 [0036.357] WriteFile (in: hFile=0x274, lpBuffer=0x19be340*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19be340*, lpNumberOfBytesWritten=0x2ae46c*=0x101d0, lpOverlapped=0x0) returned 1 [0036.359] CloseHandle (hObject=0x274) returned 1 [0036.360] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.360] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.360] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcb19c00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4a166b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x101d0)) returned 1 [0036.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf.anonymous")) returned 1 [0036.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU", lpFilePart=0x0) returned 0x39 [0036.361] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", lpFilePart=0x0) returned 0x3a [0036.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0036.362] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.362] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.362] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.362] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.362] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0036.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU", lpFilePart=0x0) returned 0x39 [0036.362] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", lpFilePart=0x0) returned 0x3a [0036.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0036.363] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.363] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.363] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.363] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.363] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0036.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.363] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.364] GetFileType (hFile=0x274) returned 0x1 [0036.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.364] GetFileType (hFile=0x274) returned 0x1 [0036.364] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x106d4 [0036.364] ReadFile (in: hFile=0x274, lpBuffer=0x19d0348, nNumberOfBytesToRead=0x106d4, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19d0348*, lpNumberOfBytesRead=0x2ae478*=0x106d4, lpOverlapped=0x0) returned 1 [0036.376] CloseHandle (hObject=0x274) returned 1 [0036.406] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.407] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.408] GetFileType (hFile=0x274) returned 0x1 [0036.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.408] GetFileType (hFile=0x274) returned 0x1 [0036.408] WriteFile (in: hFile=0x274, lpBuffer=0x19505dc*, nNumberOfBytesToWrite=0x106e0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19505dc*, lpNumberOfBytesWritten=0x2ae46c*=0x106e0, lpOverlapped=0x0) returned 1 [0036.410] CloseHandle (hObject=0x274) returned 1 [0036.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.411] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce13780, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4a88ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x106e0)) returned 1 [0036.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf.anonymous")) returned 1 [0036.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.423] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.423] GetFileType (hFile=0x274) returned 0x1 [0036.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.423] GetFileType (hFile=0x274) returned 0x1 [0036.423] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x101bc [0036.423] ReadFile (in: hFile=0x274, lpBuffer=0x1961104, nNumberOfBytesToRead=0x101bc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1961104*, lpNumberOfBytesRead=0x2ae478*=0x101bc, lpOverlapped=0x0) returned 1 [0036.434] CloseHandle (hObject=0x274) returned 1 [0036.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.496] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.498] GetFileType (hFile=0x274) returned 0x1 [0036.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.499] GetFileType (hFile=0x274) returned 0x1 [0036.499] WriteFile (in: hFile=0x274, lpBuffer=0x19de59c*, nNumberOfBytesToWrite=0x101c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19de59c*, lpNumberOfBytesWritten=0x2ae46c*=0x101c0, lpOverlapped=0x0) returned 1 [0036.501] CloseHandle (hObject=0x274) returned 1 [0036.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce13780, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4b6d310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x101c0)) returned 1 [0036.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf.anonymous")) returned 1 [0036.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU", lpFilePart=0x0) returned 0x39 [0036.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", lpFilePart=0x0) returned 0x3a [0036.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.506] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.507] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.507] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.507] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.507] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.507] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU", lpFilePart=0x0) returned 0x39 [0036.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", lpFilePart=0x0) returned 0x3a [0036.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.508] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.508] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.508] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.508] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.508] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.509] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.509] GetFileType (hFile=0x274) returned 0x1 [0036.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.509] GetFileType (hFile=0x274) returned 0x1 [0036.509] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x14096 [0036.509] ReadFile (in: hFile=0x274, lpBuffer=0x19f0594, nNumberOfBytesToRead=0x14096, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19f0594*, lpNumberOfBytesRead=0x2ae478*=0x14096, lpOverlapped=0x0) returned 1 [0036.516] CloseHandle (hObject=0x274) returned 1 [0036.536] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.536] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.538] GetFileType (hFile=0x274) returned 0x1 [0036.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.538] GetFileType (hFile=0x274) returned 0x1 [0036.538] WriteFile (in: hFile=0x274, lpBuffer=0x1a79574*, nNumberOfBytesToWrite=0x140a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a79574*, lpNumberOfBytesWritten=0x2ae46c*=0x140a0, lpOverlapped=0x0) returned 1 [0036.541] CloseHandle (hObject=0x274) returned 1 [0036.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.543] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce13780, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4bdf730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x140a0)) returned 1 [0036.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf.anonymous")) returned 1 [0036.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.544] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.544] GetFileType (hFile=0x274) returned 0x1 [0036.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.544] GetFileType (hFile=0x274) returned 0x1 [0036.544] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x13b0b [0036.544] ReadFile (in: hFile=0x274, lpBuffer=0x1a8da5c, nNumberOfBytesToRead=0x13b0b, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a8da5c*, lpNumberOfBytesRead=0x2ae478*=0x13b0b, lpOverlapped=0x0) returned 1 [0036.550] CloseHandle (hObject=0x274) returned 1 [0036.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.567] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.569] GetFileType (hFile=0x274) returned 0x1 [0036.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.569] GetFileType (hFile=0x274) returned 0x1 [0036.569] WriteFile (in: hFile=0x274, lpBuffer=0x1b1598c*, nNumberOfBytesToWrite=0x13b10, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b1598c*, lpNumberOfBytesWritten=0x2ae46c*=0x13b10, lpOverlapped=0x0) returned 1 [0036.571] CloseHandle (hObject=0x274) returned 1 [0036.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.578] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce13780, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4c2b9f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13b10)) returned 1 [0036.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf.anonymous")) returned 1 [0036.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP", lpFilePart=0x0) returned 0x39 [0036.579] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpFilePart=0x0) returned 0x3a [0036.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0036.580] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.580] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.580] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.580] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.580] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0036.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.580] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP", lpFilePart=0x0) returned 0x39 [0036.580] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpFilePart=0x0) returned 0x3a [0036.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0036.580] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.581] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.581] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.581] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.581] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0036.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.581] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.581] GetFileType (hFile=0x274) returned 0x1 [0036.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.581] GetFileType (hFile=0x274) returned 0x1 [0036.581] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x109db [0036.582] ReadFile (in: hFile=0x274, lpBuffer=0x1b2b2d4, nNumberOfBytesToRead=0x109db, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2b2d4*, lpNumberOfBytesRead=0x2ae478*=0x109db, lpOverlapped=0x0) returned 1 [0036.583] CloseHandle (hObject=0x274) returned 1 [0036.609] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.609] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.611] GetFileType (hFile=0x274) returned 0x1 [0036.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.611] GetFileType (hFile=0x274) returned 0x1 [0036.611] WriteFile (in: hFile=0x274, lpBuffer=0x1961908*, nNumberOfBytesToWrite=0x109e0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1961908*, lpNumberOfBytesWritten=0x2ae46c*=0x109e0, lpOverlapped=0x0) returned 1 [0036.613] CloseHandle (hObject=0x274) returned 1 [0036.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.614] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4c77cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x109e0)) returned 1 [0036.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf.anonymous")) returned 1 [0036.615] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.615] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.615] GetFileType (hFile=0x274) returned 0x1 [0036.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.616] GetFileType (hFile=0x274) returned 0x1 [0036.616] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x104bf [0036.616] ReadFile (in: hFile=0x274, lpBuffer=0x1972730, nNumberOfBytesToRead=0x104bf, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1972730*, lpNumberOfBytesRead=0x2ae478*=0x104bf, lpOverlapped=0x0) returned 1 [0036.630] CloseHandle (hObject=0x274) returned 1 [0036.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.666] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.668] GetFileType (hFile=0x274) returned 0x1 [0036.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.668] GetFileType (hFile=0x274) returned 0x1 [0036.668] WriteFile (in: hFile=0x274, lpBuffer=0x19f04cc*, nNumberOfBytesToWrite=0x104c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19f04cc*, lpNumberOfBytesWritten=0x2ae46c*=0x104c0, lpOverlapped=0x0) returned 1 [0036.670] CloseHandle (hObject=0x274) returned 1 [0036.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.672] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4d10230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x104c0)) returned 1 [0036.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf.anonymous")) returned 1 [0036.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.672] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ", lpFilePart=0x0) returned 0x39 [0036.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", lpFilePart=0x0) returned 0x3a [0036.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.672] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.673] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.673] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ", lpFilePart=0x0) returned 0x39 [0036.673] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", lpFilePart=0x0) returned 0x3a [0036.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.673] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.673] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.673] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA", lpFilePart=0x0) returned 0x39 [0036.674] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpFilePart=0x0) returned 0x3a [0036.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.674] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.674] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.675] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.675] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA", lpFilePart=0x0) returned 0x39 [0036.675] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpFilePart=0x0) returned 0x3a [0036.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.675] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.676] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.676] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.676] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.676] GetFileType (hFile=0x274) returned 0x1 [0036.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.676] GetFileType (hFile=0x274) returned 0x1 [0036.676] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10ab0 [0036.676] ReadFile (in: hFile=0x274, lpBuffer=0x1a03aec, nNumberOfBytesToRead=0x10ab0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a03aec*, lpNumberOfBytesRead=0x2ae478*=0x10ab0, lpOverlapped=0x0) returned 1 [0036.683] CloseHandle (hObject=0x274) returned 1 [0036.697] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.698] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.699] GetFileType (hFile=0x274) returned 0x1 [0036.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.699] GetFileType (hFile=0x274) returned 0x1 [0036.699] WriteFile (in: hFile=0x274, lpBuffer=0x1a82928*, nNumberOfBytesToWrite=0x10ac0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a82928*, lpNumberOfBytesWritten=0x2ae46c*=0x10ac0, lpOverlapped=0x0) returned 1 [0036.701] CloseHandle (hObject=0x274) returned 1 [0036.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.703] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4d5c4f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10ac0)) returned 1 [0036.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf.anonymous")) returned 1 [0036.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.703] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.703] GetFileType (hFile=0x274) returned 0x1 [0036.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.704] GetFileType (hFile=0x274) returned 0x1 [0036.704] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10596 [0036.704] ReadFile (in: hFile=0x274, lpBuffer=0x1a93830, nNumberOfBytesToRead=0x10596, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a93830*, lpNumberOfBytesRead=0x2ae478*=0x10596, lpOverlapped=0x0) returned 1 [0036.713] CloseHandle (hObject=0x274) returned 1 [0036.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.728] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.730] GetFileType (hFile=0x274) returned 0x1 [0036.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.730] GetFileType (hFile=0x274) returned 0x1 [0036.730] WriteFile (in: hFile=0x274, lpBuffer=0x1b11710*, nNumberOfBytesToWrite=0x105a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b11710*, lpNumberOfBytesWritten=0x2ae46c*=0x105a0, lpOverlapped=0x0) returned 1 [0036.732] CloseHandle (hObject=0x274) returned 1 [0036.733] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.733] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.733] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4da87b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x105a0)) returned 1 [0036.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf.anonymous")) returned 1 [0036.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.734] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV", lpFilePart=0x0) returned 0x39 [0036.734] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpFilePart=0x0) returned 0x3a [0036.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0036.734] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.734] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.734] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.735] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.735] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0036.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV", lpFilePart=0x0) returned 0x39 [0036.735] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpFilePart=0x0) returned 0x3a [0036.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0036.735] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.735] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.735] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.735] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.736] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0036.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.736] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.736] GetFileType (hFile=0x274) returned 0x1 [0036.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.736] GetFileType (hFile=0x274) returned 0x1 [0036.736] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x43b5 [0036.736] ReadFile (in: hFile=0x274, lpBuffer=0x1b23ae8, nNumberOfBytesToRead=0x43b5, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b23ae8*, lpNumberOfBytesRead=0x2ae478*=0x43b5, lpOverlapped=0x0) returned 1 [0036.746] CloseHandle (hObject=0x274) returned 1 [0036.782] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.782] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.784] GetFileType (hFile=0x274) returned 0x1 [0036.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.784] GetFileType (hFile=0x274) returned 0x1 [0036.784] WriteFile (in: hFile=0x274, lpBuffer=0x1979268*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1979268*, lpNumberOfBytesWritten=0x2ae46c*=0x43c0, lpOverlapped=0x0) returned 1 [0036.785] CloseHandle (hObject=0x274) returned 1 [0036.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.786] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4e1abd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x43c0)) returned 1 [0036.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf.anonymous")) returned 1 [0036.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.787] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.787] GetFileType (hFile=0x274) returned 0x1 [0036.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.787] GetFileType (hFile=0x274) returned 0x1 [0036.787] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3e95 [0036.787] ReadFile (in: hFile=0x274, lpBuffer=0x197da70, nNumberOfBytesToRead=0x3e95, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197da70*, lpNumberOfBytesRead=0x2ae478*=0x3e95, lpOverlapped=0x0) returned 1 [0036.789] CloseHandle (hObject=0x274) returned 1 [0036.801] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.801] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.803] GetFileType (hFile=0x274) returned 0x1 [0036.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.803] GetFileType (hFile=0x274) returned 0x1 [0036.803] WriteFile (in: hFile=0x274, lpBuffer=0x19de2d8*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19de2d8*, lpNumberOfBytesWritten=0x2ae46c*=0x3ea0, lpOverlapped=0x0) returned 1 [0036.804] CloseHandle (hObject=0x274) returned 1 [0036.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.805] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4e40d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ea0)) returned 1 [0036.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf.anonymous")) returned 1 [0036.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN", lpFilePart=0x0) returned 0x39 [0036.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpFilePart=0x0) returned 0x3a [0036.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.806] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.807] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.807] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.807] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.807] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN", lpFilePart=0x0) returned 0x39 [0036.807] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpFilePart=0x0) returned 0x3a [0036.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0036.807] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.808] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.808] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.808] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.808] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0036.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.808] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.808] GetFileType (hFile=0x274) returned 0x1 [0036.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.808] GetFileType (hFile=0x274) returned 0x1 [0036.808] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x16097 [0036.809] ReadFile (in: hFile=0x274, lpBuffer=0x2ac4bc0, nNumberOfBytesToRead=0x16097, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2ac4bc0*, lpNumberOfBytesRead=0x2ae478*=0x16097, lpOverlapped=0x0) returned 1 [0036.824] CloseHandle (hObject=0x274) returned 1 [0036.940] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.940] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.940] GetFileType (hFile=0x274) returned 0x1 [0036.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.940] GetFileType (hFile=0x274) returned 0x1 [0036.940] WriteFile (in: hFile=0x274, lpBuffer=0x2b32f18*, nNumberOfBytesToWrite=0x160a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2b32f18*, lpNumberOfBytesWritten=0x2ae46c*=0x160a0, lpOverlapped=0x0) returned 1 [0036.943] CloseHandle (hObject=0x274) returned 1 [0036.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0036.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.944] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb4f97990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160a0)) returned 1 [0036.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf.anonymous")) returned 1 [0036.945] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.945] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.945] GetFileType (hFile=0x274) returned 0x1 [0036.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.945] GetFileType (hFile=0x274) returned 0x1 [0036.945] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x15db2 [0036.946] ReadFile (in: hFile=0x274, lpBuffer=0x2b48fd8, nNumberOfBytesToRead=0x15db2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2b48fd8*, lpNumberOfBytesRead=0x2ae478*=0x15db2, lpOverlapped=0x0) returned 1 [0036.957] CloseHandle (hObject=0x274) returned 1 [0036.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0036.977] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.979] GetFileType (hFile=0x274) returned 0x1 [0036.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0036.979] GetFileType (hFile=0x274) returned 0x1 [0036.979] WriteFile (in: hFile=0x274, lpBuffer=0x2bb64c8*, nNumberOfBytesToWrite=0x15dc0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2bb64c8*, lpNumberOfBytesWritten=0x2ae46c*=0x15dc0, lpOverlapped=0x0) returned 1 [0036.981] CloseHandle (hObject=0x274) returned 1 [0036.983] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0036.983] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0036.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0036.983] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5009db0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15dc0)) returned 1 [0036.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0036.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf.anonymous")) returned 1 [0036.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.983] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA", lpFilePart=0x0) returned 0x39 [0036.983] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpFilePart=0x0) returned 0x3a [0036.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0036.984] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.984] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.984] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.984] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.984] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0036.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0036.984] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA", lpFilePart=0x0) returned 0x39 [0036.984] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpFilePart=0x0) returned 0x3a [0036.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0036.985] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.985] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.985] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0036.985] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0036.985] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0036.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0036.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0036.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0036.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0036.985] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0036.986] GetFileType (hFile=0x274) returned 0x1 [0036.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0036.986] GetFileType (hFile=0x274) returned 0x1 [0036.986] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10913 [0036.986] ReadFile (in: hFile=0x274, lpBuffer=0x1a7fe24, nNumberOfBytesToRead=0x10913, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a7fe24*, lpNumberOfBytesRead=0x2ae478*=0x10913, lpOverlapped=0x0) returned 1 [0036.998] CloseHandle (hObject=0x274) returned 1 [0037.014] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.014] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.016] GetFileType (hFile=0x274) returned 0x1 [0037.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.016] GetFileType (hFile=0x274) returned 0x1 [0037.016] WriteFile (in: hFile=0x274, lpBuffer=0x1afe784*, nNumberOfBytesToWrite=0x10920, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1afe784*, lpNumberOfBytesWritten=0x2ae46c*=0x10920, lpOverlapped=0x0) returned 1 [0037.018] CloseHandle (hObject=0x274) returned 1 [0037.019] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.019] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.019] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5056070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10920)) returned 1 [0037.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf.anonymous")) returned 1 [0037.019] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.019] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.020] GetFileType (hFile=0x274) returned 0x1 [0037.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.020] GetFileType (hFile=0x274) returned 0x1 [0037.020] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x103f8 [0037.020] ReadFile (in: hFile=0x274, lpBuffer=0x1b0f4ec, nNumberOfBytesToRead=0x103f8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b0f4ec*, lpNumberOfBytesRead=0x2ae478*=0x103f8, lpOverlapped=0x0) returned 1 [0037.028] CloseHandle (hObject=0x274) returned 1 [0037.067] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.067] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.068] GetFileType (hFile=0x274) returned 0x1 [0037.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.068] GetFileType (hFile=0x274) returned 0x1 [0037.068] WriteFile (in: hFile=0x274, lpBuffer=0x1998f30*, nNumberOfBytesToWrite=0x10400, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1998f30*, lpNumberOfBytesWritten=0x2ae46c*=0x10400, lpOverlapped=0x0) returned 1 [0037.070] CloseHandle (hObject=0x274) returned 1 [0037.072] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.072] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.072] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb50ee5f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10400)) returned 1 [0037.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf.anonymous")) returned 1 [0037.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN", lpFilePart=0x0) returned 0x39 [0037.073] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpFilePart=0x0) returned 0x3a [0037.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0037.073] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.073] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.073] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.074] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.074] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0037.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.074] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN", lpFilePart=0x0) returned 0x39 [0037.074] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpFilePart=0x0) returned 0x3a [0037.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0037.074] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.074] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.074] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.075] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.075] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0037.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.075] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.075] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.075] GetFileType (hFile=0x274) returned 0x1 [0037.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.075] GetFileType (hFile=0x274) returned 0x1 [0037.075] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5944 [0037.075] ReadFile (in: hFile=0x274, lpBuffer=0x19ab168, nNumberOfBytesToRead=0x5944, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19ab168*, lpNumberOfBytesRead=0x2ae478*=0x5944, lpOverlapped=0x0) returned 1 [0037.086] CloseHandle (hObject=0x274) returned 1 [0037.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.101] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.103] GetFileType (hFile=0x274) returned 0x1 [0037.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.103] GetFileType (hFile=0x274) returned 0x1 [0037.103] WriteFile (in: hFile=0x274, lpBuffer=0x1a13f3c*, nNumberOfBytesToWrite=0x5950, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a13f3c*, lpNumberOfBytesWritten=0x2ae46c*=0x5950, lpOverlapped=0x0) returned 1 [0037.104] CloseHandle (hObject=0x274) returned 1 [0037.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.105] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb513a8b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5950)) returned 1 [0037.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf.anonymous")) returned 1 [0037.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.106] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.107] GetFileType (hFile=0x274) returned 0x1 [0037.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.107] GetFileType (hFile=0x274) returned 0x1 [0037.107] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5404 [0037.107] ReadFile (in: hFile=0x274, lpBuffer=0x1a19cd4, nNumberOfBytesToRead=0x5404, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a19cd4*, lpNumberOfBytesRead=0x2ae478*=0x5404, lpOverlapped=0x0) returned 1 [0037.109] CloseHandle (hObject=0x274) returned 1 [0037.127] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.127] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.129] GetFileType (hFile=0x274) returned 0x1 [0037.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.129] GetFileType (hFile=0x274) returned 0x1 [0037.129] WriteFile (in: hFile=0x274, lpBuffer=0x1a80f0c*, nNumberOfBytesToWrite=0x5410, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a80f0c*, lpNumberOfBytesWritten=0x2ae46c*=0x5410, lpOverlapped=0x0) returned 1 [0037.131] CloseHandle (hObject=0x274) returned 1 [0037.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.133] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5160a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5410)) returned 1 [0037.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf.anonymous")) returned 1 [0037.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR", lpFilePart=0x0) returned 0x39 [0037.133] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpFilePart=0x0) returned 0x3a [0037.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0037.134] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.134] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.134] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.134] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.134] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0037.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR", lpFilePart=0x0) returned 0x39 [0037.135] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpFilePart=0x0) returned 0x3a [0037.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0037.135] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.135] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.135] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.136] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.136] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0037.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.136] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.136] GetFileType (hFile=0x274) returned 0x1 [0037.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.136] GetFileType (hFile=0x274) returned 0x1 [0037.136] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x592a [0037.136] ReadFile (in: hFile=0x274, lpBuffer=0x1a88154, nNumberOfBytesToRead=0x592a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a88154*, lpNumberOfBytesRead=0x2ae478*=0x592a, lpOverlapped=0x0) returned 1 [0037.139] CloseHandle (hObject=0x274) returned 1 [0037.157] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.157] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.159] GetFileType (hFile=0x274) returned 0x1 [0037.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.159] GetFileType (hFile=0x274) returned 0x1 [0037.159] WriteFile (in: hFile=0x274, lpBuffer=0x1af0d30*, nNumberOfBytesToWrite=0x5930, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1af0d30*, lpNumberOfBytesWritten=0x2ae46c*=0x5930, lpOverlapped=0x0) returned 1 [0037.160] CloseHandle (hObject=0x274) returned 1 [0037.161] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.161] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.162] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb51accd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5930)) returned 1 [0037.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf.anonymous")) returned 1 [0037.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.162] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.163] GetFileType (hFile=0x274) returned 0x1 [0037.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.163] GetFileType (hFile=0x274) returned 0x1 [0037.163] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5416 [0037.163] ReadFile (in: hFile=0x274, lpBuffer=0x1af6aa8, nNumberOfBytesToRead=0x5416, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1af6aa8*, lpNumberOfBytesRead=0x2ae478*=0x5416, lpOverlapped=0x0) returned 1 [0037.165] CloseHandle (hObject=0x274) returned 1 [0037.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.183] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.185] GetFileType (hFile=0x274) returned 0x1 [0037.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.185] GetFileType (hFile=0x274) returned 0x1 [0037.185] WriteFile (in: hFile=0x274, lpBuffer=0x1b5dd34*, nNumberOfBytesToWrite=0x5420, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b5dd34*, lpNumberOfBytesWritten=0x2ae46c*=0x5420, lpOverlapped=0x0) returned 1 [0037.187] CloseHandle (hObject=0x274) returned 1 [0037.188] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.188] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.188] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb51f8f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5420)) returned 1 [0037.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf.anonymous")) returned 1 [0037.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.189] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD", lpFilePart=0x0) returned 0x39 [0037.189] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpFilePart=0x0) returned 0x3a [0037.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0037.190] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.192] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.192] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.192] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.192] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0037.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD", lpFilePart=0x0) returned 0x39 [0037.192] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpFilePart=0x0) returned 0x3a [0037.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0037.193] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.193] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.193] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.193] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.193] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0037.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.193] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.194] GetFileType (hFile=0x274) returned 0x1 [0037.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.194] GetFileType (hFile=0x274) returned 0x1 [0037.194] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10929 [0037.194] ReadFile (in: hFile=0x274, lpBuffer=0x1951bc0, nNumberOfBytesToRead=0x10929, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1951bc0*, lpNumberOfBytesRead=0x2ae478*=0x10929, lpOverlapped=0x0) returned 1 [0037.199] CloseHandle (hObject=0x274) returned 1 [0037.236] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.236] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.237] GetFileType (hFile=0x274) returned 0x1 [0037.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.237] GetFileType (hFile=0x274) returned 0x1 [0037.237] WriteFile (in: hFile=0x274, lpBuffer=0x19d06ac*, nNumberOfBytesToWrite=0x10930, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19d06ac*, lpNumberOfBytesWritten=0x2ae46c*=0x10930, lpOverlapped=0x0) returned 1 [0037.239] CloseHandle (hObject=0x274) returned 1 [0037.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.275] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5291510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10930)) returned 1 [0037.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf.anonymous")) returned 1 [0037.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.275] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.276] GetFileType (hFile=0x274) returned 0x1 [0037.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.276] GetFileType (hFile=0x274) returned 0x1 [0037.276] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10405 [0037.276] ReadFile (in: hFile=0x274, lpBuffer=0x19e1424, nNumberOfBytesToRead=0x10405, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e1424*, lpNumberOfBytesRead=0x2ae478*=0x10405, lpOverlapped=0x0) returned 1 [0037.278] CloseHandle (hObject=0x274) returned 1 [0037.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.300] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.302] GetFileType (hFile=0x274) returned 0x1 [0037.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.303] GetFileType (hFile=0x274) returned 0x1 [0037.303] WriteFile (in: hFile=0x274, lpBuffer=0x1a5ee54*, nNumberOfBytesToWrite=0x10410, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a5ee54*, lpNumberOfBytesWritten=0x2ae46c*=0x10410, lpOverlapped=0x0) returned 1 [0037.305] CloseHandle (hObject=0x274) returned 1 [0037.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.307] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce5fa40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb52dd7d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10410)) returned 1 [0037.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf.anonymous")) returned 1 [0037.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR", lpFilePart=0x0) returned 0x39 [0037.308] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpFilePart=0x0) returned 0x3a [0037.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0037.308] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.308] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.308] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.309] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.309] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0037.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR", lpFilePart=0x0) returned 0x39 [0037.309] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpFilePart=0x0) returned 0x3a [0037.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0037.309] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.310] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.310] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.310] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.310] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0037.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.310] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.311] GetFileType (hFile=0x274) returned 0x1 [0037.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.311] GetFileType (hFile=0x274) returned 0x1 [0037.311] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10956 [0037.312] ReadFile (in: hFile=0x274, lpBuffer=0x1a7109c, nNumberOfBytesToRead=0x10956, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a7109c*, lpNumberOfBytesRead=0x2ae478*=0x10956, lpOverlapped=0x0) returned 1 [0037.337] CloseHandle (hObject=0x274) returned 1 [0037.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.359] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.361] GetFileType (hFile=0x274) returned 0x1 [0037.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.361] GetFileType (hFile=0x274) returned 0x1 [0037.361] WriteFile (in: hFile=0x274, lpBuffer=0x1aefabc*, nNumberOfBytesToWrite=0x10960, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1aefabc*, lpNumberOfBytesWritten=0x2ae46c*=0x10960, lpOverlapped=0x0) returned 1 [0037.364] CloseHandle (hObject=0x274) returned 1 [0037.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.366] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce85ba0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb534fbf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10960)) returned 1 [0037.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf.anonymous")) returned 1 [0037.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.366] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.366] GetFileType (hFile=0x274) returned 0x1 [0037.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.367] GetFileType (hFile=0x274) returned 0x1 [0037.367] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1043a [0037.367] ReadFile (in: hFile=0x274, lpBuffer=0x1b00864, nNumberOfBytesToRead=0x1043a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b00864*, lpNumberOfBytesRead=0x2ae478*=0x1043a, lpOverlapped=0x0) returned 1 [0037.391] CloseHandle (hObject=0x274) returned 1 [0037.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.441] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.443] GetFileType (hFile=0x274) returned 0x1 [0037.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.443] GetFileType (hFile=0x274) returned 0x1 [0037.443] WriteFile (in: hFile=0x274, lpBuffer=0x198ea04*, nNumberOfBytesToWrite=0x10440, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x198ea04*, lpNumberOfBytesWritten=0x2ae46c*=0x10440, lpOverlapped=0x0) returned 1 [0037.447] CloseHandle (hObject=0x274) returned 1 [0037.448] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.448] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.448] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce85ba0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5434430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10440)) returned 1 [0037.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf.anonymous")) returned 1 [0037.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL", lpFilePart=0x0) returned 0x39 [0037.449] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpFilePart=0x0) returned 0x3a [0037.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0037.450] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.450] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.451] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.451] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.451] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0037.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL", lpFilePart=0x0) returned 0x39 [0037.451] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpFilePart=0x0) returned 0x3a [0037.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0037.451] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.452] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.452] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.452] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.452] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0037.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.452] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.453] GetFileType (hFile=0x274) returned 0x1 [0037.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.453] GetFileType (hFile=0x274) returned 0x1 [0037.453] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x26ca2 [0037.454] ReadFile (in: hFile=0x274, lpBuffer=0x2c912a8, nNumberOfBytesToRead=0x26ca2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2c912a8*, lpNumberOfBytesRead=0x2ae478*=0x26ca2, lpOverlapped=0x0) returned 1 [0037.483] CloseHandle (hObject=0x274) returned 1 [0037.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.506] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.508] GetFileType (hFile=0x274) returned 0x1 [0037.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.508] GetFileType (hFile=0x274) returned 0x1 [0037.508] WriteFile (in: hFile=0x274, lpBuffer=0x2a67100*, nNumberOfBytesToWrite=0x26cb0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2a67100*, lpNumberOfBytesWritten=0x2ae46c*=0x26cb0, lpOverlapped=0x0) returned 1 [0037.511] CloseHandle (hObject=0x274) returned 1 [0037.514] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.514] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.514] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb54cc9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26cb0)) returned 1 [0037.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf.anonymous")) returned 1 [0037.515] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.515] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.515] GetFileType (hFile=0x274) returned 0x1 [0037.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.516] GetFileType (hFile=0x274) returned 0x1 [0037.516] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x25d4a [0037.516] ReadFile (in: hFile=0x274, lpBuffer=0x29dace8, nNumberOfBytesToRead=0x25d4a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x29dace8*, lpNumberOfBytesRead=0x2ae478*=0x25d4a, lpOverlapped=0x0) returned 1 [0037.537] CloseHandle (hObject=0x274) returned 1 [0037.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.584] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.586] GetFileType (hFile=0x274) returned 0x1 [0037.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.586] GetFileType (hFile=0x274) returned 0x1 [0037.586] WriteFile (in: hFile=0x274, lpBuffer=0x2b25330*, nNumberOfBytesToWrite=0x25d50, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2b25330*, lpNumberOfBytesWritten=0x2ae46c*=0x25d50, lpOverlapped=0x0) returned 1 [0037.596] CloseHandle (hObject=0x274) returned 1 [0037.597] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.597] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.598] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb558b090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25d50)) returned 1 [0037.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf.anonymous")) returned 1 [0037.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB", lpFilePart=0x0) returned 0x39 [0037.598] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpFilePart=0x0) returned 0x3a [0037.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0037.599] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.599] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.599] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.599] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.599] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0037.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.599] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB", lpFilePart=0x0) returned 0x39 [0037.599] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpFilePart=0x0) returned 0x3a [0037.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0037.600] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.600] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.600] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.600] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.600] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0037.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.600] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.600] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.601] GetFileType (hFile=0x274) returned 0x1 [0037.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.601] GetFileType (hFile=0x274) returned 0x1 [0037.601] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x11426 [0037.601] ReadFile (in: hFile=0x274, lpBuffer=0x197e9f4, nNumberOfBytesToRead=0x11426, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197e9f4*, lpNumberOfBytesRead=0x2ae478*=0x11426, lpOverlapped=0x0) returned 1 [0037.618] CloseHandle (hObject=0x274) returned 1 [0037.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.633] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.635] GetFileType (hFile=0x274) returned 0x1 [0037.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.635] GetFileType (hFile=0x274) returned 0x1 [0037.635] WriteFile (in: hFile=0x274, lpBuffer=0x19ff484*, nNumberOfBytesToWrite=0x11430, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19ff484*, lpNumberOfBytesWritten=0x2ae46c*=0x11430, lpOverlapped=0x0) returned 1 [0037.637] CloseHandle (hObject=0x274) returned 1 [0037.639] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.639] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.639] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb55fd4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11430)) returned 1 [0037.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf.anonymous")) returned 1 [0037.639] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.640] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.640] GetFileType (hFile=0x274) returned 0x1 [0037.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.640] GetFileType (hFile=0x274) returned 0x1 [0037.640] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10f09 [0037.640] ReadFile (in: hFile=0x274, lpBuffer=0x1a10cfc, nNumberOfBytesToRead=0x10f09, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a10cfc*, lpNumberOfBytesRead=0x2ae478*=0x10f09, lpOverlapped=0x0) returned 1 [0037.650] CloseHandle (hObject=0x274) returned 1 [0037.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.665] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.667] GetFileType (hFile=0x274) returned 0x1 [0037.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.667] GetFileType (hFile=0x274) returned 0x1 [0037.667] WriteFile (in: hFile=0x274, lpBuffer=0x1a9082c*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a9082c*, lpNumberOfBytesWritten=0x2ae46c*=0x10f10, lpOverlapped=0x0) returned 1 [0037.669] CloseHandle (hObject=0x274) returned 1 [0037.670] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.670] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.670] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5649770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10f10)) returned 1 [0037.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf.anonymous")) returned 1 [0037.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM", lpFilePart=0x0) returned 0x39 [0037.671] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpFilePart=0x0) returned 0x3a [0037.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0037.672] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.672] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.672] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.672] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.672] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0037.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.673] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM", lpFilePart=0x0) returned 0x39 [0037.673] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpFilePart=0x0) returned 0x3a [0037.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0037.673] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.673] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.673] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.673] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.673] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0037.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.674] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.674] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.674] GetFileType (hFile=0x274) returned 0x1 [0037.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.674] GetFileType (hFile=0x274) returned 0x1 [0037.674] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5891 [0037.674] ReadFile (in: hFile=0x274, lpBuffer=0x1aa3574, nNumberOfBytesToRead=0x5891, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aa3574*, lpNumberOfBytesRead=0x2ae478*=0x5891, lpOverlapped=0x0) returned 1 [0037.683] CloseHandle (hObject=0x274) returned 1 [0037.695] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.695] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.696] GetFileType (hFile=0x274) returned 0x1 [0037.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.696] GetFileType (hFile=0x274) returned 0x1 [0037.696] WriteFile (in: hFile=0x274, lpBuffer=0x1b0be80*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b0be80*, lpNumberOfBytesWritten=0x2ae46c*=0x58a0, lpOverlapped=0x0) returned 1 [0037.698] CloseHandle (hObject=0x274) returned 1 [0037.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.699] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5695a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x58a0)) returned 1 [0037.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf.anonymous")) returned 1 [0037.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.702] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.702] GetFileType (hFile=0x274) returned 0x1 [0037.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.702] GetFileType (hFile=0x274) returned 0x1 [0037.702] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5be8 [0037.702] ReadFile (in: hFile=0x274, lpBuffer=0x1b11b68, nNumberOfBytesToRead=0x5be8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b11b68*, lpNumberOfBytesRead=0x2ae478*=0x5be8, lpOverlapped=0x0) returned 1 [0037.709] CloseHandle (hObject=0x274) returned 1 [0037.746] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.747] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.748] GetFileType (hFile=0x274) returned 0x1 [0037.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.748] GetFileType (hFile=0x274) returned 0x1 [0037.748] WriteFile (in: hFile=0x274, lpBuffer=0x19816f0*, nNumberOfBytesToWrite=0x5bf0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19816f0*, lpNumberOfBytesWritten=0x2ae46c*=0x5bf0, lpOverlapped=0x0) returned 1 [0037.749] CloseHandle (hObject=0x274) returned 1 [0037.750] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.750] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd17f720, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5707e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5bf0)) returned 1 [0037.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf.anonymous")) returned 1 [0037.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.751] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS", lpFilePart=0x0) returned 0x39 [0037.751] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpFilePart=0x0) returned 0x3a [0037.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0037.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.752] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0037.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS", lpFilePart=0x0) returned 0x39 [0037.752] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpFilePart=0x0) returned 0x3a [0037.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0037.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.753] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0037.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.753] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.753] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.753] GetFileType (hFile=0x274) returned 0x1 [0037.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.753] GetFileType (hFile=0x274) returned 0x1 [0037.753] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1e071 [0037.754] ReadFile (in: hFile=0x274, lpBuffer=0x2b8f720, nNumberOfBytesToRead=0x1e071, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2b8f720*, lpNumberOfBytesRead=0x2ae478*=0x1e071, lpOverlapped=0x0) returned 1 [0037.765] CloseHandle (hObject=0x274) returned 1 [0037.781] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.781] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.783] GetFileType (hFile=0x274) returned 0x1 [0037.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.784] GetFileType (hFile=0x274) returned 0x1 [0037.784] WriteFile (in: hFile=0x274, lpBuffer=0x2c259d0*, nNumberOfBytesToWrite=0x1e080, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2c259d0*, lpNumberOfBytesWritten=0x2ae46c*=0x1e080, lpOverlapped=0x0) returned 1 [0037.786] CloseHandle (hObject=0x274) returned 1 [0037.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5754110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e080)) returned 1 [0037.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf.anonymous")) returned 1 [0037.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.789] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.789] GetFileType (hFile=0x274) returned 0x1 [0037.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.789] GetFileType (hFile=0x274) returned 0x1 [0037.789] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1d17f [0037.789] ReadFile (in: hFile=0x274, lpBuffer=0x2c43a70, nNumberOfBytesToRead=0x1d17f, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2c43a70*, lpNumberOfBytesRead=0x2ae478*=0x1d17f, lpOverlapped=0x0) returned 1 [0037.797] CloseHandle (hObject=0x274) returned 1 [0037.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.821] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.823] GetFileType (hFile=0x274) returned 0x1 [0037.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.823] GetFileType (hFile=0x274) returned 0x1 [0037.823] WriteFile (in: hFile=0x274, lpBuffer=0x298d368*, nNumberOfBytesToWrite=0x1d180, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesWritten=0x2ae46c*=0x1d180, lpOverlapped=0x0) returned 1 [0037.826] CloseHandle (hObject=0x274) returned 1 [0037.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.827] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb57c6530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d180)) returned 1 [0037.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf.anonymous")) returned 1 [0037.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY", lpFilePart=0x0) returned 0x39 [0037.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpFilePart=0x0) returned 0x3a [0037.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0037.829] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.829] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.829] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.829] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.829] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0037.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY", lpFilePart=0x0) returned 0x39 [0037.830] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpFilePart=0x0) returned 0x3a [0037.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0037.830] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.830] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.830] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.830] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.830] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0037.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.831] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.831] GetFileType (hFile=0x274) returned 0x1 [0037.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.831] GetFileType (hFile=0x274) returned 0x1 [0037.831] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x161fc [0037.831] ReadFile (in: hFile=0x274, lpBuffer=0x29aa508, nNumberOfBytesToRead=0x161fc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x29aa508*, lpNumberOfBytesRead=0x2ae478*=0x161fc, lpOverlapped=0x0) returned 1 [0037.833] CloseHandle (hObject=0x274) returned 1 [0037.875] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.875] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.877] GetFileType (hFile=0x274) returned 0x1 [0037.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.877] GetFileType (hFile=0x274) returned 0x1 [0037.877] WriteFile (in: hFile=0x274, lpBuffer=0x2c8d010*, nNumberOfBytesToWrite=0x16200, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2c8d010*, lpNumberOfBytesWritten=0x2ae46c*=0x16200, lpOverlapped=0x0) returned 1 [0037.880] CloseHandle (hObject=0x274) returned 1 [0037.881] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.881] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.881] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5838950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16200)) returned 1 [0037.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf.anonymous")) returned 1 [0037.882] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.882] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.882] GetFileType (hFile=0x274) returned 0x1 [0037.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.882] GetFileType (hFile=0x274) returned 0x1 [0037.882] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x13d46 [0037.882] ReadFile (in: hFile=0x274, lpBuffer=0x197e99c, nNumberOfBytesToRead=0x13d46, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197e99c*, lpNumberOfBytesRead=0x2ae478*=0x13d46, lpOverlapped=0x0) returned 1 [0037.899] CloseHandle (hObject=0x274) returned 1 [0037.913] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.913] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.914] GetFileType (hFile=0x274) returned 0x1 [0037.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.914] GetFileType (hFile=0x274) returned 0x1 [0037.914] WriteFile (in: hFile=0x274, lpBuffer=0x1a06f8c*, nNumberOfBytesToWrite=0x13d50, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a06f8c*, lpNumberOfBytesWritten=0x2ae46c*=0x13d50, lpOverlapped=0x0) returned 1 [0037.917] CloseHandle (hObject=0x274) returned 1 [0037.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.918] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb58aad70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13d50)) returned 1 [0037.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf.anonymous")) returned 1 [0037.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV", lpFilePart=0x0) returned 0x39 [0037.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpFilePart=0x0) returned 0x3a [0037.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0037.919] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.920] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.920] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.920] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.920] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0037.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV", lpFilePart=0x0) returned 0x39 [0037.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpFilePart=0x0) returned 0x3a [0037.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0037.920] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.920] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.921] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.921] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.921] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0037.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.921] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.921] GetFileType (hFile=0x274) returned 0x1 [0037.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.921] GetFileType (hFile=0x274) returned 0x1 [0037.921] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6133 [0037.921] ReadFile (in: hFile=0x274, lpBuffer=0x1a1cb14, nNumberOfBytesToRead=0x6133, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a1cb14*, lpNumberOfBytesRead=0x2ae478*=0x6133, lpOverlapped=0x0) returned 1 [0037.927] CloseHandle (hObject=0x274) returned 1 [0037.940] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.940] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.941] GetFileType (hFile=0x274) returned 0x1 [0037.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.941] GetFileType (hFile=0x274) returned 0x1 [0037.941] WriteFile (in: hFile=0x274, lpBuffer=0x1a87f40*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a87f40*, lpNumberOfBytesWritten=0x2ae46c*=0x6140, lpOverlapped=0x0) returned 1 [0037.943] CloseHandle (hObject=0x274) returned 1 [0037.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0037.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.944] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb58d0ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6140)) returned 1 [0037.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf.anonymous")) returned 1 [0037.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.944] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.945] GetFileType (hFile=0x274) returned 0x1 [0037.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.945] GetFileType (hFile=0x274) returned 0x1 [0037.945] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5aac [0037.945] ReadFile (in: hFile=0x274, lpBuffer=0x1a8e4c8, nNumberOfBytesToRead=0x5aac, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a8e4c8*, lpNumberOfBytesRead=0x2ae478*=0x5aac, lpOverlapped=0x0) returned 1 [0037.947] CloseHandle (hObject=0x274) returned 1 [0037.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0037.959] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.960] GetFileType (hFile=0x274) returned 0x1 [0037.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0037.960] GetFileType (hFile=0x274) returned 0x1 [0037.960] WriteFile (in: hFile=0x274, lpBuffer=0x1af7820*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1af7820*, lpNumberOfBytesWritten=0x2ae46c*=0x5ab0, lpOverlapped=0x0) returned 1 [0037.962] CloseHandle (hObject=0x274) returned 1 [0037.962] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0037.963] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0037.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0037.963] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb591d190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5ab0)) returned 1 [0037.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0037.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf.anonymous")) returned 1 [0037.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.963] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO", lpFilePart=0x0) returned 0x39 [0037.963] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpFilePart=0x0) returned 0x3a [0037.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0037.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.964] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0037.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0037.965] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO", lpFilePart=0x0) returned 0x39 [0037.965] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpFilePart=0x0) returned 0x3a [0037.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0037.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0037.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0037.966] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0037.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0037.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0037.966] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0037.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0037.966] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0037.966] GetFileType (hFile=0x274) returned 0x1 [0037.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0037.966] GetFileType (hFile=0x274) returned 0x1 [0037.966] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x107e2 [0037.966] ReadFile (in: hFile=0x274, lpBuffer=0x1aff108, nNumberOfBytesToRead=0x107e2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aff108*, lpNumberOfBytesRead=0x2ae478*=0x107e2, lpOverlapped=0x0) returned 1 [0037.974] CloseHandle (hObject=0x274) returned 1 [0038.013] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.013] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.014] GetFileType (hFile=0x274) returned 0x1 [0038.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.014] GetFileType (hFile=0x274) returned 0x1 [0038.014] WriteFile (in: hFile=0x274, lpBuffer=0x198e4b8*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x198e4b8*, lpNumberOfBytesWritten=0x2ae46c*=0x107f0, lpOverlapped=0x0) returned 1 [0038.016] CloseHandle (hObject=0x274) returned 1 [0038.018] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.018] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0038.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.018] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb598f5b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x107f0)) returned 1 [0038.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf.anonymous")) returned 1 [0038.018] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.018] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.019] GetFileType (hFile=0x274) returned 0x1 [0038.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.019] GetFileType (hFile=0x274) returned 0x1 [0038.019] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x102c8 [0038.019] ReadFile (in: hFile=0x274, lpBuffer=0x199f0f0, nNumberOfBytesToRead=0x102c8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x199f0f0*, lpNumberOfBytesRead=0x2ae478*=0x102c8, lpOverlapped=0x0) returned 1 [0038.041] CloseHandle (hObject=0x274) returned 1 [0038.055] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.056] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.057] GetFileType (hFile=0x274) returned 0x1 [0038.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.058] GetFileType (hFile=0x274) returned 0x1 [0038.058] WriteFile (in: hFile=0x274, lpBuffer=0x1a1c8b8*, nNumberOfBytesToWrite=0x102d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a1c8b8*, lpNumberOfBytesWritten=0x2ae46c*=0x102d0, lpOverlapped=0x0) returned 1 [0038.060] CloseHandle (hObject=0x274) returned 1 [0038.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0038.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.061] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce398e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5a019d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x102d0)) returned 1 [0038.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf.anonymous")) returned 1 [0038.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE", lpFilePart=0x0) returned 0x39 [0038.062] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpFilePart=0x0) returned 0x3a [0038.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.062] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE", lpFilePart=0x0) returned 0x39 [0038.063] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpFilePart=0x0) returned 0x3a [0038.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.063] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.064] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.064] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.064] GetFileType (hFile=0x274) returned 0x1 [0038.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.064] GetFileType (hFile=0x274) returned 0x1 [0038.064] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x12696 [0038.064] ReadFile (in: hFile=0x274, lpBuffer=0x1a2e9c0, nNumberOfBytesToRead=0x12696, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2e9c0*, lpNumberOfBytesRead=0x2ae478*=0x12696, lpOverlapped=0x0) returned 1 [0038.069] CloseHandle (hObject=0x274) returned 1 [0038.084] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.085] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.086] GetFileType (hFile=0x274) returned 0x1 [0038.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.087] GetFileType (hFile=0x274) returned 0x1 [0038.087] WriteFile (in: hFile=0x274, lpBuffer=0x1ab2ba0*, nNumberOfBytesToWrite=0x126a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ab2ba0*, lpNumberOfBytesWritten=0x2ae46c*=0x126a0, lpOverlapped=0x0) returned 1 [0038.089] CloseHandle (hObject=0x274) returned 1 [0038.090] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.090] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0038.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.090] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce85ba0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5a4dc90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x126a0)) returned 1 [0038.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf.anonymous")) returned 1 [0038.091] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.091] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.092] GetFileType (hFile=0x274) returned 0x1 [0038.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.092] GetFileType (hFile=0x274) returned 0x1 [0038.092] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x11c35 [0038.092] ReadFile (in: hFile=0x274, lpBuffer=0x1ac5688, nNumberOfBytesToRead=0x11c35, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ac5688*, lpNumberOfBytesRead=0x2ae478*=0x11c35, lpOverlapped=0x0) returned 1 [0038.102] CloseHandle (hObject=0x274) returned 1 [0038.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.118] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.120] GetFileType (hFile=0x274) returned 0x1 [0038.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.120] GetFileType (hFile=0x274) returned 0x1 [0038.120] WriteFile (in: hFile=0x274, lpBuffer=0x1952bac*, nNumberOfBytesToWrite=0x11c40, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1952bac*, lpNumberOfBytesWritten=0x2ae46c*=0x11c40, lpOverlapped=0x0) returned 1 [0038.122] CloseHandle (hObject=0x274) returned 1 [0038.124] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.124] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0038.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.124] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdce85ba0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5a99f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11c40)) returned 1 [0038.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf.anonymous")) returned 1 [0038.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.125] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR", lpFilePart=0x0) returned 0x39 [0038.125] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpFilePart=0x0) returned 0x3a [0038.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.126] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.127] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR", lpFilePart=0x0) returned 0x39 [0038.127] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpFilePart=0x0) returned 0x3a [0038.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.127] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.128] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.128] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.128] GetFileType (hFile=0x274) returned 0x1 [0038.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.128] GetFileType (hFile=0x274) returned 0x1 [0038.128] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x49db0 [0038.128] ReadFile (in: hFile=0x274, lpBuffer=0x2aa32e0, nNumberOfBytesToRead=0x49db0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2aa32e0*, lpNumberOfBytesRead=0x2ae478*=0x49db0, lpOverlapped=0x0) returned 1 [0038.170] CloseHandle (hObject=0x274) returned 1 [0038.215] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.216] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.220] GetFileType (hFile=0x274) returned 0x1 [0038.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.220] GetFileType (hFile=0x274) returned 0x1 [0038.220] WriteFile (in: hFile=0x274, lpBuffer=0x2d0f3f8*, nNumberOfBytesToWrite=0x49dc0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2d0f3f8*, lpNumberOfBytesWritten=0x2ae46c*=0x49dc0, lpOverlapped=0x0) returned 1 [0038.226] CloseHandle (hObject=0x274) returned 1 [0038.229] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.229] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0038.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.229] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1595c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5ba48f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x49dc0)) returned 1 [0038.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf.anonymous")) returned 1 [0038.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.230] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.230] GetFileType (hFile=0x274) returned 0x1 [0038.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.230] GetFileType (hFile=0x274) returned 0x1 [0038.230] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x48d8f [0038.251] ReadFile (in: hFile=0x274, lpBuffer=0x298d368, nNumberOfBytesToRead=0x48d8f, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesRead=0x2ae478*=0x48d8f, lpOverlapped=0x0) returned 1 [0038.285] CloseHandle (hObject=0x274) returned 1 [0038.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.338] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.342] GetFileType (hFile=0x274) returned 0x1 [0038.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.342] GetFileType (hFile=0x274) returned 0x1 [0038.342] WriteFile (in: hFile=0x274, lpBuffer=0x2b3ce00*, nNumberOfBytesToWrite=0x48d90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2b3ce00*, lpNumberOfBytesWritten=0x2ae46c*=0x48d90, lpOverlapped=0x0) returned 1 [0038.348] CloseHandle (hObject=0x274) returned 1 [0038.351] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.351] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0038.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.351] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd133460, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5cd53f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x48d90)) returned 1 [0038.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf.anonymous")) returned 1 [0038.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR", lpFilePart=0x0) returned 0x39 [0038.352] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpFilePart=0x0) returned 0x3a [0038.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.352] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.352] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.352] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.352] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.352] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR", lpFilePart=0x0) returned 0x39 [0038.353] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpFilePart=0x0) returned 0x3a [0038.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.353] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.353] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.353] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.353] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.353] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.354] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.354] GetFileType (hFile=0x274) returned 0x1 [0038.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.354] GetFileType (hFile=0x274) returned 0x1 [0038.354] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x197f2 [0038.354] ReadFile (in: hFile=0x274, lpBuffer=0x29d6118, nNumberOfBytesToRead=0x197f2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x29d6118*, lpNumberOfBytesRead=0x2ae478*=0x197f2, lpOverlapped=0x0) returned 1 [0038.357] CloseHandle (hObject=0x274) returned 1 [0038.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.414] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.416] GetFileType (hFile=0x274) returned 0x1 [0038.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.416] GetFileType (hFile=0x274) returned 0x1 [0038.416] WriteFile (in: hFile=0x274, lpBuffer=0x2bebbd0*, nNumberOfBytesToWrite=0x19800, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2bebbd0*, lpNumberOfBytesWritten=0x2ae46c*=0x19800, lpOverlapped=0x0) returned 1 [0038.419] CloseHandle (hObject=0x274) returned 1 [0038.421] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", lpFilePart=0x0) returned 0x45 [0038.421] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.anonymous", lpFilePart=0x0) returned 0x4f [0038.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.421] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd133460, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5d6d970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19800)) returned 1 [0038.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf.anonymous")) returned 1 [0038.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.422] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.422] GetFileType (hFile=0x274) returned 0x1 [0038.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.422] GetFileType (hFile=0x274) returned 0x1 [0038.422] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x48d20 [0038.423] ReadFile (in: hFile=0x274, lpBuffer=0x2c053f0, nNumberOfBytesToRead=0x48d20, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2c053f0*, lpNumberOfBytesRead=0x2ae478*=0x48d20, lpOverlapped=0x0) returned 1 [0038.462] CloseHandle (hObject=0x274) returned 1 [0038.490] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.490] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.494] GetFileType (hFile=0x274) returned 0x1 [0038.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.494] GetFileType (hFile=0x274) returned 0x1 [0038.494] WriteFile (in: hFile=0x274, lpBuffer=0x298d368*, nNumberOfBytesToWrite=0x48d30, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesWritten=0x2ae46c*=0x48d30, lpOverlapped=0x0) returned 1 [0038.500] CloseHandle (hObject=0x274) returned 1 [0038.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", lpFilePart=0x0) returned 0x47 [0038.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.anonymous", lpFilePart=0x0) returned 0x51 [0038.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd133460, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5e2c050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x48d30)) returned 1 [0038.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf.anonymous")) returned 1 [0038.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0038.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts", lpFilePart=0x0) returned 0x35 [0038.504] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", lpFilePart=0x0) returned 0x36 [0038.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0038.504] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.505] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.505] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0038.505] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0038.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0038.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0038.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0038.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts", lpFilePart=0x0) returned 0x35 [0038.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", lpFilePart=0x0) returned 0x36 [0038.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0038.505] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.505] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.506] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0038.506] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0038.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0038.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0038.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0038.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal", lpFilePart=0x0) returned 0x2f [0038.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpFilePart=0x0) returned 0x30 [0038.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0038.517] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.518] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.519] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.520] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.521] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.521] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.521] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0038.521] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0038.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0038.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0038.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0038.522] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal", lpFilePart=0x0) returned 0x2f [0038.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpFilePart=0x0) returned 0x30 [0038.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0038.523] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.523] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.523] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.524] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.525] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.526] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.526] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.526] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.526] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.526] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0038.526] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0038.526] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0038.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0038.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0038.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.527] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT", lpFilePart=0x0) returned 0x33 [0038.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpFilePart=0x0) returned 0x34 [0038.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0038.529] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.529] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.529] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.529] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.529] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0038.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT", lpFilePart=0x0) returned 0x33 [0038.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpFilePart=0x0) returned 0x34 [0038.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0038.530] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.530] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.530] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.531] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.531] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0038.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.531] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", lpFilePart=0x0) returned 0x40 [0038.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.531] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.532] GetFileType (hFile=0x274) returned 0x1 [0038.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.532] GetFileType (hFile=0x274) returned 0x1 [0038.532] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xd11a [0038.532] ReadFile (in: hFile=0x274, lpBuffer=0x1937c54, nNumberOfBytesToRead=0xd11a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1937c54*, lpNumberOfBytesRead=0x2ae478*=0xd11a, lpOverlapped=0x0) returned 1 [0038.533] CloseHandle (hObject=0x274) returned 1 [0038.570] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", lpFilePart=0x0) returned 0x40 [0038.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.570] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.572] GetFileType (hFile=0x274) returned 0x1 [0038.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.572] GetFileType (hFile=0x274) returned 0x1 [0038.572] WriteFile (in: hFile=0x274, lpBuffer=0x19abf10*, nNumberOfBytesToWrite=0xd120, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19abf10*, lpNumberOfBytesWritten=0x2ae46c*=0xd120, lpOverlapped=0x0) returned 1 [0038.574] CloseHandle (hObject=0x274) returned 1 [0038.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", lpFilePart=0x0) returned 0x40 [0038.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0038.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.576] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd6b4740, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5eea730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd120)) returned 1 [0038.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html.anonymous")) returned 1 [0038.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS", lpFilePart=0x0) returned 0x33 [0038.576] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpFilePart=0x0) returned 0x34 [0038.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.577] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.577] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.577] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.577] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.578] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS", lpFilePart=0x0) returned 0x33 [0038.578] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpFilePart=0x0) returned 0x34 [0038.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0038.578] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.578] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.578] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.578] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.579] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0038.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", lpFilePart=0x0) returned 0x40 [0038.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.579] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.580] GetFileType (hFile=0x274) returned 0x1 [0038.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.580] GetFileType (hFile=0x274) returned 0x1 [0038.580] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x12dac [0038.580] ReadFile (in: hFile=0x274, lpBuffer=0x19bac9c, nNumberOfBytesToRead=0x12dac, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19bac9c*, lpNumberOfBytesRead=0x2ae478*=0x12dac, lpOverlapped=0x0) returned 1 [0038.602] CloseHandle (hObject=0x274) returned 1 [0038.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", lpFilePart=0x0) returned 0x40 [0038.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.624] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.626] GetFileType (hFile=0x274) returned 0x1 [0038.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.626] GetFileType (hFile=0x274) returned 0x1 [0038.626] WriteFile (in: hFile=0x274, lpBuffer=0x1a403a8*, nNumberOfBytesToWrite=0x12db0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a403a8*, lpNumberOfBytesWritten=0x2ae46c*=0x12db0, lpOverlapped=0x0) returned 1 [0038.629] CloseHandle (hObject=0x274) returned 1 [0038.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", lpFilePart=0x0) returned 0x40 [0038.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0038.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.631] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd3487a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5f5cb50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12db0)) returned 1 [0038.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html.anonymous")) returned 1 [0038.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT", lpFilePart=0x0) returned 0x33 [0038.632] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpFilePart=0x0) returned 0x34 [0038.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea58 [0038.633] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.634] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.634] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.634] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.634] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0038.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.634] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT", lpFilePart=0x0) returned 0x33 [0038.634] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpFilePart=0x0) returned 0x34 [0038.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea58 [0038.635] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.635] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.635] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.635] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.635] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0038.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.636] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", lpFilePart=0x0) returned 0x40 [0038.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.636] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.636] GetFileType (hFile=0x274) returned 0x1 [0038.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.636] GetFileType (hFile=0x274) returned 0x1 [0038.636] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x13a5b [0038.636] ReadFile (in: hFile=0x274, lpBuffer=0x1a54dc4, nNumberOfBytesToRead=0x13a5b, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a54dc4*, lpNumberOfBytesRead=0x2ae478*=0x13a5b, lpOverlapped=0x0) returned 1 [0038.665] CloseHandle (hObject=0x274) returned 1 [0038.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", lpFilePart=0x0) returned 0x40 [0038.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.686] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.690] GetFileType (hFile=0x274) returned 0x1 [0038.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.690] GetFileType (hFile=0x274) returned 0x1 [0038.690] WriteFile (in: hFile=0x274, lpBuffer=0x1adcae4*, nNumberOfBytesToWrite=0x13a60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1adcae4*, lpNumberOfBytesWritten=0x2ae46c*=0x13a60, lpOverlapped=0x0) returned 1 [0038.692] CloseHandle (hObject=0x274) returned 1 [0038.693] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", lpFilePart=0x0) returned 0x40 [0038.693] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0038.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd3487a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb5ff50d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13a60)) returned 1 [0038.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html.anonymous")) returned 1 [0038.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.694] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE", lpFilePart=0x0) returned 0x33 [0038.694] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpFilePart=0x0) returned 0x34 [0038.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0038.695] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.696] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.696] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.696] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.696] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0038.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.696] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE", lpFilePart=0x0) returned 0x33 [0038.696] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpFilePart=0x0) returned 0x34 [0038.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0038.697] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.697] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.697] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.697] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.697] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0038.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.697] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", lpFilePart=0x0) returned 0x40 [0038.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.698] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.698] GetFileType (hFile=0x274) returned 0x1 [0038.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.699] GetFileType (hFile=0x274) returned 0x1 [0038.699] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x112b7 [0038.699] ReadFile (in: hFile=0x274, lpBuffer=0x1af21b0, nNumberOfBytesToRead=0x112b7, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1af21b0*, lpNumberOfBytesRead=0x2ae478*=0x112b7, lpOverlapped=0x0) returned 1 [0038.725] CloseHandle (hObject=0x274) returned 1 [0038.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", lpFilePart=0x0) returned 0x40 [0038.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.778] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.780] GetFileType (hFile=0x274) returned 0x1 [0038.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.780] GetFileType (hFile=0x274) returned 0x1 [0038.780] WriteFile (in: hFile=0x274, lpBuffer=0x1984d90*, nNumberOfBytesToWrite=0x112c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1984d90*, lpNumberOfBytesWritten=0x2ae46c*=0x112c0, lpOverlapped=0x0) returned 1 [0038.783] CloseHandle (hObject=0x274) returned 1 [0038.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", lpFilePart=0x0) returned 0x40 [0038.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0038.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.785] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1f1b40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb60d9910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x112c0)) returned 1 [0038.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html.anonymous")) returned 1 [0038.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN", lpFilePart=0x0) returned 0x33 [0038.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpFilePart=0x0) returned 0x34 [0038.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0038.787] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.788] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.788] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.788] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.788] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0038.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN", lpFilePart=0x0) returned 0x33 [0038.788] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpFilePart=0x0) returned 0x34 [0038.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0038.789] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.789] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.789] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.789] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.789] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0038.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", lpFilePart=0x0) returned 0x40 [0038.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.789] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.790] GetFileType (hFile=0x274) returned 0x1 [0038.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.790] GetFileType (hFile=0x274) returned 0x1 [0038.790] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbd79 [0038.790] ReadFile (in: hFile=0x274, lpBuffer=0x1997cbc, nNumberOfBytesToRead=0xbd79, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1997cbc*, lpNumberOfBytesRead=0x2ae478*=0xbd79, lpOverlapped=0x0) returned 1 [0038.808] CloseHandle (hObject=0x274) returned 1 [0038.822] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", lpFilePart=0x0) returned 0x40 [0038.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.822] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.823] GetFileType (hFile=0x274) returned 0x1 [0038.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.823] GetFileType (hFile=0x274) returned 0x1 [0038.823] WriteFile (in: hFile=0x274, lpBuffer=0x1a08498*, nNumberOfBytesToWrite=0xbd80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a08498*, lpNumberOfBytesWritten=0x2ae46c*=0xbd80, lpOverlapped=0x0) returned 1 [0038.825] CloseHandle (hObject=0x274) returned 1 [0038.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", lpFilePart=0x0) returned 0x40 [0038.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0038.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.826] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd322640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb614bd30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbd80)) returned 1 [0038.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html.anonymous")) returned 1 [0038.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU", lpFilePart=0x0) returned 0x33 [0038.827] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpFilePart=0x0) returned 0x34 [0038.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0038.827] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.827] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.828] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.828] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.828] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0038.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU", lpFilePart=0x0) returned 0x33 [0038.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpFilePart=0x0) returned 0x34 [0038.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0038.828] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.828] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.828] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.829] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.829] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0038.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", lpFilePart=0x0) returned 0x40 [0038.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.829] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.829] GetFileType (hFile=0x274) returned 0x1 [0038.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.829] GetFileType (hFile=0x274) returned 0x1 [0038.829] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc750 [0038.829] ReadFile (in: hFile=0x274, lpBuffer=0x1a15e84, nNumberOfBytesToRead=0xc750, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a15e84*, lpNumberOfBytesRead=0x2ae478*=0xc750, lpOverlapped=0x0) returned 1 [0038.848] CloseHandle (hObject=0x274) returned 1 [0038.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", lpFilePart=0x0) returned 0x40 [0038.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0038.864] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.866] GetFileType (hFile=0x274) returned 0x1 [0038.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0038.866] GetFileType (hFile=0x274) returned 0x1 [0038.866] WriteFile (in: hFile=0x274, lpBuffer=0x1a882a0*, nNumberOfBytesToWrite=0xc760, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a882a0*, lpNumberOfBytesWritten=0x2ae46c*=0xc760, lpOverlapped=0x0) returned 1 [0038.868] CloseHandle (hObject=0x274) returned 1 [0038.869] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", lpFilePart=0x0) returned 0x40 [0038.869] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0038.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0038.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd322640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb61be150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc760)) returned 1 [0038.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0038.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html.anonymous")) returned 1 [0038.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.870] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU", lpFilePart=0x0) returned 0x33 [0038.870] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpFilePart=0x0) returned 0x34 [0038.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0038.871] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.871] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.872] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.872] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.872] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0038.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0038.872] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU", lpFilePart=0x0) returned 0x33 [0038.872] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpFilePart=0x0) returned 0x34 [0038.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0038.872] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0038.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0038.873] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0038.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0038.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0038.873] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", lpFilePart=0x0) returned 0x40 [0038.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0038.873] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0038.873] GetFileType (hFile=0x274) returned 0x1 [0038.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0038.874] GetFileType (hFile=0x274) returned 0x1 [0038.874] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa835 [0038.874] ReadFile (in: hFile=0x274, lpBuffer=0x1a9666c, nNumberOfBytesToRead=0xa835, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a9666c*, lpNumberOfBytesRead=0x2ae478*=0xa835, lpOverlapped=0x0) returned 1 [0038.907] CloseHandle (hObject=0x274) returned 1 [0039.043] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", lpFilePart=0x0) returned 0x40 [0039.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.044] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.045] GetFileType (hFile=0x274) returned 0x1 [0039.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.045] GetFileType (hFile=0x274) returned 0x1 [0039.045] WriteFile (in: hFile=0x274, lpBuffer=0x1b02d2c*, nNumberOfBytesToWrite=0xa840, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b02d2c*, lpNumberOfBytesWritten=0x2ae46c*=0xa840, lpOverlapped=0x0) returned 1 [0039.047] CloseHandle (hObject=0x274) returned 1 [0039.048] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", lpFilePart=0x0) returned 0x40 [0039.048] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.048] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2fc4e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6361070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa840)) returned 1 [0039.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html.anonymous")) returned 1 [0039.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.049] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP", lpFilePart=0x0) returned 0x33 [0039.049] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpFilePart=0x0) returned 0x34 [0039.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0039.050] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.050] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.050] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.050] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.050] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0039.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.050] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP", lpFilePart=0x0) returned 0x33 [0039.050] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpFilePart=0x0) returned 0x34 [0039.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0039.051] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.051] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.051] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.051] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.051] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0039.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.051] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", lpFilePart=0x0) returned 0x40 [0039.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.051] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.052] GetFileType (hFile=0x274) returned 0x1 [0039.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.052] GetFileType (hFile=0x274) returned 0x1 [0039.052] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xcd60 [0039.052] ReadFile (in: hFile=0x274, lpBuffer=0x1b0f1d8, nNumberOfBytesToRead=0xcd60, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b0f1d8*, lpNumberOfBytesRead=0x2ae478*=0xcd60, lpOverlapped=0x0) returned 1 [0039.063] CloseHandle (hObject=0x274) returned 1 [0039.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", lpFilePart=0x0) returned 0x40 [0039.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.101] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.102] GetFileType (hFile=0x274) returned 0x1 [0039.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.102] GetFileType (hFile=0x274) returned 0x1 [0039.102] WriteFile (in: hFile=0x274, lpBuffer=0x198fbb8*, nNumberOfBytesToWrite=0xcd70, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x198fbb8*, lpNumberOfBytesWritten=0x2ae46c*=0xcd70, lpOverlapped=0x0) returned 1 [0039.104] CloseHandle (hObject=0x274) returned 1 [0039.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", lpFilePart=0x0) returned 0x40 [0039.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.105] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2d6380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb63f95f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcd70)) returned 1 [0039.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html.anonymous")) returned 1 [0039.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ", lpFilePart=0x0) returned 0x33 [0039.106] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpFilePart=0x0) returned 0x34 [0039.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0039.106] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.106] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.106] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.106] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.106] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0039.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.107] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ", lpFilePart=0x0) returned 0x33 [0039.107] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpFilePart=0x0) returned 0x34 [0039.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0039.107] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.107] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.107] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.107] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.107] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0039.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", lpFilePart=0x0) returned 0x40 [0039.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.108] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.108] GetFileType (hFile=0x274) returned 0x1 [0039.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.108] GetFileType (hFile=0x274) returned 0x1 [0039.108] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xaedb [0039.108] ReadFile (in: hFile=0x274, lpBuffer=0x199e594, nNumberOfBytesToRead=0xaedb, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x199e594*, lpNumberOfBytesRead=0x2ae478*=0xaedb, lpOverlapped=0x0) returned 1 [0039.110] CloseHandle (hObject=0x274) returned 1 [0039.124] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", lpFilePart=0x0) returned 0x40 [0039.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.124] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.126] GetFileType (hFile=0x274) returned 0x1 [0039.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.126] GetFileType (hFile=0x274) returned 0x1 [0039.126] WriteFile (in: hFile=0x274, lpBuffer=0x1a0c190*, nNumberOfBytesToWrite=0xaee0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a0c190*, lpNumberOfBytesWritten=0x2ae46c*=0xaee0, lpOverlapped=0x0) returned 1 [0039.128] CloseHandle (hObject=0x274) returned 1 [0039.129] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", lpFilePart=0x0) returned 0x40 [0039.129] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.129] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd6b4740, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb641f750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaee0)) returned 1 [0039.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html.anonymous")) returned 1 [0039.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA", lpFilePart=0x0) returned 0x33 [0039.130] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpFilePart=0x0) returned 0x34 [0039.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0039.131] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.131] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.131] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.131] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.132] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0039.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA", lpFilePart=0x0) returned 0x33 [0039.132] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpFilePart=0x0) returned 0x34 [0039.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0039.132] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.132] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.132] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.132] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.133] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0039.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", lpFilePart=0x0) returned 0x40 [0039.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.133] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.133] GetFileType (hFile=0x274) returned 0x1 [0039.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.133] GetFileType (hFile=0x274) returned 0x1 [0039.133] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xe94c [0039.133] ReadFile (in: hFile=0x274, lpBuffer=0x1a18cdc, nNumberOfBytesToRead=0xe94c, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a18cdc*, lpNumberOfBytesRead=0x2ae478*=0xe94c, lpOverlapped=0x0) returned 1 [0039.135] CloseHandle (hObject=0x274) returned 1 [0039.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", lpFilePart=0x0) returned 0x40 [0039.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.148] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.150] GetFileType (hFile=0x274) returned 0x1 [0039.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.150] GetFileType (hFile=0x274) returned 0x1 [0039.150] WriteFile (in: hFile=0x274, lpBuffer=0x1a916c8*, nNumberOfBytesToWrite=0xe950, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a916c8*, lpNumberOfBytesWritten=0x2ae46c*=0xe950, lpOverlapped=0x0) returned 1 [0039.152] CloseHandle (hObject=0x274) returned 1 [0039.153] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", lpFilePart=0x0) returned 0x40 [0039.153] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.153] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2fc4e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb646ba10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe950)) returned 1 [0039.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html.anonymous")) returned 1 [0039.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.153] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV", lpFilePart=0x0) returned 0x33 [0039.154] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpFilePart=0x0) returned 0x34 [0039.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0039.154] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.154] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.154] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.154] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.154] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0039.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV", lpFilePart=0x0) returned 0x33 [0039.154] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpFilePart=0x0) returned 0x34 [0039.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0039.155] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.155] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.155] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.155] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.155] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0039.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", lpFilePart=0x0) returned 0x40 [0039.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.155] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.156] GetFileType (hFile=0x274) returned 0x1 [0039.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.156] GetFileType (hFile=0x274) returned 0x1 [0039.156] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc490 [0039.156] ReadFile (in: hFile=0x274, lpBuffer=0x1aa1c84, nNumberOfBytesToRead=0xc490, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aa1c84*, lpNumberOfBytesRead=0x2ae478*=0xc490, lpOverlapped=0x0) returned 1 [0039.164] CloseHandle (hObject=0x274) returned 1 [0039.176] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", lpFilePart=0x0) returned 0x40 [0039.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.176] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.178] GetFileType (hFile=0x274) returned 0x1 [0039.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.178] GetFileType (hFile=0x274) returned 0x1 [0039.178] WriteFile (in: hFile=0x274, lpBuffer=0x1b13860*, nNumberOfBytesToWrite=0xc4a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b13860*, lpNumberOfBytesWritten=0x2ae46c*=0xc4a0, lpOverlapped=0x0) returned 1 [0039.180] CloseHandle (hObject=0x274) returned 1 [0039.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", lpFilePart=0x0) returned 0x40 [0039.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.181] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1f1b40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb64b7cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc4a0)) returned 1 [0039.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html.anonymous")) returned 1 [0039.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN", lpFilePart=0x0) returned 0x33 [0039.182] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpFilePart=0x0) returned 0x34 [0039.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0039.182] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.182] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.182] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.182] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.183] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0039.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN", lpFilePart=0x0) returned 0x33 [0039.183] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpFilePart=0x0) returned 0x34 [0039.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0039.183] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.183] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.183] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.183] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.183] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0039.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.184] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", lpFilePart=0x0) returned 0x40 [0039.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.184] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.184] GetFileType (hFile=0x274) returned 0x1 [0039.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.184] GetFileType (hFile=0x274) returned 0x1 [0039.184] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x11ef3 [0039.184] ReadFile (in: hFile=0x274, lpBuffer=0x1b2196c, nNumberOfBytesToRead=0x11ef3, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2196c*, lpNumberOfBytesRead=0x2ae478*=0x11ef3, lpOverlapped=0x0) returned 1 [0039.194] CloseHandle (hObject=0x274) returned 1 [0039.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", lpFilePart=0x0) returned 0x40 [0039.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.232] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.233] GetFileType (hFile=0x274) returned 0x1 [0039.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.233] GetFileType (hFile=0x274) returned 0x1 [0039.233] WriteFile (in: hFile=0x274, lpBuffer=0x19b6988*, nNumberOfBytesToWrite=0x11f00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19b6988*, lpNumberOfBytesWritten=0x2ae46c*=0x11f00, lpOverlapped=0x0) returned 1 [0039.235] CloseHandle (hObject=0x274) returned 1 [0039.237] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", lpFilePart=0x0) returned 0x40 [0039.237] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.237] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1f1b40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb652a0f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11f00)) returned 1 [0039.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html.anonymous")) returned 1 [0039.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.237] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA", lpFilePart=0x0) returned 0x33 [0039.237] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpFilePart=0x0) returned 0x34 [0039.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0039.239] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.239] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.239] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.239] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.239] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0039.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.239] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA", lpFilePart=0x0) returned 0x33 [0039.239] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpFilePart=0x0) returned 0x34 [0039.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0039.240] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.240] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.240] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.240] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.240] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0039.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", lpFilePart=0x0) returned 0x40 [0039.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.240] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.241] GetFileType (hFile=0x274) returned 0x1 [0039.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.241] GetFileType (hFile=0x274) returned 0x1 [0039.241] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc60d [0039.241] ReadFile (in: hFile=0x274, lpBuffer=0x19ca4f4, nNumberOfBytesToRead=0xc60d, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19ca4f4*, lpNumberOfBytesRead=0x2ae478*=0xc60d, lpOverlapped=0x0) returned 1 [0039.254] CloseHandle (hObject=0x274) returned 1 [0039.268] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", lpFilePart=0x0) returned 0x40 [0039.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.269] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.270] GetFileType (hFile=0x274) returned 0x1 [0039.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.270] GetFileType (hFile=0x274) returned 0x1 [0039.270] WriteFile (in: hFile=0x274, lpBuffer=0x1a3c680*, nNumberOfBytesToWrite=0xc610, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3c680*, lpNumberOfBytesWritten=0x2ae46c*=0xc610, lpOverlapped=0x0) returned 1 [0039.272] CloseHandle (hObject=0x274) returned 1 [0039.273] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", lpFilePart=0x0) returned 0x40 [0039.273] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.274] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2d6380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb659c510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc610)) returned 1 [0039.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html.anonymous")) returned 1 [0039.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN", lpFilePart=0x0) returned 0x33 [0039.277] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpFilePart=0x0) returned 0x34 [0039.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0039.278] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.278] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.278] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.278] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.278] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0039.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN", lpFilePart=0x0) returned 0x33 [0039.278] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpFilePart=0x0) returned 0x34 [0039.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb58 [0039.279] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.279] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.279] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.279] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.279] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0039.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.279] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", lpFilePart=0x0) returned 0x40 [0039.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.279] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.280] GetFileType (hFile=0x274) returned 0x1 [0039.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.280] GetFileType (hFile=0x274) returned 0x1 [0039.280] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1dc34 [0039.280] ReadFile (in: hFile=0x274, lpBuffer=0x2bb9fa0, nNumberOfBytesToRead=0x1dc34, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2bb9fa0*, lpNumberOfBytesRead=0x2ae478*=0x1dc34, lpOverlapped=0x0) returned 1 [0039.290] CloseHandle (hObject=0x274) returned 1 [0039.311] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", lpFilePart=0x0) returned 0x40 [0039.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.311] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.313] GetFileType (hFile=0x274) returned 0x1 [0039.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.313] GetFileType (hFile=0x274) returned 0x1 [0039.313] WriteFile (in: hFile=0x274, lpBuffer=0x2d39080*, nNumberOfBytesToWrite=0x1dc40, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2d39080*, lpNumberOfBytesWritten=0x2ae46c*=0x1dc40, lpOverlapped=0x0) returned 1 [0039.316] CloseHandle (hObject=0x274) returned 1 [0039.318] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", lpFilePart=0x0) returned 0x40 [0039.318] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.318] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2fc4e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb660e930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1dc40)) returned 1 [0039.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html.anonymous")) returned 1 [0039.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.319] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR", lpFilePart=0x0) returned 0x33 [0039.319] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpFilePart=0x0) returned 0x34 [0039.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0039.320] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.320] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.320] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.320] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.320] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0039.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.321] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR", lpFilePart=0x0) returned 0x33 [0039.321] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpFilePart=0x0) returned 0x34 [0039.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0039.321] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.321] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.321] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.321] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.321] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0039.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", lpFilePart=0x0) returned 0x40 [0039.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.322] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.322] GetFileType (hFile=0x274) returned 0x1 [0039.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.322] GetFileType (hFile=0x274) returned 0x1 [0039.322] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x18e95 [0039.323] ReadFile (in: hFile=0x274, lpBuffer=0x2d56ce0, nNumberOfBytesToRead=0x18e95, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2d56ce0*, lpNumberOfBytesRead=0x2ae478*=0x18e95, lpOverlapped=0x0) returned 1 [0039.331] CloseHandle (hObject=0x274) returned 1 [0039.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", lpFilePart=0x0) returned 0x40 [0039.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.383] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.386] GetFileType (hFile=0x274) returned 0x1 [0039.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.386] GetFileType (hFile=0x274) returned 0x1 [0039.386] WriteFile (in: hFile=0x274, lpBuffer=0x2a197a0*, nNumberOfBytesToWrite=0x18ea0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesWritten=0x2ae46c*=0x18ea0, lpOverlapped=0x0) returned 1 [0039.389] CloseHandle (hObject=0x274) returned 1 [0039.391] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", lpFilePart=0x0) returned 0x40 [0039.391] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.391] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2d6380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb66a6eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18ea0)) returned 1 [0039.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html.anonymous")) returned 1 [0039.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.392] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD", lpFilePart=0x0) returned 0x33 [0039.392] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpFilePart=0x0) returned 0x34 [0039.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb18 [0039.393] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.393] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.393] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.393] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.393] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0039.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.393] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD", lpFilePart=0x0) returned 0x33 [0039.394] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpFilePart=0x0) returned 0x34 [0039.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb18 [0039.394] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.394] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.394] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.394] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.394] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0039.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", lpFilePart=0x0) returned 0x40 [0039.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.395] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.395] GetFileType (hFile=0x274) returned 0x1 [0039.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.395] GetFileType (hFile=0x274) returned 0x1 [0039.395] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc288 [0039.396] ReadFile (in: hFile=0x274, lpBuffer=0x1950e2c, nNumberOfBytesToRead=0xc288, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1950e2c*, lpNumberOfBytesRead=0x2ae478*=0xc288, lpOverlapped=0x0) returned 1 [0039.406] CloseHandle (hObject=0x274) returned 1 [0039.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", lpFilePart=0x0) returned 0x40 [0039.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.451] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.452] GetFileType (hFile=0x274) returned 0x1 [0039.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.452] GetFileType (hFile=0x274) returned 0x1 [0039.452] WriteFile (in: hFile=0x274, lpBuffer=0x19c2570*, nNumberOfBytesToWrite=0xc290, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19c2570*, lpNumberOfBytesWritten=0x2ae46c*=0xc290, lpOverlapped=0x0) returned 1 [0039.454] CloseHandle (hObject=0x274) returned 1 [0039.455] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", lpFilePart=0x0) returned 0x40 [0039.455] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd322640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb673f430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc290)) returned 1 [0039.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html.anonymous")) returned 1 [0039.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR", lpFilePart=0x0) returned 0x33 [0039.457] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpFilePart=0x0) returned 0x34 [0039.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0039.459] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.459] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.459] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.459] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.459] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0039.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.459] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR", lpFilePart=0x0) returned 0x33 [0039.459] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpFilePart=0x0) returned 0x34 [0039.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0039.460] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.460] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.460] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.460] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.460] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0039.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.460] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", lpFilePart=0x0) returned 0x40 [0039.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.460] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.461] GetFileType (hFile=0x274) returned 0x1 [0039.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.461] GetFileType (hFile=0x274) returned 0x1 [0039.461] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xba2a [0039.461] ReadFile (in: hFile=0x274, lpBuffer=0x19306f8, nNumberOfBytesToRead=0xba2a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19306f8*, lpNumberOfBytesRead=0x2ae478*=0xba2a, lpOverlapped=0x0) returned 1 [0039.463] CloseHandle (hObject=0x274) returned 1 [0039.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", lpFilePart=0x0) returned 0x40 [0039.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.500] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.501] GetFileType (hFile=0x274) returned 0x1 [0039.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.501] GetFileType (hFile=0x274) returned 0x1 [0039.501] WriteFile (in: hFile=0x274, lpBuffer=0x19a04e4*, nNumberOfBytesToWrite=0xba30, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19a04e4*, lpNumberOfBytesWritten=0x2ae46c*=0xba30, lpOverlapped=0x0) returned 1 [0039.503] CloseHandle (hObject=0x274) returned 1 [0039.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", lpFilePart=0x0) returned 0x40 [0039.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2fc4e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb67b1850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xba30)) returned 1 [0039.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html.anonymous")) returned 1 [0039.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL", lpFilePart=0x0) returned 0x33 [0039.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpFilePart=0x0) returned 0x34 [0039.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb18 [0039.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.507] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0039.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.507] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL", lpFilePart=0x0) returned 0x33 [0039.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpFilePart=0x0) returned 0x34 [0039.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb18 [0039.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.508] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0039.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", lpFilePart=0x0) returned 0x40 [0039.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.508] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.508] GetFileType (hFile=0x274) returned 0x1 [0039.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.508] GetFileType (hFile=0x274) returned 0x1 [0039.508] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xf0a0 [0039.508] ReadFile (in: hFile=0x274, lpBuffer=0x19adb80, nNumberOfBytesToRead=0xf0a0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19adb80*, lpNumberOfBytesRead=0x2ae478*=0xf0a0, lpOverlapped=0x0) returned 1 [0039.521] CloseHandle (hObject=0x274) returned 1 [0039.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", lpFilePart=0x0) returned 0x40 [0039.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.536] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.537] GetFileType (hFile=0x274) returned 0x1 [0039.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.537] GetFileType (hFile=0x274) returned 0x1 [0039.537] WriteFile (in: hFile=0x274, lpBuffer=0x1a27b8c*, nNumberOfBytesToWrite=0xf0b0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a27b8c*, lpNumberOfBytesWritten=0x2ae46c*=0xf0b0, lpOverlapped=0x0) returned 1 [0039.539] CloseHandle (hObject=0x274) returned 1 [0039.540] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", lpFilePart=0x0) returned 0x40 [0039.540] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.540] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1cb9e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6823c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0b0)) returned 1 [0039.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html.anonymous")) returned 1 [0039.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.541] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB", lpFilePart=0x0) returned 0x33 [0039.541] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpFilePart=0x0) returned 0x34 [0039.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea58 [0039.542] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.542] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.542] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.542] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.542] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0039.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB", lpFilePart=0x0) returned 0x33 [0039.543] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpFilePart=0x0) returned 0x34 [0039.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea58 [0039.543] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.543] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.543] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.543] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.543] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0039.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", lpFilePart=0x0) returned 0x40 [0039.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.543] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.544] GetFileType (hFile=0x274) returned 0x1 [0039.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.544] GetFileType (hFile=0x274) returned 0x1 [0039.544] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xd746 [0039.544] ReadFile (in: hFile=0x274, lpBuffer=0x1a388a8, nNumberOfBytesToRead=0xd746, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a388a8*, lpNumberOfBytesRead=0x2ae478*=0xd746, lpOverlapped=0x0) returned 1 [0039.556] CloseHandle (hObject=0x274) returned 1 [0039.570] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", lpFilePart=0x0) returned 0x40 [0039.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.570] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.572] GetFileType (hFile=0x274) returned 0x1 [0039.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.572] GetFileType (hFile=0x274) returned 0x1 [0039.572] WriteFile (in: hFile=0x274, lpBuffer=0x1aadc98*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1aadc98*, lpNumberOfBytesWritten=0x2ae46c*=0xd750, lpOverlapped=0x0) returned 1 [0039.574] CloseHandle (hObject=0x274) returned 1 [0039.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", lpFilePart=0x0) returned 0x40 [0039.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.575] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2d6380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb686ff30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd750)) returned 1 [0039.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html.anonymous")) returned 1 [0039.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM", lpFilePart=0x0) returned 0x33 [0039.575] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpFilePart=0x0) returned 0x34 [0039.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0039.576] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.577] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.577] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.577] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.577] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0039.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM", lpFilePart=0x0) returned 0x33 [0039.577] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpFilePart=0x0) returned 0x34 [0039.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbecd8 [0039.577] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.577] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.577] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.578] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.578] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0039.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", lpFilePart=0x0) returned 0x40 [0039.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.578] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.578] GetFileType (hFile=0x274) returned 0x1 [0039.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.578] GetFileType (hFile=0x274) returned 0x1 [0039.578] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xe796 [0039.578] ReadFile (in: hFile=0x274, lpBuffer=0x1abd054, nNumberOfBytesToRead=0xe796, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1abd054*, lpNumberOfBytesRead=0x2ae478*=0xe796, lpOverlapped=0x0) returned 1 [0039.588] CloseHandle (hObject=0x274) returned 1 [0039.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", lpFilePart=0x0) returned 0x40 [0039.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.609] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.610] GetFileType (hFile=0x274) returned 0x1 [0039.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.610] GetFileType (hFile=0x274) returned 0x1 [0039.610] WriteFile (in: hFile=0x274, lpBuffer=0x193e26c*, nNumberOfBytesToWrite=0xe7a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x193e26c*, lpNumberOfBytesWritten=0x2ae46c*=0xe7a0, lpOverlapped=0x0) returned 1 [0039.612] CloseHandle (hObject=0x274) returned 1 [0039.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", lpFilePart=0x0) returned 0x40 [0039.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.614] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1cb9e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb68bc1f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe7a0)) returned 1 [0039.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html.anonymous")) returned 1 [0039.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.615] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS", lpFilePart=0x0) returned 0x33 [0039.615] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpFilePart=0x0) returned 0x34 [0039.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0039.615] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.616] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.616] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.616] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.616] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0039.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS", lpFilePart=0x0) returned 0x33 [0039.616] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpFilePart=0x0) returned 0x34 [0039.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0039.616] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.617] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.617] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.617] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.617] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0039.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.617] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", lpFilePart=0x0) returned 0x40 [0039.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.617] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.617] GetFileType (hFile=0x274) returned 0x1 [0039.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.617] GetFileType (hFile=0x274) returned 0x1 [0039.617] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3ece3 [0039.619] ReadFile (in: hFile=0x274, lpBuffer=0x2ab7f20, nNumberOfBytesToRead=0x3ece3, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2ab7f20*, lpNumberOfBytesRead=0x2ae478*=0x3ece3, lpOverlapped=0x0) returned 1 [0039.644] CloseHandle (hObject=0x274) returned 1 [0039.691] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", lpFilePart=0x0) returned 0x40 [0039.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.691] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.694] GetFileType (hFile=0x274) returned 0x1 [0039.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.694] GetFileType (hFile=0x274) returned 0x1 [0039.694] WriteFile (in: hFile=0x274, lpBuffer=0x2bf2000*, nNumberOfBytesToWrite=0x3ecf0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2bf2000*, lpNumberOfBytesWritten=0x2ae46c*=0x3ecf0, lpOverlapped=0x0) returned 1 [0039.699] CloseHandle (hObject=0x274) returned 1 [0039.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", lpFilePart=0x0) returned 0x40 [0039.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1cb9e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb69a0a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ecf0)) returned 1 [0039.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html.anonymous")) returned 1 [0039.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY", lpFilePart=0x0) returned 0x33 [0039.702] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpFilePart=0x0) returned 0x34 [0039.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0039.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.703] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0039.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY", lpFilePart=0x0) returned 0x33 [0039.703] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpFilePart=0x0) returned 0x34 [0039.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0039.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.704] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0039.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", lpFilePart=0x0) returned 0x40 [0039.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.704] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.704] GetFileType (hFile=0x274) returned 0x1 [0039.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.704] GetFileType (hFile=0x274) returned 0x1 [0039.704] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10d39 [0039.705] ReadFile (in: hFile=0x274, lpBuffer=0x199d23c, nNumberOfBytesToRead=0x10d39, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x199d23c*, lpNumberOfBytesRead=0x2ae478*=0x10d39, lpOverlapped=0x0) returned 1 [0039.723] CloseHandle (hObject=0x274) returned 1 [0039.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", lpFilePart=0x0) returned 0x40 [0039.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.736] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.738] GetFileType (hFile=0x274) returned 0x1 [0039.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.738] GetFileType (hFile=0x274) returned 0x1 [0039.738] WriteFile (in: hFile=0x274, lpBuffer=0x1a1c7fc*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a1c7fc*, lpNumberOfBytesWritten=0x2ae46c*=0x10d40, lpOverlapped=0x0) returned 1 [0039.740] CloseHandle (hObject=0x274) returned 1 [0039.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", lpFilePart=0x0) returned 0x40 [0039.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.742] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1cb9e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6a12e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10d40)) returned 1 [0039.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html.anonymous")) returned 1 [0039.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV", lpFilePart=0x0) returned 0x33 [0039.742] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpFilePart=0x0) returned 0x34 [0039.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0039.743] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.743] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.743] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.743] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.743] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0039.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV", lpFilePart=0x0) returned 0x33 [0039.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpFilePart=0x0) returned 0x34 [0039.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0039.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.744] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0039.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", lpFilePart=0x0) returned 0x40 [0039.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.745] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.745] GetFileType (hFile=0x274) returned 0x1 [0039.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.745] GetFileType (hFile=0x274) returned 0x1 [0039.745] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc2f5 [0039.745] ReadFile (in: hFile=0x274, lpBuffer=0x1a2f1a8, nNumberOfBytesToRead=0xc2f5, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2f1a8*, lpNumberOfBytesRead=0x2ae478*=0xc2f5, lpOverlapped=0x0) returned 1 [0039.754] CloseHandle (hObject=0x274) returned 1 [0039.768] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", lpFilePart=0x0) returned 0x40 [0039.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.768] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.769] GetFileType (hFile=0x274) returned 0x1 [0039.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.769] GetFileType (hFile=0x274) returned 0x1 [0039.769] WriteFile (in: hFile=0x274, lpBuffer=0x1aa08a8*, nNumberOfBytesToWrite=0xc300, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1aa08a8*, lpNumberOfBytesWritten=0x2ae46c*=0xc300, lpOverlapped=0x0) returned 1 [0039.771] CloseHandle (hObject=0x274) returned 1 [0039.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", lpFilePart=0x0) returned 0x40 [0039.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.773] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1a5880, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6a5f110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc300)) returned 1 [0039.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html.anonymous")) returned 1 [0039.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.773] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO", lpFilePart=0x0) returned 0x33 [0039.773] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpFilePart=0x0) returned 0x34 [0039.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0039.774] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.774] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.774] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.774] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.774] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0039.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO", lpFilePart=0x0) returned 0x33 [0039.774] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpFilePart=0x0) returned 0x34 [0039.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0039.775] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.775] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.775] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.775] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.775] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0039.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", lpFilePart=0x0) returned 0x40 [0039.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.775] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.775] GetFileType (hFile=0x274) returned 0x1 [0039.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.776] GetFileType (hFile=0x274) returned 0x1 [0039.776] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xd34f [0039.776] ReadFile (in: hFile=0x274, lpBuffer=0x1aae814, nNumberOfBytesToRead=0xd34f, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aae814*, lpNumberOfBytesRead=0x2ae478*=0xd34f, lpOverlapped=0x0) returned 1 [0039.786] CloseHandle (hObject=0x274) returned 1 [0039.800] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", lpFilePart=0x0) returned 0x40 [0039.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.800] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.802] GetFileType (hFile=0x274) returned 0x1 [0039.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.802] GetFileType (hFile=0x274) returned 0x1 [0039.802] WriteFile (in: hFile=0x274, lpBuffer=0x1b23004*, nNumberOfBytesToWrite=0xd350, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b23004*, lpNumberOfBytesWritten=0x2ae46c*=0xd350, lpOverlapped=0x0) returned 1 [0039.804] CloseHandle (hObject=0x274) returned 1 [0039.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", lpFilePart=0x0) returned 0x40 [0039.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.805] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd322640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6aab3d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd350)) returned 1 [0039.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html.anonymous")) returned 1 [0039.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE", lpFilePart=0x0) returned 0x33 [0039.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpFilePart=0x0) returned 0x34 [0039.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbead8 [0039.806] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.806] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.806] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.806] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.806] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0039.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE", lpFilePart=0x0) returned 0x33 [0039.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpFilePart=0x0) returned 0x34 [0039.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbead8 [0039.807] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.807] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.807] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.807] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.807] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0039.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", lpFilePart=0x0) returned 0x40 [0039.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.807] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.808] GetFileType (hFile=0x274) returned 0x1 [0039.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.808] GetFileType (hFile=0x274) returned 0x1 [0039.808] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc8bf [0039.808] ReadFile (in: hFile=0x274, lpBuffer=0x1b31fc0, nNumberOfBytesToRead=0xc8bf, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b31fc0*, lpNumberOfBytesRead=0x2ae478*=0xc8bf, lpOverlapped=0x0) returned 1 [0039.821] CloseHandle (hObject=0x274) returned 1 [0039.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", lpFilePart=0x0) returned 0x40 [0039.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.859] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.860] GetFileType (hFile=0x274) returned 0x1 [0039.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.861] GetFileType (hFile=0x274) returned 0x1 [0039.861] WriteFile (in: hFile=0x274, lpBuffer=0x19af744*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19af744*, lpNumberOfBytesWritten=0x2ae46c*=0xc8c0, lpOverlapped=0x0) returned 1 [0039.862] CloseHandle (hObject=0x274) returned 1 [0039.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", lpFilePart=0x0) returned 0x40 [0039.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.863] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd2d6380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6b1d7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc8c0)) returned 1 [0039.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html.anonymous")) returned 1 [0039.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR", lpFilePart=0x0) returned 0x33 [0039.864] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpFilePart=0x0) returned 0x34 [0039.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0039.865] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.865] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.866] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.866] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.866] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0039.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR", lpFilePart=0x0) returned 0x33 [0039.866] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpFilePart=0x0) returned 0x34 [0039.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0039.866] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.866] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.866] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.867] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.867] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0039.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.867] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", lpFilePart=0x0) returned 0x40 [0039.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.867] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.867] GetFileType (hFile=0x274) returned 0x1 [0039.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.867] GetFileType (hFile=0x274) returned 0x1 [0039.867] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xfa69 [0039.867] ReadFile (in: hFile=0x274, lpBuffer=0x19bdc70, nNumberOfBytesToRead=0xfa69, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19bdc70*, lpNumberOfBytesRead=0x2ae478*=0xfa69, lpOverlapped=0x0) returned 1 [0039.886] CloseHandle (hObject=0x274) returned 1 [0039.903] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", lpFilePart=0x0) returned 0x40 [0039.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0039.903] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.905] GetFileType (hFile=0x274) returned 0x1 [0039.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0039.905] GetFileType (hFile=0x274) returned 0x1 [0039.905] WriteFile (in: hFile=0x274, lpBuffer=0x1a39b1c*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a39b1c*, lpNumberOfBytesWritten=0x2ae46c*=0xfa70, lpOverlapped=0x0) returned 1 [0039.907] CloseHandle (hObject=0x274) returned 1 [0039.908] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", lpFilePart=0x0) returned 0x40 [0039.908] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0039.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0039.908] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1a5880, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6b8fc10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfa70)) returned 1 [0039.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0039.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html.anonymous")) returned 1 [0039.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.909] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR", lpFilePart=0x0) returned 0x33 [0039.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpFilePart=0x0) returned 0x34 [0039.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0039.909] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.909] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.909] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.909] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.910] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0039.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0039.910] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR", lpFilePart=0x0) returned 0x33 [0039.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpFilePart=0x0) returned 0x34 [0039.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0039.910] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.910] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.910] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0039.911] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0039.911] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0039.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0039.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0039.911] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", lpFilePart=0x0) returned 0x40 [0039.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0039.911] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0039.911] GetFileType (hFile=0x274) returned 0x1 [0039.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0039.911] GetFileType (hFile=0x274) returned 0x1 [0039.911] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3a6af [0039.934] ReadFile (in: hFile=0x274, lpBuffer=0x298d368, nNumberOfBytesToRead=0x3a6af, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesRead=0x2ae478*=0x3a6af, lpOverlapped=0x0) returned 1 [0039.963] CloseHandle (hObject=0x274) returned 1 [0040.016] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", lpFilePart=0x0) returned 0x40 [0040.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0040.016] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.019] GetFileType (hFile=0x274) returned 0x1 [0040.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0040.019] GetFileType (hFile=0x274) returned 0x1 [0040.019] WriteFile (in: hFile=0x274, lpBuffer=0x2b03280*, nNumberOfBytesToWrite=0x3a6b0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2b03280*, lpNumberOfBytesWritten=0x2ae46c*=0x3a6b0, lpOverlapped=0x0) returned 1 [0040.024] CloseHandle (hObject=0x274) returned 1 [0040.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", lpFilePart=0x0) returned 0x40 [0040.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.anonymous", lpFilePart=0x0) returned 0x4a [0040.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0040.027] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd1a5880, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb6cc0710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a6b0)) returned 1 [0040.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html.anonymous")) returned 1 [0040.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0040.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale", lpFilePart=0x0) returned 0x30 [0040.027] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\", lpFilePart=0x0) returned 0x31 [0040.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0040.075] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0040.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0040.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0040.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale", lpFilePart=0x0) returned 0x30 [0040.076] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\", lpFilePart=0x0) returned 0x31 [0040.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.078] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.079] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.080] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.080] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.080] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.080] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.080] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0040.080] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0040.080] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0040.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0040.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES", lpFilePart=0x0) returned 0x36 [0040.081] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpFilePart=0x0) returned 0x37 [0040.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.102] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.103] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0040.105] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES", lpFilePart=0x0) returned 0x36 [0040.106] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpFilePart=0x0) returned 0x37 [0040.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.107] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.107] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.107] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.107] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.107] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.107] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0040.110] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.111] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services", lpFilePart=0x0) returned 0x3f [0040.111] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpFilePart=0x0) returned 0x40 [0040.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.112] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0040.113] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.113] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services", lpFilePart=0x0) returned 0x3f [0040.113] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpFilePart=0x0) returned 0x40 [0040.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0040.114] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.114] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ", lpFilePart=0x0) returned 0x36 [0040.114] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpFilePart=0x0) returned 0x37 [0040.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.168] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0040.168] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ", lpFilePart=0x0) returned 0x36 [0040.170] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpFilePart=0x0) returned 0x37 [0040.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.171] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.171] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.171] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.172] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.173] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0040.173] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.175] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services", lpFilePart=0x0) returned 0x3f [0040.175] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\", lpFilePart=0x0) returned 0x40 [0040.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.177] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.177] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.177] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.177] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0040.177] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.178] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services", lpFilePart=0x0) returned 0x3f [0040.178] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\", lpFilePart=0x0) returned 0x40 [0040.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.178] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.178] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.178] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.178] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0040.178] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.178] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK", lpFilePart=0x0) returned 0x36 [0040.178] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", lpFilePart=0x0) returned 0x37 [0040.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.198] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.199] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0040.199] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.200] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK", lpFilePart=0x0) returned 0x36 [0040.200] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", lpFilePart=0x0) returned 0x37 [0040.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.202] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.203] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.203] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.203] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.203] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.203] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.203] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0040.203] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.204] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services", lpFilePart=0x0) returned 0x3f [0040.204] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\", lpFilePart=0x0) returned 0x40 [0040.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0040.206] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.206] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services", lpFilePart=0x0) returned 0x3f [0040.206] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\", lpFilePart=0x0) returned 0x40 [0040.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0040.206] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0040.207] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.207] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE", lpFilePart=0x0) returned 0x36 [0040.207] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\", lpFilePart=0x0) returned 0x37 [0040.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.230] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0040.231] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.232] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE", lpFilePart=0x0) returned 0x36 [0040.232] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\", lpFilePart=0x0) returned 0x37 [0040.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.234] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.235] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services", lpFilePart=0x0) returned 0x3f [0040.235] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\", lpFilePart=0x0) returned 0x40 [0040.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.237] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.238] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services", lpFilePart=0x0) returned 0x3f [0040.238] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\", lpFilePart=0x0) returned 0x40 [0040.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.238] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.238] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES", lpFilePart=0x0) returned 0x36 [0040.239] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\", lpFilePart=0x0) returned 0x37 [0040.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.245] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.246] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES", lpFilePart=0x0) returned 0x36 [0040.246] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\", lpFilePart=0x0) returned 0x37 [0040.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.248] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.249] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services", lpFilePart=0x0) returned 0x3f [0040.249] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\", lpFilePart=0x0) returned 0x40 [0040.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.251] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.251] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services", lpFilePart=0x0) returned 0x3f [0040.251] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\", lpFilePart=0x0) returned 0x40 [0040.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.251] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.251] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES", lpFilePart=0x0) returned 0x36 [0040.252] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\", lpFilePart=0x0) returned 0x37 [0040.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.276] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES", lpFilePart=0x0) returned 0x36 [0040.278] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\", lpFilePart=0x0) returned 0x37 [0040.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.279] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.280] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services", lpFilePart=0x0) returned 0x3f [0040.280] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\", lpFilePart=0x0) returned 0x40 [0040.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.281] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services", lpFilePart=0x0) returned 0x3f [0040.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\", lpFilePart=0x0) returned 0x40 [0040.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.281] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI", lpFilePart=0x0) returned 0x36 [0040.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\", lpFilePart=0x0) returned 0x37 [0040.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.283] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.284] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI", lpFilePart=0x0) returned 0x36 [0040.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\", lpFilePart=0x0) returned 0x37 [0040.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.285] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services", lpFilePart=0x0) returned 0x3f [0040.286] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\", lpFilePart=0x0) returned 0x40 [0040.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.288] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services", lpFilePart=0x0) returned 0x3f [0040.288] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\", lpFilePart=0x0) returned 0x40 [0040.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.288] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR", lpFilePart=0x0) returned 0x36 [0040.288] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\", lpFilePart=0x0) returned 0x37 [0040.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.297] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR", lpFilePart=0x0) returned 0x36 [0040.298] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\", lpFilePart=0x0) returned 0x37 [0040.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.299] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services", lpFilePart=0x0) returned 0x3f [0040.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.302] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services", lpFilePart=0x0) returned 0x3f [0040.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.302] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR", lpFilePart=0x0) returned 0x36 [0040.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\", lpFilePart=0x0) returned 0x37 [0040.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.306] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR", lpFilePart=0x0) returned 0x36 [0040.307] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\", lpFilePart=0x0) returned 0x37 [0040.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.308] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services", lpFilePart=0x0) returned 0x3f [0040.309] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.312] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services", lpFilePart=0x0) returned 0x3f [0040.312] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.313] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.313] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU", lpFilePart=0x0) returned 0x36 [0040.313] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\", lpFilePart=0x0) returned 0x37 [0040.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.318] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.320] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU", lpFilePart=0x0) returned 0x36 [0040.320] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\", lpFilePart=0x0) returned 0x37 [0040.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.321] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services", lpFilePart=0x0) returned 0x3f [0040.322] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\", lpFilePart=0x0) returned 0x40 [0040.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.323] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.323] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services", lpFilePart=0x0) returned 0x3f [0040.323] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\", lpFilePart=0x0) returned 0x40 [0040.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.323] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.323] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT", lpFilePart=0x0) returned 0x36 [0040.323] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\", lpFilePart=0x0) returned 0x37 [0040.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.336] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.337] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT", lpFilePart=0x0) returned 0x36 [0040.337] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\", lpFilePart=0x0) returned 0x37 [0040.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.338] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.339] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services", lpFilePart=0x0) returned 0x3f [0040.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\", lpFilePart=0x0) returned 0x40 [0040.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.340] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.340] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services", lpFilePart=0x0) returned 0x3f [0040.340] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\", lpFilePart=0x0) returned 0x40 [0040.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.341] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.341] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP", lpFilePart=0x0) returned 0x36 [0040.341] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\", lpFilePart=0x0) returned 0x37 [0040.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.352] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP", lpFilePart=0x0) returned 0x36 [0040.353] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\", lpFilePart=0x0) returned 0x37 [0040.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.354] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.355] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services", lpFilePart=0x0) returned 0x3f [0040.355] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\", lpFilePart=0x0) returned 0x40 [0040.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.356] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services", lpFilePart=0x0) returned 0x3f [0040.357] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\", lpFilePart=0x0) returned 0x40 [0040.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.357] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR", lpFilePart=0x0) returned 0x36 [0040.357] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\", lpFilePart=0x0) returned 0x37 [0040.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.367] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.368] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR", lpFilePart=0x0) returned 0x36 [0040.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\", lpFilePart=0x0) returned 0x37 [0040.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.369] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.370] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services", lpFilePart=0x0) returned 0x3f [0040.371] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.372] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.372] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services", lpFilePart=0x0) returned 0x3f [0040.372] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.372] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.372] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO", lpFilePart=0x0) returned 0x36 [0040.373] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\", lpFilePart=0x0) returned 0x37 [0040.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.378] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.379] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO", lpFilePart=0x0) returned 0x36 [0040.379] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\", lpFilePart=0x0) returned 0x37 [0040.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.380] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.381] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services", lpFilePart=0x0) returned 0x3f [0040.381] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\", lpFilePart=0x0) returned 0x40 [0040.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.382] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services", lpFilePart=0x0) returned 0x3f [0040.383] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\", lpFilePart=0x0) returned 0x40 [0040.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.383] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL", lpFilePart=0x0) returned 0x36 [0040.383] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\", lpFilePart=0x0) returned 0x37 [0040.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.395] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL", lpFilePart=0x0) returned 0x36 [0040.396] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\", lpFilePart=0x0) returned 0x37 [0040.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.397] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services", lpFilePart=0x0) returned 0x3f [0040.398] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\", lpFilePart=0x0) returned 0x40 [0040.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.399] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services", lpFilePart=0x0) returned 0x3f [0040.400] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\", lpFilePart=0x0) returned 0x40 [0040.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.400] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL", lpFilePart=0x0) returned 0x36 [0040.400] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\", lpFilePart=0x0) returned 0x37 [0040.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.401] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.402] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL", lpFilePart=0x0) returned 0x36 [0040.403] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\", lpFilePart=0x0) returned 0x37 [0040.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.404] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services", lpFilePart=0x0) returned 0x3f [0040.405] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\", lpFilePart=0x0) returned 0x40 [0040.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.406] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.406] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services", lpFilePart=0x0) returned 0x3f [0040.406] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\", lpFilePart=0x0) returned 0x40 [0040.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.406] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.406] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR", lpFilePart=0x0) returned 0x36 [0040.406] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\", lpFilePart=0x0) returned 0x37 [0040.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.408] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.409] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR", lpFilePart=0x0) returned 0x36 [0040.409] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\", lpFilePart=0x0) returned 0x37 [0040.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.410] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services", lpFilePart=0x0) returned 0x3f [0040.411] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.413] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services", lpFilePart=0x0) returned 0x3f [0040.413] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.413] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO", lpFilePart=0x0) returned 0x36 [0040.413] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\", lpFilePart=0x0) returned 0x37 [0040.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.419] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.420] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO", lpFilePart=0x0) returned 0x36 [0040.420] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\", lpFilePart=0x0) returned 0x37 [0040.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.422] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.423] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services", lpFilePart=0x0) returned 0x3f [0040.423] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\", lpFilePart=0x0) returned 0x40 [0040.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.424] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.424] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services", lpFilePart=0x0) returned 0x3f [0040.424] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\", lpFilePart=0x0) returned 0x40 [0040.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.424] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.425] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU", lpFilePart=0x0) returned 0x36 [0040.425] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\", lpFilePart=0x0) returned 0x37 [0040.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.426] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU", lpFilePart=0x0) returned 0x36 [0040.427] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\", lpFilePart=0x0) returned 0x37 [0040.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.428] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services", lpFilePart=0x0) returned 0x3f [0040.430] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\", lpFilePart=0x0) returned 0x40 [0040.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.431] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services", lpFilePart=0x0) returned 0x3f [0040.431] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\", lpFilePart=0x0) returned 0x40 [0040.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.431] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK", lpFilePart=0x0) returned 0x36 [0040.432] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\", lpFilePart=0x0) returned 0x37 [0040.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.434] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0040.435] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK", lpFilePart=0x0) returned 0x36 [0040.435] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\", lpFilePart=0x0) returned 0x37 [0040.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.436] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0040.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0040.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.437] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services", lpFilePart=0x0) returned 0x3f [0040.437] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\", lpFilePart=0x0) returned 0x40 [0040.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.438] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0040.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0040.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services", lpFilePart=0x0) returned 0x3f [0040.438] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\", lpFilePart=0x0) returned 0x40 [0040.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.438] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0040.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI", lpFilePart=0x0) returned 0x36 [0040.438] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\", lpFilePart=0x0) returned 0x37 [0040.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.445] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.445] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI", lpFilePart=0x0) returned 0x36 [0040.446] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\", lpFilePart=0x0) returned 0x37 [0040.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.447] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.448] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services", lpFilePart=0x0) returned 0x3f [0040.448] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\", lpFilePart=0x0) returned 0x40 [0040.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.449] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services", lpFilePart=0x0) returned 0x3f [0040.449] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\", lpFilePart=0x0) returned 0x40 [0040.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.449] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE", lpFilePart=0x0) returned 0x36 [0040.449] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\", lpFilePart=0x0) returned 0x37 [0040.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.451] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE", lpFilePart=0x0) returned 0x36 [0040.452] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\", lpFilePart=0x0) returned 0x37 [0040.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.453] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.454] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services", lpFilePart=0x0) returned 0x3f [0040.454] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\", lpFilePart=0x0) returned 0x40 [0040.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.455] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.455] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services", lpFilePart=0x0) returned 0x3f [0040.455] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\", lpFilePart=0x0) returned 0x40 [0040.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.455] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.455] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR", lpFilePart=0x0) returned 0x36 [0040.455] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\", lpFilePart=0x0) returned 0x37 [0040.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.457] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.458] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR", lpFilePart=0x0) returned 0x36 [0040.458] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\", lpFilePart=0x0) returned 0x37 [0040.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.459] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.460] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services", lpFilePart=0x0) returned 0x3f [0040.460] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.462] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.462] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services", lpFilePart=0x0) returned 0x3f [0040.462] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\", lpFilePart=0x0) returned 0x40 [0040.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.462] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.462] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA", lpFilePart=0x0) returned 0x36 [0040.462] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\", lpFilePart=0x0) returned 0x37 [0040.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.468] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.469] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA", lpFilePart=0x0) returned 0x36 [0040.469] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\", lpFilePart=0x0) returned 0x37 [0040.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.470] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.471] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services", lpFilePart=0x0) returned 0x3f [0040.471] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\", lpFilePart=0x0) returned 0x40 [0040.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.472] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services", lpFilePart=0x0) returned 0x3f [0040.472] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\", lpFilePart=0x0) returned 0x40 [0040.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.472] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN", lpFilePart=0x0) returned 0x36 [0040.473] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\", lpFilePart=0x0) returned 0x37 [0040.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.484] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN", lpFilePart=0x0) returned 0x36 [0040.485] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\", lpFilePart=0x0) returned 0x37 [0040.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.486] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.487] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services", lpFilePart=0x0) returned 0x3f [0040.487] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\", lpFilePart=0x0) returned 0x40 [0040.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.488] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.488] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services", lpFilePart=0x0) returned 0x3f [0040.489] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\", lpFilePart=0x0) returned 0x40 [0040.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.489] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.489] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW", lpFilePart=0x0) returned 0x36 [0040.489] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\", lpFilePart=0x0) returned 0x37 [0040.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.495] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW", lpFilePart=0x0) returned 0x36 [0040.496] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\", lpFilePart=0x0) returned 0x37 [0040.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.497] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services", lpFilePart=0x0) returned 0x3f [0040.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\", lpFilePart=0x0) returned 0x40 [0040.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.499] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.499] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services", lpFilePart=0x0) returned 0x3f [0040.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\", lpFilePart=0x0) returned 0x40 [0040.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.499] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins", lpFilePart=0x0) returned 0x32 [0040.500] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpFilePart=0x0) returned 0x33 [0040.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0040.501] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.501] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins", lpFilePart=0x0) returned 0x32 [0040.502] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpFilePart=0x0) returned 0x33 [0040.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0040.503] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm", lpFilePart=0x0) returned 0x3b [0040.504] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\", lpFilePart=0x0) returned 0x3c [0040.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.505] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm", lpFilePart=0x0) returned 0x3b [0040.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\", lpFilePart=0x0) returned 0x3c [0040.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.506] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP", lpFilePart=0x0) returned 0x3f [0040.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\", lpFilePart=0x0) returned 0x40 [0040.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.506] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.507] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP", lpFilePart=0x0) returned 0x3f [0040.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\", lpFilePart=0x0) returned 0x40 [0040.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.507] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.507] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations", lpFilePart=0x0) returned 0x3e [0040.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\", lpFilePart=0x0) returned 0x3f [0040.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.508] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations", lpFilePart=0x0) returned 0x3e [0040.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\", lpFilePart=0x0) returned 0x3f [0040.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0040.508] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps", lpFilePart=0x0) returned 0x45 [0040.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpFilePart=0x0) returned 0x46 [0040.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.518] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.518] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps", lpFilePart=0x0) returned 0x45 [0040.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpFilePart=0x0) returned 0x46 [0040.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0040.520] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0040.521] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", lpFilePart=0x0) returned 0x4f [0040.521] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.522] GetFileType (hFile=0x274) returned 0x1 [0040.522] GetFileType (hFile=0x274) returned 0x1 [0040.522] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1b772 [0040.532] CloseHandle (hObject=0x274) returned 1 [0040.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", lpFilePart=0x0) returned 0x4f [0040.549] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.551] GetFileType (hFile=0x274) returned 0x1 [0040.551] GetFileType (hFile=0x274) returned 0x1 [0040.551] WriteFile (in: hFile=0x274, lpBuffer=0x2b8ffe0*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2b8ffe0*, lpNumberOfBytesWritten=0x2ae3f8*=0x1b780, lpOverlapped=0x0) returned 1 [0040.554] CloseHandle (hObject=0x274) returned 1 [0040.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", lpFilePart=0x0) returned 0x4f [0040.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.anonymous", lpFilePart=0x0) returned 0x59 [0040.555] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbee6b40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb71cf5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b780)) returned 1 [0040.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf.anonymous")) returned 1 [0040.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT", lpFilePart=0x0) returned 0x49 [0040.556] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", lpFilePart=0x0) returned 0x4a [0040.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0040.562] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0040.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT", lpFilePart=0x0) returned 0x49 [0040.563] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", lpFilePart=0x0) returned 0x4a [0040.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0040.564] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0040.565] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0040.565] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.566] GetFileType (hFile=0x274) returned 0x1 [0040.566] GetFileType (hFile=0x274) returned 0x1 [0040.566] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xcdd8 [0040.568] CloseHandle (hObject=0x274) returned 1 [0040.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0040.581] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.583] GetFileType (hFile=0x274) returned 0x1 [0040.583] GetFileType (hFile=0x274) returned 0x1 [0040.583] WriteFile (in: hFile=0x274, lpBuffer=0x1b256a4*, nNumberOfBytesToWrite=0xcde0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b256a4*, lpNumberOfBytesWritten=0x2ae384*=0xcde0, lpOverlapped=0x0) returned 1 [0040.585] CloseHandle (hObject=0x274) returned 1 [0040.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0040.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0040.586] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd61c1c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb721b890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcde0)) returned 1 [0040.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf.anonymous")) returned 1 [0040.588] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0040.588] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.588] GetFileType (hFile=0x274) returned 0x1 [0040.588] GetFileType (hFile=0x274) returned 0x1 [0040.588] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x892d [0040.594] CloseHandle (hObject=0x274) returned 1 [0040.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0040.629] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.631] GetFileType (hFile=0x274) returned 0x1 [0040.631] GetFileType (hFile=0x274) returned 0x1 [0040.631] WriteFile (in: hFile=0x274, lpBuffer=0x19a97a0*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19a97a0*, lpNumberOfBytesWritten=0x2ae384*=0x8930, lpOverlapped=0x0) returned 1 [0040.632] CloseHandle (hObject=0x274) returned 1 [0040.633] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd642320, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb728dcb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8930)) returned 1 [0040.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf.anonymous")) returned 1 [0040.634] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.640] GetFileType (hFile=0x274) returned 0x1 [0040.640] GetFileType (hFile=0x274) returned 0x1 [0040.640] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xc084 [0040.644] CloseHandle (hObject=0x274) returned 1 [0040.658] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.659] GetFileType (hFile=0x274) returned 0x1 [0040.659] GetFileType (hFile=0x274) returned 0x1 [0040.659] WriteFile (in: hFile=0x274, lpBuffer=0x1a23550*, nNumberOfBytesToWrite=0xc090, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a23550*, lpNumberOfBytesWritten=0x2ae384*=0xc090, lpOverlapped=0x0) returned 1 [0040.661] CloseHandle (hObject=0x274) returned 1 [0040.662] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd668480, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb72d9f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc090)) returned 1 [0040.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf.anonymous")) returned 1 [0040.663] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.663] GetFileType (hFile=0x274) returned 0x1 [0040.663] GetFileType (hFile=0x274) returned 0x1 [0040.663] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x8c96 [0040.669] CloseHandle (hObject=0x274) returned 1 [0040.681] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.682] GetFileType (hFile=0x274) returned 0x1 [0040.683] GetFileType (hFile=0x274) returned 0x1 [0040.683] WriteFile (in: hFile=0x274, lpBuffer=0x1aa87e8*, nNumberOfBytesToWrite=0x8ca0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aa87e8*, lpNumberOfBytesWritten=0x2ae384*=0x8ca0, lpOverlapped=0x0) returned 1 [0040.684] CloseHandle (hObject=0x274) returned 1 [0040.685] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd61c1c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb73000d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8ca0)) returned 1 [0040.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf.anonymous")) returned 1 [0040.685] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.686] GetFileType (hFile=0x274) returned 0x1 [0040.686] GetFileType (hFile=0x274) returned 0x1 [0040.686] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2eb9e [0040.687] ReadFile (in: hFile=0x274, lpBuffer=0x2bdd460, nNumberOfBytesToRead=0x2eb9e, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2bdd460*, lpNumberOfBytesRead=0x2ae390*=0x2eb9e, lpOverlapped=0x0) returned 1 [0040.702] CloseHandle (hObject=0x274) returned 1 [0040.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0040.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0040.727] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.729] GetFileType (hFile=0x274) returned 0x1 [0040.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0040.729] GetFileType (hFile=0x274) returned 0x1 [0040.729] WriteFile (in: hFile=0x274, lpBuffer=0x298d368*, nNumberOfBytesToWrite=0x2eba0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesWritten=0x2ae384*=0x2eba0, lpOverlapped=0x0) returned 1 [0040.733] CloseHandle (hObject=0x274) returned 1 [0040.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0040.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0040.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0040.735] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd61c1c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb73724f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2eba0)) returned 1 [0040.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0040.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf.anonymous")) returned 1 [0040.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0040.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0040.736] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.736] GetFileType (hFile=0x274) returned 0x1 [0040.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0040.736] GetFileType (hFile=0x274) returned 0x1 [0040.736] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9a88d [0040.736] ReadFile (in: hFile=0x274, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0x9a88d, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae390*=0x9a88d, lpOverlapped=0x0) returned 1 [0040.751] CloseHandle (hObject=0x274) returned 1 [0040.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0040.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0040.837] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.844] GetFileType (hFile=0x274) returned 0x1 [0040.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0040.844] GetFileType (hFile=0x274) returned 0x1 [0040.844] WriteFile (in: hFile=0x274, lpBuffer=0x2ab4050*, nNumberOfBytesToWrite=0x9a890, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2ab4050*, lpNumberOfBytesWritten=0x2ae384*=0x9a890, lpOverlapped=0x0) returned 1 [0040.856] CloseHandle (hObject=0x274) returned 1 [0040.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0040.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0040.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0040.861] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd61c1c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb74a2ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a890)) returned 1 [0040.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0040.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf.anonymous")) returned 1 [0040.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0040.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS", lpFilePart=0x0) returned 0x49 [0040.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", lpFilePart=0x0) returned 0x4a [0040.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed18 [0040.863] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.863] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.863] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.863] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.863] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.863] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0040.863] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0040.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0040.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0040.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0040.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS", lpFilePart=0x0) returned 0x49 [0040.864] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", lpFilePart=0x0) returned 0x4a [0040.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed18 [0040.864] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.864] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.864] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.864] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.864] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0040.864] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0040.865] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0040.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0040.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0040.865] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0040.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0040.865] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.865] GetFileType (hFile=0x274) returned 0x1 [0040.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0040.865] GetFileType (hFile=0x274) returned 0x1 [0040.865] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x13e0e [0040.866] ReadFile (in: hFile=0x274, lpBuffer=0x1933e8c, nNumberOfBytesToRead=0x13e0e, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1933e8c*, lpNumberOfBytesRead=0x2ae390*=0x13e0e, lpOverlapped=0x0) returned 1 [0040.882] CloseHandle (hObject=0x274) returned 1 [0040.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0040.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0040.920] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.921] GetFileType (hFile=0x274) returned 0x1 [0040.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0040.922] GetFileType (hFile=0x274) returned 0x1 [0040.922] WriteFile (in: hFile=0x274, lpBuffer=0x19bccbc*, nNumberOfBytesToWrite=0x13e10, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19bccbc*, lpNumberOfBytesWritten=0x2ae384*=0x13e10, lpOverlapped=0x0) returned 1 [0040.924] CloseHandle (hObject=0x274) returned 1 [0040.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0040.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0040.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0040.976] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc6c9420, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb75d3af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13e10)) returned 1 [0040.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0040.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf.anonymous")) returned 1 [0040.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0040.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0040.978] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0040.978] GetFileType (hFile=0x274) returned 0x1 [0040.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0040.978] GetFileType (hFile=0x274) returned 0x1 [0040.978] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xaf90 [0040.978] ReadFile (in: hFile=0x274, lpBuffer=0x19d0fa4, nNumberOfBytesToRead=0xaf90, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19d0fa4*, lpNumberOfBytesRead=0x2ae390*=0xaf90, lpOverlapped=0x0) returned 1 [0040.989] CloseHandle (hObject=0x274) returned 1 [0041.004] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0041.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.004] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.005] GetFileType (hFile=0x274) returned 0x1 [0041.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.006] GetFileType (hFile=0x274) returned 0x1 [0041.006] WriteFile (in: hFile=0x274, lpBuffer=0x1a3ec80*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a3ec80*, lpNumberOfBytesWritten=0x2ae384*=0xafa0, lpOverlapped=0x0) returned 1 [0041.014] CloseHandle (hObject=0x274) returned 1 [0041.015] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0041.015] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0041.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc6a32c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb761fdb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xafa0)) returned 1 [0041.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf.anonymous")) returned 1 [0041.016] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.016] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.016] GetFileType (hFile=0x274) returned 0x1 [0041.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.016] GetFileType (hFile=0x274) returned 0x1 [0041.016] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xc0af [0041.016] ReadFile (in: hFile=0x274, lpBuffer=0x1a4a0f4, nNumberOfBytesToRead=0xc0af, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a4a0f4*, lpNumberOfBytesRead=0x2ae390*=0xc0af, lpOverlapped=0x0) returned 1 [0041.028] CloseHandle (hObject=0x274) returned 1 [0041.041] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.041] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.042] GetFileType (hFile=0x274) returned 0x1 [0041.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.043] GetFileType (hFile=0x274) returned 0x1 [0041.043] WriteFile (in: hFile=0x274, lpBuffer=0x1abb104*, nNumberOfBytesToWrite=0xc0b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1abb104*, lpNumberOfBytesWritten=0x2ae384*=0xc0b0, lpOverlapped=0x0) returned 1 [0041.044] CloseHandle (hObject=0x274) returned 1 [0041.045] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.046] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc6a32c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb766c070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0b0)) returned 1 [0041.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf.anonymous")) returned 1 [0041.046] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.046] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.046] GetFileType (hFile=0x274) returned 0x1 [0041.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.047] GetFileType (hFile=0x274) returned 0x1 [0041.047] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x217ce [0041.047] ReadFile (in: hFile=0x274, lpBuffer=0x2b4e900, nNumberOfBytesToRead=0x217ce, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b4e900*, lpNumberOfBytesRead=0x2ae390*=0x217ce, lpOverlapped=0x0) returned 1 [0041.073] CloseHandle (hObject=0x274) returned 1 [0041.116] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.116] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.118] GetFileType (hFile=0x274) returned 0x1 [0041.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.118] GetFileType (hFile=0x274) returned 0x1 [0041.118] WriteFile (in: hFile=0x274, lpBuffer=0x2bf6050*, nNumberOfBytesToWrite=0x217d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bf6050*, lpNumberOfBytesWritten=0x2ae384*=0x217d0, lpOverlapped=0x0) returned 1 [0041.121] CloseHandle (hObject=0x274) returned 1 [0041.123] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.123] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0041.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.123] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc6a32c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb772a750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x217d0)) returned 1 [0041.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf.anonymous")) returned 1 [0041.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.124] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT", lpFilePart=0x0) returned 0x49 [0041.124] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", lpFilePart=0x0) returned 0x4a [0041.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0041.125] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.125] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.125] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.125] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.125] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.125] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.126] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0041.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.126] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT", lpFilePart=0x0) returned 0x49 [0041.126] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", lpFilePart=0x0) returned 0x4a [0041.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0041.126] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.126] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.126] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.126] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.126] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.127] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.127] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0041.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.127] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.127] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.127] GetFileType (hFile=0x274) returned 0x1 [0041.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.127] GetFileType (hFile=0x274) returned 0x1 [0041.127] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x132cc [0041.127] ReadFile (in: hFile=0x274, lpBuffer=0x196498c, nNumberOfBytesToRead=0x132cc, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x196498c*, lpNumberOfBytesRead=0x2ae390*=0x132cc, lpOverlapped=0x0) returned 1 [0041.135] CloseHandle (hObject=0x274) returned 1 [0041.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.150] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.151] GetFileType (hFile=0x274) returned 0x1 [0041.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.151] GetFileType (hFile=0x274) returned 0x1 [0041.151] WriteFile (in: hFile=0x274, lpBuffer=0x19eb154*, nNumberOfBytesToWrite=0x132d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19eb154*, lpNumberOfBytesWritten=0x2ae384*=0x132d0, lpOverlapped=0x0) returned 1 [0041.153] CloseHandle (hObject=0x274) returned 1 [0041.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0041.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.155] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc089a60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7776a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x132d0)) returned 1 [0041.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf.anonymous")) returned 1 [0041.157] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0041.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.157] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.157] GetFileType (hFile=0x274) returned 0x1 [0041.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.157] GetFileType (hFile=0x274) returned 0x1 [0041.158] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb7c2 [0041.158] ReadFile (in: hFile=0x274, lpBuffer=0x19fe8fc, nNumberOfBytesToRead=0xb7c2, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19fe8fc*, lpNumberOfBytesRead=0x2ae390*=0xb7c2, lpOverlapped=0x0) returned 1 [0041.165] CloseHandle (hObject=0x274) returned 1 [0041.178] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0041.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.178] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.180] GetFileType (hFile=0x274) returned 0x1 [0041.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.180] GetFileType (hFile=0x274) returned 0x1 [0041.180] WriteFile (in: hFile=0x274, lpBuffer=0x1a6de6c*, nNumberOfBytesToWrite=0xb7d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a6de6c*, lpNumberOfBytesWritten=0x2ae384*=0xb7d0, lpOverlapped=0x0) returned 1 [0041.181] CloseHandle (hObject=0x274) returned 1 [0041.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0041.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0041.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.183] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc089a60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb77c2cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb7d0)) returned 1 [0041.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf.anonymous")) returned 1 [0041.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.183] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.183] GetFileType (hFile=0x274) returned 0x1 [0041.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.183] GetFileType (hFile=0x274) returned 0x1 [0041.184] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1182b [0041.184] ReadFile (in: hFile=0x274, lpBuffer=0x1a79b10, nNumberOfBytesToRead=0x1182b, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a79b10*, lpNumberOfBytesRead=0x2ae390*=0x1182b, lpOverlapped=0x0) returned 1 [0041.197] CloseHandle (hObject=0x274) returned 1 [0041.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.211] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.212] GetFileType (hFile=0x274) returned 0x1 [0041.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.213] GetFileType (hFile=0x274) returned 0x1 [0041.213] WriteFile (in: hFile=0x274, lpBuffer=0x1afb1a0*, nNumberOfBytesToWrite=0x11830, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1afb1a0*, lpNumberOfBytesWritten=0x2ae384*=0x11830, lpOverlapped=0x0) returned 1 [0041.215] CloseHandle (hObject=0x274) returned 1 [0041.216] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.216] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.216] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc089a60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb780ef90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11830)) returned 1 [0041.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf.anonymous")) returned 1 [0041.216] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.217] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.217] GetFileType (hFile=0x274) returned 0x1 [0041.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.217] GetFileType (hFile=0x274) returned 0x1 [0041.217] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x322cc [0041.218] ReadFile (in: hFile=0x274, lpBuffer=0x2c60e40, nNumberOfBytesToRead=0x322cc, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c60e40*, lpNumberOfBytesRead=0x2ae390*=0x322cc, lpOverlapped=0x0) returned 1 [0041.239] CloseHandle (hObject=0x274) returned 1 [0041.305] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.305] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.308] GetFileType (hFile=0x274) returned 0x1 [0041.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.308] GetFileType (hFile=0x274) returned 0x1 [0041.308] WriteFile (in: hFile=0x274, lpBuffer=0x298d368*, nNumberOfBytesToWrite=0x322d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesWritten=0x2ae384*=0x322d0, lpOverlapped=0x0) returned 1 [0041.312] CloseHandle (hObject=0x274) returned 1 [0041.315] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.315] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0041.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.316] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc089a60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7919930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x322d0)) returned 1 [0041.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf.anonymous")) returned 1 [0041.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE", lpFilePart=0x0) returned 0x49 [0041.316] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\", lpFilePart=0x0) returned 0x4a [0041.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea58 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.344] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0041.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.345] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE", lpFilePart=0x0) returned 0x49 [0041.345] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\", lpFilePart=0x0) returned 0x4a [0041.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea58 [0041.346] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.346] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.346] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.346] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.347] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.347] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.347] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.347] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.347] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0041.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.348] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.350] GetFileType (hFile=0x274) returned 0x1 [0041.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.350] GetFileType (hFile=0x274) returned 0x1 [0041.350] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x7d00 [0041.350] ReadFile (in: hFile=0x274, lpBuffer=0x1934af0, nNumberOfBytesToRead=0x7d00, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1934af0*, lpNumberOfBytesRead=0x2ae390*=0x7d00, lpOverlapped=0x0) returned 1 [0041.354] CloseHandle (hObject=0x274) returned 1 [0041.390] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.390] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.391] GetFileType (hFile=0x274) returned 0x1 [0041.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.391] GetFileType (hFile=0x274) returned 0x1 [0041.391] WriteFile (in: hFile=0x274, lpBuffer=0x19a9040*, nNumberOfBytesToWrite=0x7d10, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19a9040*, lpNumberOfBytesWritten=0x2ae384*=0x7d10, lpOverlapped=0x0) returned 1 [0041.393] CloseHandle (hObject=0x274) returned 1 [0041.394] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.394] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0041.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.394] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfdc800, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb79b1eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d10)) returned 1 [0041.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf.anonymous")) returned 1 [0041.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0041.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.398] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.399] GetFileType (hFile=0x274) returned 0x1 [0041.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.399] GetFileType (hFile=0x274) returned 0x1 [0041.399] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x8770 [0041.399] ReadFile (in: hFile=0x274, lpBuffer=0x19b1228, nNumberOfBytesToRead=0x8770, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19b1228*, lpNumberOfBytesRead=0x2ae390*=0x8770, lpOverlapped=0x0) returned 1 [0041.401] CloseHandle (hObject=0x274) returned 1 [0041.421] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0041.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.421] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.423] GetFileType (hFile=0x274) returned 0x1 [0041.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.423] GetFileType (hFile=0x274) returned 0x1 [0041.423] WriteFile (in: hFile=0x274, lpBuffer=0x1a28590*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a28590*, lpNumberOfBytesWritten=0x2ae384*=0x8780, lpOverlapped=0x0) returned 1 [0041.425] CloseHandle (hObject=0x274) returned 1 [0041.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0041.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0041.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.427] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfdc800, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7a242d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8780)) returned 1 [0041.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf.anonymous")) returned 1 [0041.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0041.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.428] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.428] GetFileType (hFile=0x274) returned 0x1 [0041.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.428] GetFileType (hFile=0x274) returned 0x1 [0041.428] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb7dc [0041.428] ReadFile (in: hFile=0x274, lpBuffer=0x1a311e4, nNumberOfBytesToRead=0xb7dc, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a311e4*, lpNumberOfBytesRead=0x2ae390*=0xb7dc, lpOverlapped=0x0) returned 1 [0041.449] CloseHandle (hObject=0x274) returned 1 [0041.463] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0041.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.463] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.465] GetFileType (hFile=0x274) returned 0x1 [0041.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.465] GetFileType (hFile=0x274) returned 0x1 [0041.465] WriteFile (in: hFile=0x274, lpBuffer=0x1aa0780*, nNumberOfBytesToWrite=0xb7e0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aa0780*, lpNumberOfBytesWritten=0x2ae384*=0xb7e0, lpOverlapped=0x0) returned 1 [0041.467] CloseHandle (hObject=0x274) returned 1 [0041.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0041.469] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.469] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfdc800, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7a70590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb7e0)) returned 1 [0041.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf.anonymous")) returned 1 [0041.470] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.470] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.470] GetFileType (hFile=0x274) returned 0x1 [0041.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.470] GetFileType (hFile=0x274) returned 0x1 [0041.470] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x5274b [0041.472] ReadFile (in: hFile=0x274, lpBuffer=0x2c93128, nNumberOfBytesToRead=0x5274b, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c93128*, lpNumberOfBytesRead=0x2ae390*=0x5274b, lpOverlapped=0x0) returned 1 [0041.518] CloseHandle (hObject=0x274) returned 1 [0041.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.552] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.558] GetFileType (hFile=0x274) returned 0x1 [0041.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.558] GetFileType (hFile=0x274) returned 0x1 [0041.558] WriteFile (in: hFile=0x274, lpBuffer=0x2b63500*, nNumberOfBytesToWrite=0x52750, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b63500*, lpNumberOfBytesWritten=0x2ae384*=0x52750, lpOverlapped=0x0) returned 1 [0041.568] CloseHandle (hObject=0x274) returned 1 [0041.572] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.572] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.572] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd002960, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7b7af30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x52750)) returned 1 [0041.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf.anonymous")) returned 1 [0041.572] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0041.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.573] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.573] GetFileType (hFile=0x274) returned 0x1 [0041.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.573] GetFileType (hFile=0x274) returned 0x1 [0041.573] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2c339 [0041.574] ReadFile (in: hFile=0x274, lpBuffer=0x2bb5c70, nNumberOfBytesToRead=0x2c339, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2bb5c70*, lpNumberOfBytesRead=0x2ae390*=0x2c339, lpOverlapped=0x0) returned 1 [0041.598] CloseHandle (hObject=0x274) returned 1 [0041.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0041.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.668] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.670] GetFileType (hFile=0x274) returned 0x1 [0041.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.670] GetFileType (hFile=0x274) returned 0x1 [0041.670] WriteFile (in: hFile=0x274, lpBuffer=0x298d368*, nNumberOfBytesToWrite=0x2c340, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesWritten=0x2ae384*=0x2c340, lpOverlapped=0x0) returned 1 [0041.674] CloseHandle (hObject=0x274) returned 1 [0041.676] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0041.676] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.676] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfdc800, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7c858d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2c340)) returned 1 [0041.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf.anonymous")) returned 1 [0041.676] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.676] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.677] GetFileType (hFile=0x274) returned 0x1 [0041.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.677] GetFileType (hFile=0x274) returned 0x1 [0041.677] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x15c7a [0041.677] ReadFile (in: hFile=0x274, lpBuffer=0x29b96c8, nNumberOfBytesToRead=0x15c7a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x29b96c8*, lpNumberOfBytesRead=0x2ae390*=0x15c7a, lpOverlapped=0x0) returned 1 [0041.684] CloseHandle (hObject=0x274) returned 1 [0041.723] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.723] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.724] GetFileType (hFile=0x274) returned 0x1 [0041.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.724] GetFileType (hFile=0x274) returned 0x1 [0041.724] WriteFile (in: hFile=0x274, lpBuffer=0x2a450a0*, nNumberOfBytesToWrite=0x15c80, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a450a0*, lpNumberOfBytesWritten=0x2ae384*=0x15c80, lpOverlapped=0x0) returned 1 [0041.727] CloseHandle (hObject=0x274) returned 1 [0041.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0041.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.728] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f093400, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfdc800, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7cf7cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15c80)) returned 1 [0041.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf.anonymous")) returned 1 [0041.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.729] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN", lpFilePart=0x0) returned 0x49 [0041.729] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", lpFilePart=0x0) returned 0x4a [0041.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0041.729] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.729] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.729] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.729] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.730] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.730] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0041.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN", lpFilePart=0x0) returned 0x49 [0041.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", lpFilePart=0x0) returned 0x4a [0041.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0041.730] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.730] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.730] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.730] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.731] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.731] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0041.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.731] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.731] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.731] GetFileType (hFile=0x274) returned 0x1 [0041.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.731] GetFileType (hFile=0x274) returned 0x1 [0041.731] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xe6d5 [0041.731] ReadFile (in: hFile=0x274, lpBuffer=0x1981ae0, nNumberOfBytesToRead=0xe6d5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1981ae0*, lpNumberOfBytesRead=0x2ae390*=0xe6d5, lpOverlapped=0x0) returned 1 [0041.744] CloseHandle (hObject=0x274) returned 1 [0041.757] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.758] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.759] GetFileType (hFile=0x274) returned 0x1 [0041.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.759] GetFileType (hFile=0x274) returned 0x1 [0041.759] WriteFile (in: hFile=0x274, lpBuffer=0x19f9d80*, nNumberOfBytesToWrite=0xe6e0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19f9d80*, lpNumberOfBytesWritten=0x2ae384*=0xe6e0, lpOverlapped=0x0) returned 1 [0041.761] CloseHandle (hObject=0x274) returned 1 [0041.762] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.762] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0041.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.762] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc089a60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7d43fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe6e0)) returned 1 [0041.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf.anonymous")) returned 1 [0041.763] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.763] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.764] GetFileType (hFile=0x274) returned 0x1 [0041.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.764] GetFileType (hFile=0x274) returned 0x1 [0041.764] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9306 [0041.764] ReadFile (in: hFile=0x274, lpBuffer=0x1a08948, nNumberOfBytesToRead=0x9306, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a08948*, lpNumberOfBytesRead=0x2ae390*=0x9306, lpOverlapped=0x0) returned 1 [0041.766] CloseHandle (hObject=0x274) returned 1 [0041.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.778] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.780] GetFileType (hFile=0x274) returned 0x1 [0041.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.780] GetFileType (hFile=0x274) returned 0x1 [0041.780] WriteFile (in: hFile=0x274, lpBuffer=0x1a83684*, nNumberOfBytesToWrite=0x9310, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a83684*, lpNumberOfBytesWritten=0x2ae384*=0x9310, lpOverlapped=0x0) returned 1 [0041.781] CloseHandle (hObject=0x274) returned 1 [0041.782] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.782] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.782] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc089a60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7d6a110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9310)) returned 1 [0041.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf.anonymous")) returned 1 [0041.795] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.795] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.795] GetFileType (hFile=0x274) returned 0x1 [0041.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.795] GetFileType (hFile=0x274) returned 0x1 [0041.795] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x18757 [0041.795] ReadFile (in: hFile=0x274, lpBuffer=0x2a77b00, nNumberOfBytesToRead=0x18757, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a77b00*, lpNumberOfBytesRead=0x2ae390*=0x18757, lpOverlapped=0x0) returned 1 [0041.810] CloseHandle (hObject=0x274) returned 1 [0041.849] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.849] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.851] GetFileType (hFile=0x274) returned 0x1 [0041.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.851] GetFileType (hFile=0x274) returned 0x1 [0041.851] WriteFile (in: hFile=0x274, lpBuffer=0x2af2018*, nNumberOfBytesToWrite=0x18760, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2af2018*, lpNumberOfBytesWritten=0x2ae384*=0x18760, lpOverlapped=0x0) returned 1 [0041.854] CloseHandle (hObject=0x274) returned 1 [0041.855] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.855] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0041.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.855] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc0afbc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7e287f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18760)) returned 1 [0041.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf.anonymous")) returned 1 [0041.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU", lpFilePart=0x0) returned 0x49 [0041.856] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", lpFilePart=0x0) returned 0x4a [0041.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0041.857] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.857] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.857] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.857] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.857] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.857] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0041.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.858] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU", lpFilePart=0x0) returned 0x49 [0041.858] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", lpFilePart=0x0) returned 0x4a [0041.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0041.858] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.858] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.858] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.858] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.858] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.858] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0041.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.859] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.859] GetFileType (hFile=0x274) returned 0x1 [0041.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.859] GetFileType (hFile=0x274) returned 0x1 [0041.859] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xcadf [0041.859] ReadFile (in: hFile=0x274, lpBuffer=0x1adc420, nNumberOfBytesToRead=0xcadf, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1adc420*, lpNumberOfBytesRead=0x2ae390*=0xcadf, lpOverlapped=0x0) returned 1 [0041.863] CloseHandle (hObject=0x274) returned 1 [0041.909] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.909] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.910] GetFileType (hFile=0x274) returned 0x1 [0041.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.911] GetFileType (hFile=0x274) returned 0x1 [0041.911] WriteFile (in: hFile=0x274, lpBuffer=0x199bc80*, nNumberOfBytesToWrite=0xcae0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x199bc80*, lpNumberOfBytesWritten=0x2ae384*=0xcae0, lpOverlapped=0x0) returned 1 [0041.912] CloseHandle (hObject=0x274) returned 1 [0041.913] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.913] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0041.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.913] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfcb380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7ec0d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcae0)) returned 1 [0041.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf.anonymous")) returned 1 [0041.914] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.914] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.914] GetFileType (hFile=0x274) returned 0x1 [0041.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.914] GetFileType (hFile=0x274) returned 0x1 [0041.914] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa36f [0041.914] ReadFile (in: hFile=0x274, lpBuffer=0x19a8c48, nNumberOfBytesToRead=0xa36f, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19a8c48*, lpNumberOfBytesRead=0x2ae390*=0xa36f, lpOverlapped=0x0) returned 1 [0041.916] CloseHandle (hObject=0x274) returned 1 [0041.929] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.929] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.930] GetFileType (hFile=0x274) returned 0x1 [0041.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.930] GetFileType (hFile=0x274) returned 0x1 [0041.930] WriteFile (in: hFile=0x274, lpBuffer=0x1a28cc0*, nNumberOfBytesToWrite=0xa370, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a28cc0*, lpNumberOfBytesWritten=0x2ae384*=0xa370, lpOverlapped=0x0) returned 1 [0041.932] CloseHandle (hObject=0x274) returned 1 [0041.933] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0041.933] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0041.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.933] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfcb380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7ee6ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa370)) returned 1 [0041.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf.anonymous")) returned 1 [0041.941] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.941] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.941] GetFileType (hFile=0x274) returned 0x1 [0041.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.941] GetFileType (hFile=0x274) returned 0x1 [0041.941] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x178c0 [0041.942] ReadFile (in: hFile=0x274, lpBuffer=0x2b23d58, nNumberOfBytesToRead=0x178c0, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b23d58*, lpNumberOfBytesRead=0x2ae390*=0x178c0, lpOverlapped=0x0) returned 1 [0041.955] CloseHandle (hObject=0x274) returned 1 [0041.971] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0041.971] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.972] GetFileType (hFile=0x274) returned 0x1 [0041.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0041.973] GetFileType (hFile=0x274) returned 0x1 [0041.973] WriteFile (in: hFile=0x274, lpBuffer=0x2b99998*, nNumberOfBytesToWrite=0x178d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b99998*, lpNumberOfBytesWritten=0x2ae384*=0x178d0, lpOverlapped=0x0) returned 1 [0041.975] CloseHandle (hObject=0x274) returned 1 [0041.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0041.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0041.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0041.976] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfcb380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7f592f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x178d0)) returned 1 [0041.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0041.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf.anonymous")) returned 1 [0041.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU", lpFilePart=0x0) returned 0x49 [0041.977] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\", lpFilePart=0x0) returned 0x4a [0041.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0041.980] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.980] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.980] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.980] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.981] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.981] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0041.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0041.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU", lpFilePart=0x0) returned 0x49 [0041.981] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\", lpFilePart=0x0) returned 0x4a [0041.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0041.981] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.981] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.981] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.982] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0041.982] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0041.982] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0041.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0041.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0041.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0041.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0041.982] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0041.983] GetFileType (hFile=0x274) returned 0x1 [0041.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0041.983] GetFileType (hFile=0x274) returned 0x1 [0041.983] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xdf82 [0041.983] ReadFile (in: hFile=0x274, lpBuffer=0x1a82ac0, nNumberOfBytesToRead=0xdf82, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a82ac0*, lpNumberOfBytesRead=0x2ae390*=0xdf82, lpOverlapped=0x0) returned 1 [0042.000] CloseHandle (hObject=0x274) returned 1 [0042.015] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.015] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.017] GetFileType (hFile=0x274) returned 0x1 [0042.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.017] GetFileType (hFile=0x274) returned 0x1 [0042.017] WriteFile (in: hFile=0x274, lpBuffer=0x1af9770*, nNumberOfBytesToWrite=0xdf90, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1af9770*, lpNumberOfBytesWritten=0x2ae384*=0xdf90, lpOverlapped=0x0) returned 1 [0042.019] CloseHandle (hObject=0x274) returned 1 [0042.020] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.020] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0042.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc017640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb7fcb710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdf90)) returned 1 [0042.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.anonymous")) returned 1 [0042.021] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.021] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.021] GetFileType (hFile=0x274) returned 0x1 [0042.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.021] GetFileType (hFile=0x274) returned 0x1 [0042.021] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9f16 [0042.021] ReadFile (in: hFile=0x274, lpBuffer=0x1b07be8, nNumberOfBytesToRead=0x9f16, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b07be8*, lpNumberOfBytesRead=0x2ae390*=0x9f16, lpOverlapped=0x0) returned 1 [0042.028] CloseHandle (hObject=0x274) returned 1 [0042.065] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.065] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.066] GetFileType (hFile=0x274) returned 0x1 [0042.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.066] GetFileType (hFile=0x274) returned 0x1 [0042.067] WriteFile (in: hFile=0x274, lpBuffer=0x19907ec*, nNumberOfBytesToWrite=0x9f20, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19907ec*, lpNumberOfBytesWritten=0x2ae384*=0x9f20, lpOverlapped=0x0) returned 1 [0042.068] CloseHandle (hObject=0x274) returned 1 [0042.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0042.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.069] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc017640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb803db30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9f20)) returned 1 [0042.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.anonymous")) returned 1 [0042.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.077] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.077] GetFileType (hFile=0x274) returned 0x1 [0042.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.077] GetFileType (hFile=0x274) returned 0x1 [0042.077] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1a8db [0042.078] ReadFile (in: hFile=0x274, lpBuffer=0x2bfdee8, nNumberOfBytesToRead=0x1a8db, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2bfdee8*, lpNumberOfBytesRead=0x2ae390*=0x1a8db, lpOverlapped=0x0) returned 1 [0042.084] CloseHandle (hObject=0x274) returned 1 [0042.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.100] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.102] GetFileType (hFile=0x274) returned 0x1 [0042.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.102] GetFileType (hFile=0x274) returned 0x1 [0042.102] WriteFile (in: hFile=0x274, lpBuffer=0x2c82b80*, nNumberOfBytesToWrite=0x1a8e0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c82b80*, lpNumberOfBytesWritten=0x2ae384*=0x1a8e0, lpOverlapped=0x0) returned 1 [0042.105] CloseHandle (hObject=0x274) returned 1 [0042.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0042.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.106] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbff14e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8089df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a8e0)) returned 1 [0042.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.anonymous")) returned 1 [0042.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0042.107] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP", lpFilePart=0x0) returned 0x49 [0042.107] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\", lpFilePart=0x0) returned 0x4a [0042.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0042.107] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.107] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.107] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.107] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.108] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0042.108] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0042.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0042.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0042.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0042.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP", lpFilePart=0x0) returned 0x49 [0042.108] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\", lpFilePart=0x0) returned 0x4a [0042.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0042.108] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.108] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.108] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.108] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.109] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0042.109] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0042.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0042.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0042.109] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.109] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.109] GetFileType (hFile=0x274) returned 0x1 [0042.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.109] GetFileType (hFile=0x274) returned 0x1 [0042.109] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xcdd8 [0042.109] ReadFile (in: hFile=0x274, lpBuffer=0x19ea2f0, nNumberOfBytesToRead=0xcdd8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19ea2f0*, lpNumberOfBytesRead=0x2ae390*=0xcdd8, lpOverlapped=0x0) returned 1 [0042.117] CloseHandle (hObject=0x274) returned 1 [0042.131] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.131] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.132] GetFileType (hFile=0x274) returned 0x1 [0042.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.132] GetFileType (hFile=0x274) returned 0x1 [0042.132] WriteFile (in: hFile=0x274, lpBuffer=0x1a5da8c*, nNumberOfBytesToWrite=0xcde0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a5da8c*, lpNumberOfBytesWritten=0x2ae384*=0xcde0, lpOverlapped=0x0) returned 1 [0042.134] CloseHandle (hObject=0x274) returned 1 [0042.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0042.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.135] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc0afbc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb80d60b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcde0)) returned 1 [0042.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf.anonymous")) returned 1 [0042.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.135] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.136] GetFileType (hFile=0x274) returned 0x1 [0042.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.136] GetFileType (hFile=0x274) returned 0x1 [0042.136] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x8c96 [0042.136] ReadFile (in: hFile=0x274, lpBuffer=0x1a6ad54, nNumberOfBytesToRead=0x8c96, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a6ad54*, lpNumberOfBytesRead=0x2ae390*=0x8c96, lpOverlapped=0x0) returned 1 [0042.144] CloseHandle (hObject=0x274) returned 1 [0042.156] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.156] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.157] GetFileType (hFile=0x274) returned 0x1 [0042.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.157] GetFileType (hFile=0x274) returned 0x1 [0042.158] WriteFile (in: hFile=0x274, lpBuffer=0x1ae3a60*, nNumberOfBytesToWrite=0x8ca0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ae3a60*, lpNumberOfBytesWritten=0x2ae384*=0x8ca0, lpOverlapped=0x0) returned 1 [0042.159] CloseHandle (hObject=0x274) returned 1 [0042.159] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.160] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0042.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.160] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc0afbc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8122370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8ca0)) returned 1 [0042.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf.anonymous")) returned 1 [0042.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.167] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.167] GetFileType (hFile=0x274) returned 0x1 [0042.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.167] GetFileType (hFile=0x274) returned 0x1 [0042.167] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9a88d [0042.170] ReadFile (in: hFile=0x274, lpBuffer=0x2cb7040, nNumberOfBytesToRead=0x9a88d, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2cb7040*, lpNumberOfBytesRead=0x2ae390*=0x9a88d, lpOverlapped=0x0) returned 1 [0042.191] CloseHandle (hObject=0x274) returned 1 [0042.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.263] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.270] GetFileType (hFile=0x274) returned 0x1 [0042.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.271] GetFileType (hFile=0x274) returned 0x1 [0042.271] WriteFile (in: hFile=0x274, lpBuffer=0x2d518f0*, nNumberOfBytesToWrite=0x9a890, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2d518f0*, lpNumberOfBytesWritten=0x2ae384*=0x9a890, lpOverlapped=0x0) returned 1 [0042.283] CloseHandle (hObject=0x274) returned 1 [0042.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0042.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.287] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc0afbc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8252e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a890)) returned 1 [0042.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf.anonymous")) returned 1 [0042.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0042.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ", lpFilePart=0x0) returned 0x49 [0042.288] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", lpFilePart=0x0) returned 0x4a [0042.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0042.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.307] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.307] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.307] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.307] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.307] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0042.307] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0042.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0042.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0042.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0042.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ", lpFilePart=0x0) returned 0x49 [0042.308] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", lpFilePart=0x0) returned 0x4a [0042.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0042.309] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.309] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.310] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.310] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.310] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.310] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.310] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.310] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0042.310] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0042.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0042.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0042.311] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.311] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.313] GetFileType (hFile=0x274) returned 0x1 [0042.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.313] GetFileType (hFile=0x274) returned 0x1 [0042.313] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xcdd8 [0042.313] ReadFile (in: hFile=0x274, lpBuffer=0x194bd80, nNumberOfBytesToRead=0xcdd8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x194bd80*, lpNumberOfBytesRead=0x2ae390*=0xcdd8, lpOverlapped=0x0) returned 1 [0042.315] CloseHandle (hObject=0x274) returned 1 [0042.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.400] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.401] GetFileType (hFile=0x274) returned 0x1 [0042.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.402] GetFileType (hFile=0x274) returned 0x1 [0042.402] WriteFile (in: hFile=0x274, lpBuffer=0x199096c*, nNumberOfBytesToWrite=0xcde0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x199096c*, lpNumberOfBytesWritten=0x2ae384*=0xcde0, lpOverlapped=0x0) returned 1 [0042.403] CloseHandle (hObject=0x274) returned 1 [0042.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0042.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.404] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd453140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb835d810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcde0)) returned 1 [0042.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf.anonymous")) returned 1 [0042.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0042.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.405] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.405] GetFileType (hFile=0x274) returned 0x1 [0042.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.405] GetFileType (hFile=0x274) returned 0x1 [0042.405] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x892d [0042.405] ReadFile (in: hFile=0x274, lpBuffer=0x199dc24, nNumberOfBytesToRead=0x892d, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x199dc24*, lpNumberOfBytesRead=0x2ae390*=0x892d, lpOverlapped=0x0) returned 1 [0042.414] CloseHandle (hObject=0x274) returned 1 [0042.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0042.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.427] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.429] GetFileType (hFile=0x274) returned 0x1 [0042.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.429] GetFileType (hFile=0x274) returned 0x1 [0042.429] WriteFile (in: hFile=0x274, lpBuffer=0x1a1595c*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a1595c*, lpNumberOfBytesWritten=0x2ae384*=0x8930, lpOverlapped=0x0) returned 1 [0042.431] CloseHandle (hObject=0x274) returned 1 [0042.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0042.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0042.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.431] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd453140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb83a9ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8930)) returned 1 [0042.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf.anonymous")) returned 1 [0042.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0042.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.432] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.432] GetFileType (hFile=0x274) returned 0x1 [0042.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.432] GetFileType (hFile=0x274) returned 0x1 [0042.432] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xc084 [0042.432] ReadFile (in: hFile=0x274, lpBuffer=0x1a1e760, nNumberOfBytesToRead=0xc084, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a1e760*, lpNumberOfBytesRead=0x2ae390*=0xc084, lpOverlapped=0x0) returned 1 [0042.436] CloseHandle (hObject=0x274) returned 1 [0042.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0042.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.452] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.454] GetFileType (hFile=0x274) returned 0x1 [0042.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.454] GetFileType (hFile=0x274) returned 0x1 [0042.454] WriteFile (in: hFile=0x274, lpBuffer=0x1a8f70c*, nNumberOfBytesToWrite=0xc090, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a8f70c*, lpNumberOfBytesWritten=0x2ae384*=0xc090, lpOverlapped=0x0) returned 1 [0042.456] CloseHandle (hObject=0x274) returned 1 [0042.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0042.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0042.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd453140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb83f5d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc090)) returned 1 [0042.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf.anonymous")) returned 1 [0042.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.457] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.457] GetFileType (hFile=0x274) returned 0x1 [0042.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.457] GetFileType (hFile=0x274) returned 0x1 [0042.457] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x8c96 [0042.457] ReadFile (in: hFile=0x274, lpBuffer=0x1a9bc98, nNumberOfBytesToRead=0x8c96, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a9bc98*, lpNumberOfBytesRead=0x2ae390*=0x8c96, lpOverlapped=0x0) returned 1 [0042.467] CloseHandle (hObject=0x274) returned 1 [0042.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.480] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.482] GetFileType (hFile=0x274) returned 0x1 [0042.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.482] GetFileType (hFile=0x274) returned 0x1 [0042.482] WriteFile (in: hFile=0x274, lpBuffer=0x1b149a4*, nNumberOfBytesToWrite=0x8ca0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b149a4*, lpNumberOfBytesWritten=0x2ae384*=0x8ca0, lpOverlapped=0x0) returned 1 [0042.483] CloseHandle (hObject=0x274) returned 1 [0042.484] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.484] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0042.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.484] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd61c1c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb841bef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8ca0)) returned 1 [0042.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf.anonymous")) returned 1 [0042.484] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0042.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.484] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.485] GetFileType (hFile=0x274) returned 0x1 [0042.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.485] GetFileType (hFile=0x274) returned 0x1 [0042.485] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2eb9e [0042.486] ReadFile (in: hFile=0x274, lpBuffer=0x29bf048, nNumberOfBytesToRead=0x2eb9e, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x29bf048*, lpNumberOfBytesRead=0x2ae390*=0x2eb9e, lpOverlapped=0x0) returned 1 [0042.499] CloseHandle (hObject=0x274) returned 1 [0042.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0042.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.544] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.546] GetFileType (hFile=0x274) returned 0x1 [0042.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.547] GetFileType (hFile=0x274) returned 0x1 [0042.547] WriteFile (in: hFile=0x274, lpBuffer=0x2ad4640*, nNumberOfBytesToWrite=0x2eba0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2ad4640*, lpNumberOfBytesWritten=0x2ae384*=0x2eba0, lpOverlapped=0x0) returned 1 [0042.551] CloseHandle (hObject=0x274) returned 1 [0042.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0042.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0042.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd406e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb84da5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2eba0)) returned 1 [0042.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf.anonymous")) returned 1 [0042.553] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.553] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.553] GetFileType (hFile=0x274) returned 0x1 [0042.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.554] GetFileType (hFile=0x274) returned 0x1 [0042.554] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9a88d [0042.555] ReadFile (in: hFile=0x274, lpBuffer=0x2b03200, nNumberOfBytesToRead=0x9a88d, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b03200*, lpNumberOfBytesRead=0x2ae390*=0x9a88d, lpOverlapped=0x0) returned 1 [0042.581] CloseHandle (hObject=0x274) returned 1 [0042.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.630] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.637] GetFileType (hFile=0x274) returned 0x1 [0042.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.638] GetFileType (hFile=0x274) returned 0x1 [0042.638] WriteFile (in: hFile=0x274, lpBuffer=0x2a197a0*, nNumberOfBytesToWrite=0x9a890, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesWritten=0x2ae384*=0x9a890, lpOverlapped=0x0) returned 1 [0042.649] CloseHandle (hObject=0x274) returned 1 [0042.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0042.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329cbb00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdd5f6060, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb85bee10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a890)) returned 1 [0042.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf.anonymous")) returned 1 [0042.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0042.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA", lpFilePart=0x0) returned 0x49 [0042.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\", lpFilePart=0x0) returned 0x4a [0042.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0042.661] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0042.662] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0042.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0042.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0042.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0042.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA", lpFilePart=0x0) returned 0x49 [0042.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\", lpFilePart=0x0) returned 0x4a [0042.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0042.662] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0042.663] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0042.663] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0042.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0042.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0042.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.663] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.664] GetFileType (hFile=0x274) returned 0x1 [0042.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.664] GetFileType (hFile=0x274) returned 0x1 [0042.664] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x30eb7 [0042.665] ReadFile (in: hFile=0x274, lpBuffer=0x2ab4050, nNumberOfBytesToRead=0x30eb7, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2ab4050*, lpNumberOfBytesRead=0x2ae390*=0x30eb7, lpOverlapped=0x0) returned 1 [0042.753] CloseHandle (hObject=0x274) returned 1 [0042.794] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.794] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.796] GetFileType (hFile=0x274) returned 0x1 [0042.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.796] GetFileType (hFile=0x274) returned 0x1 [0042.796] WriteFile (in: hFile=0x274, lpBuffer=0x2bff830*, nNumberOfBytesToWrite=0x30ec0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bff830*, lpNumberOfBytesWritten=0x2ae384*=0x30ec0, lpOverlapped=0x0) returned 1 [0042.800] CloseHandle (hObject=0x274) returned 1 [0042.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0042.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0042.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfa5220, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb873bbd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30ec0)) returned 1 [0042.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf.anonymous")) returned 1 [0042.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.803] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.804] GetFileType (hFile=0x274) returned 0x1 [0042.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.804] GetFileType (hFile=0x274) returned 0x1 [0042.804] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9d75 [0042.804] ReadFile (in: hFile=0x274, lpBuffer=0x1980b34, nNumberOfBytesToRead=0x9d75, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1980b34*, lpNumberOfBytesRead=0x2ae390*=0x9d75, lpOverlapped=0x0) returned 1 [0042.820] CloseHandle (hObject=0x274) returned 1 [0042.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.833] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.835] GetFileType (hFile=0x274) returned 0x1 [0042.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.835] GetFileType (hFile=0x274) returned 0x1 [0042.835] WriteFile (in: hFile=0x274, lpBuffer=0x19feca0*, nNumberOfBytesToWrite=0x9d80, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19feca0*, lpNumberOfBytesWritten=0x2ae384*=0x9d80, lpOverlapped=0x0) returned 1 [0042.836] CloseHandle (hObject=0x274) returned 1 [0042.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0042.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0042.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0042.837] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbf7f0c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8787e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9d80)) returned 1 [0042.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0042.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf.anonymous")) returned 1 [0042.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0042.864] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.865] GetFileType (hFile=0x274) returned 0x1 [0042.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0042.865] GetFileType (hFile=0x274) returned 0x1 [0042.865] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x44925 [0042.866] ReadFile (in: hFile=0x274, lpBuffer=0x2e07d10, nNumberOfBytesToRead=0x44925, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2e07d10*, lpNumberOfBytesRead=0x2ae390*=0x44925, lpOverlapped=0x0) returned 1 [0042.888] CloseHandle (hObject=0x274) returned 1 [0042.996] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0042.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0042.996] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0042.996] GetFileType (hFile=0x274) returned 0x1 [0042.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0042.996] GetFileType (hFile=0x274) returned 0x1 [0042.996] WriteFile (in: hFile=0x274, lpBuffer=0x2ae7340*, nNumberOfBytesToWrite=0x44930, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2ae7340*, lpNumberOfBytesWritten=0x2ae384*=0x44930, lpOverlapped=0x0) returned 1 [0043.003] CloseHandle (hObject=0x274) returned 1 [0043.005] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.005] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0043.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.005] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfa5220, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb892adb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x44930)) returned 1 [0043.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf.anonymous")) returned 1 [0043.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.006] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV", lpFilePart=0x0) returned 0x49 [0043.006] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", lpFilePart=0x0) returned 0x4a [0043.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0043.012] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.012] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.012] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.013] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.013] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.013] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.013] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.013] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.013] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0043.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.014] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV", lpFilePart=0x0) returned 0x49 [0043.014] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", lpFilePart=0x0) returned 0x4a [0043.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.016] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.017] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0043.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.018] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.018] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.019] GetFileType (hFile=0x274) returned 0x1 [0043.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.020] GetFileType (hFile=0x274) returned 0x1 [0043.020] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x21a02 [0043.020] ReadFile (in: hFile=0x274, lpBuffer=0x29d1ca8, nNumberOfBytesToRead=0x21a02, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x29d1ca8*, lpNumberOfBytesRead=0x2ae390*=0x21a02, lpOverlapped=0x0) returned 1 [0043.044] CloseHandle (hObject=0x274) returned 1 [0043.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.085] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.087] GetFileType (hFile=0x274) returned 0x1 [0043.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.087] GetFileType (hFile=0x274) returned 0x1 [0043.087] WriteFile (in: hFile=0x274, lpBuffer=0x2bb24f0*, nNumberOfBytesToWrite=0x21a10, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bb24f0*, lpNumberOfBytesWritten=0x2ae384*=0x21a10, lpOverlapped=0x0) returned 1 [0043.090] CloseHandle (hObject=0x274) returned 1 [0043.092] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.092] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0043.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.092] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb89e9490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21a10)) returned 1 [0043.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf.anonymous")) returned 1 [0043.093] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0043.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.093] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.093] GetFileType (hFile=0x274) returned 0x1 [0043.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.093] GetFileType (hFile=0x274) returned 0x1 [0043.093] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0043.093] ReadFile (in: hFile=0x274, lpBuffer=0x1981bf8, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1981bf8*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0043.102] CloseHandle (hObject=0x274) returned 1 [0043.115] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0043.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.115] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.116] GetFileType (hFile=0x274) returned 0x1 [0043.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.116] GetFileType (hFile=0x274) returned 0x1 [0043.117] WriteFile (in: hFile=0x274, lpBuffer=0x19f7628*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19f7628*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0043.118] CloseHandle (hObject=0x274) returned 1 [0043.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0043.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0043.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.119] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfdc800, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8a35750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0043.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf.anonymous")) returned 1 [0043.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0043.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.120] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.120] GetFileType (hFile=0x274) returned 0x1 [0043.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.120] GetFileType (hFile=0x274) returned 0x1 [0043.120] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0043.120] ReadFile (in: hFile=0x274, lpBuffer=0x1a0954c, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a0954c*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0043.127] CloseHandle (hObject=0x274) returned 1 [0043.165] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0043.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.165] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.166] GetFileType (hFile=0x274) returned 0x1 [0043.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.166] GetFileType (hFile=0x274) returned 0x1 [0043.166] WriteFile (in: hFile=0x274, lpBuffer=0x19a04e8*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19a04e8*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0043.168] CloseHandle (hObject=0x274) returned 1 [0043.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0043.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8aa7b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0043.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf.anonymous")) returned 1 [0043.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.170] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.170] GetFileType (hFile=0x274) returned 0x1 [0043.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.170] GetFileType (hFile=0x274) returned 0x1 [0043.170] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb6cc [0043.170] ReadFile (in: hFile=0x274, lpBuffer=0x19ac124, nNumberOfBytesToRead=0xb6cc, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19ac124*, lpNumberOfBytesRead=0x2ae390*=0xb6cc, lpOverlapped=0x0) returned 1 [0043.172] CloseHandle (hObject=0x274) returned 1 [0043.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.185] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.187] GetFileType (hFile=0x274) returned 0x1 [0043.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.187] GetFileType (hFile=0x274) returned 0x1 [0043.187] WriteFile (in: hFile=0x274, lpBuffer=0x1a1b390*, nNumberOfBytesToWrite=0xb6d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a1b390*, lpNumberOfBytesWritten=0x2ae384*=0xb6d0, lpOverlapped=0x0) returned 1 [0043.189] CloseHandle (hObject=0x274) returned 1 [0043.189] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.189] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.190] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8af3e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb6d0)) returned 1 [0043.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf.anonymous")) returned 1 [0043.190] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0043.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.190] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.190] GetFileType (hFile=0x274) returned 0x1 [0043.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.190] GetFileType (hFile=0x274) returned 0x1 [0043.191] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0043.191] ReadFile (in: hFile=0x274, lpBuffer=0x2c01b40, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c01b40*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0043.193] CloseHandle (hObject=0x274) returned 1 [0043.210] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0043.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.210] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.212] GetFileType (hFile=0x274) returned 0x1 [0043.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.212] GetFileType (hFile=0x274) returned 0x1 [0043.212] WriteFile (in: hFile=0x274, lpBuffer=0x2c8f478*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c8f478*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0043.220] CloseHandle (hObject=0x274) returned 1 [0043.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0043.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.221] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8b400f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0043.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf.anonymous")) returned 1 [0043.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.222] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.222] GetFileType (hFile=0x274) returned 0x1 [0043.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.222] GetFileType (hFile=0x274) returned 0x1 [0043.222] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1b7c1 [0043.223] ReadFile (in: hFile=0x274, lpBuffer=0x2cab998, nNumberOfBytesToRead=0x1b7c1, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2cab998*, lpNumberOfBytesRead=0x2ae390*=0x1b7c1, lpOverlapped=0x0) returned 1 [0043.236] CloseHandle (hObject=0x274) returned 1 [0043.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.260] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.262] GetFileType (hFile=0x274) returned 0x1 [0043.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.262] GetFileType (hFile=0x274) returned 0x1 [0043.262] WriteFile (in: hFile=0x274, lpBuffer=0x2a197a0*, nNumberOfBytesToWrite=0x1b7d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesWritten=0x2ae384*=0x1b7d0, lpOverlapped=0x0) returned 1 [0043.265] CloseHandle (hObject=0x274) returned 1 [0043.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0043.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.267] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8bb2510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b7d0)) returned 1 [0043.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf.anonymous")) returned 1 [0043.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN", lpFilePart=0x0) returned 0x49 [0043.267] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", lpFilePart=0x0) returned 0x4a [0043.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0043.277] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.278] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.278] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0043.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.279] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN", lpFilePart=0x0) returned 0x49 [0043.279] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", lpFilePart=0x0) returned 0x4a [0043.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.281] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.282] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.282] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0043.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.283] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.284] GetFileType (hFile=0x274) returned 0x1 [0043.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.284] GetFileType (hFile=0x274) returned 0x1 [0043.284] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xbb3e [0043.284] ReadFile (in: hFile=0x274, lpBuffer=0x1934218, nNumberOfBytesToRead=0xbb3e, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1934218*, lpNumberOfBytesRead=0x2ae390*=0xbb3e, lpOverlapped=0x0) returned 1 [0043.292] CloseHandle (hObject=0x274) returned 1 [0043.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.329] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.330] GetFileType (hFile=0x274) returned 0x1 [0043.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.330] GetFileType (hFile=0x274) returned 0x1 [0043.330] WriteFile (in: hFile=0x274, lpBuffer=0x19a4334*, nNumberOfBytesToWrite=0xbb40, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19a4334*, lpNumberOfBytesWritten=0x2ae384*=0xbb40, lpOverlapped=0x0) returned 1 [0043.332] CloseHandle (hObject=0x274) returned 1 [0043.333] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.333] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0043.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.333] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf90540, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8c4aa90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbb40)) returned 1 [0043.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf.anonymous")) returned 1 [0043.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0043.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.334] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.334] GetFileType (hFile=0x274) returned 0x1 [0043.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.334] GetFileType (hFile=0x274) returned 0x1 [0043.334] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0043.334] ReadFile (in: hFile=0x274, lpBuffer=0x19b034c, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19b034c*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0043.342] CloseHandle (hObject=0x274) returned 1 [0043.355] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0043.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.355] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.356] GetFileType (hFile=0x274) returned 0x1 [0043.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.356] GetFileType (hFile=0x274) returned 0x1 [0043.356] WriteFile (in: hFile=0x274, lpBuffer=0x1a25638*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a25638*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0043.358] CloseHandle (hObject=0x274) returned 1 [0043.358] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0043.358] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0043.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.358] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8c96d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0043.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf.anonymous")) returned 1 [0043.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0043.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.359] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.359] GetFileType (hFile=0x274) returned 0x1 [0043.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.359] GetFileType (hFile=0x274) returned 0x1 [0043.359] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0043.359] ReadFile (in: hFile=0x274, lpBuffer=0x1a2dc0c, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a2dc0c*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0043.361] CloseHandle (hObject=0x274) returned 1 [0043.373] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0043.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.374] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.375] GetFileType (hFile=0x274) returned 0x1 [0043.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.375] GetFileType (hFile=0x274) returned 0x1 [0043.375] WriteFile (in: hFile=0x274, lpBuffer=0x1a9cfcc*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a9cfcc*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0043.377] CloseHandle (hObject=0x274) returned 1 [0043.377] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0043.377] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8cbceb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0043.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf.anonymous")) returned 1 [0043.378] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.378] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.378] GetFileType (hFile=0x274) returned 0x1 [0043.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.378] GetFileType (hFile=0x274) returned 0x1 [0043.379] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9083 [0043.379] ReadFile (in: hFile=0x274, lpBuffer=0x1aa8c08, nNumberOfBytesToRead=0x9083, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aa8c08*, lpNumberOfBytesRead=0x2ae390*=0x9083, lpOverlapped=0x0) returned 1 [0043.403] CloseHandle (hObject=0x274) returned 1 [0043.415] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.415] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.417] GetFileType (hFile=0x274) returned 0x1 [0043.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.417] GetFileType (hFile=0x274) returned 0x1 [0043.417] WriteFile (in: hFile=0x274, lpBuffer=0x1b22cc4*, nNumberOfBytesToWrite=0x9090, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b22cc4*, lpNumberOfBytesWritten=0x2ae384*=0x9090, lpOverlapped=0x0) returned 1 [0043.419] CloseHandle (hObject=0x274) returned 1 [0043.419] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.420] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.420] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf90540, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8d09170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9090)) returned 1 [0043.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf.anonymous")) returned 1 [0043.420] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0043.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.420] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.421] GetFileType (hFile=0x274) returned 0x1 [0043.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.421] GetFileType (hFile=0x274) returned 0x1 [0043.421] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0043.421] ReadFile (in: hFile=0x274, lpBuffer=0x2a63490, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a63490*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0043.430] CloseHandle (hObject=0x274) returned 1 [0043.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0043.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.468] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.470] GetFileType (hFile=0x274) returned 0x1 [0043.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.470] GetFileType (hFile=0x274) returned 0x1 [0043.470] WriteFile (in: hFile=0x274, lpBuffer=0x2af0dc8*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2af0dc8*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0043.473] CloseHandle (hObject=0x274) returned 1 [0043.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0043.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.474] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf90540, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8da16f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0043.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf.anonymous")) returned 1 [0043.475] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.475] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.475] GetFileType (hFile=0x274) returned 0x1 [0043.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.475] GetFileType (hFile=0x274) returned 0x1 [0043.475] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x17b14 [0043.475] ReadFile (in: hFile=0x274, lpBuffer=0x2b0d2e8, nNumberOfBytesToRead=0x17b14, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b0d2e8*, lpNumberOfBytesRead=0x2ae390*=0x17b14, lpOverlapped=0x0) returned 1 [0043.485] CloseHandle (hObject=0x274) returned 1 [0043.499] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.499] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.501] GetFileType (hFile=0x274) returned 0x1 [0043.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.501] GetFileType (hFile=0x274) returned 0x1 [0043.501] WriteFile (in: hFile=0x274, lpBuffer=0x2b83ab8*, nNumberOfBytesToWrite=0x17b20, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b83ab8*, lpNumberOfBytesWritten=0x2ae384*=0x17b20, lpOverlapped=0x0) returned 1 [0043.503] CloseHandle (hObject=0x274) returned 1 [0043.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0043.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcfb66a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8ded9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17b20)) returned 1 [0043.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf.anonymous")) returned 1 [0043.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA", lpFilePart=0x0) returned 0x49 [0043.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", lpFilePart=0x0) returned 0x4a [0043.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb18 [0043.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.506] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0043.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA", lpFilePart=0x0) returned 0x49 [0043.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", lpFilePart=0x0) returned 0x4a [0043.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb18 [0043.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.507] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0043.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.508] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.508] GetFileType (hFile=0x274) returned 0x1 [0043.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.508] GetFileType (hFile=0x274) returned 0x1 [0043.508] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xca88 [0043.508] ReadFile (in: hFile=0x274, lpBuffer=0x19c9570, nNumberOfBytesToRead=0xca88, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19c9570*, lpNumberOfBytesRead=0x2ae390*=0xca88, lpOverlapped=0x0) returned 1 [0043.517] CloseHandle (hObject=0x274) returned 1 [0043.529] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.530] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.531] GetFileType (hFile=0x274) returned 0x1 [0043.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.531] GetFileType (hFile=0x274) returned 0x1 [0043.531] WriteFile (in: hFile=0x274, lpBuffer=0x1a3c31c*, nNumberOfBytesToWrite=0xca90, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a3c31c*, lpNumberOfBytesWritten=0x2ae384*=0xca90, lpOverlapped=0x0) returned 1 [0043.533] CloseHandle (hObject=0x274) returned 1 [0043.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0043.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.534] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbff14e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8e39c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xca90)) returned 1 [0043.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf.anonymous")) returned 1 [0043.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.535] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.535] GetFileType (hFile=0x274) returned 0x1 [0043.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.535] GetFileType (hFile=0x274) returned 0x1 [0043.535] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x8ff9 [0043.535] ReadFile (in: hFile=0x274, lpBuffer=0x1a49294, nNumberOfBytesToRead=0x8ff9, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a49294*, lpNumberOfBytesRead=0x2ae390*=0x8ff9, lpOverlapped=0x0) returned 1 [0043.546] CloseHandle (hObject=0x274) returned 1 [0043.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.559] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.561] GetFileType (hFile=0x274) returned 0x1 [0043.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.561] GetFileType (hFile=0x274) returned 0x1 [0043.561] WriteFile (in: hFile=0x274, lpBuffer=0x1ac3080*, nNumberOfBytesToWrite=0x9000, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ac3080*, lpNumberOfBytesWritten=0x2ae384*=0x9000, lpOverlapped=0x0) returned 1 [0043.562] CloseHandle (hObject=0x274) returned 1 [0043.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.563] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbff14e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8e85f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1 [0043.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf.anonymous")) returned 1 [0043.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.581] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.581] GetFileType (hFile=0x274) returned 0x1 [0043.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.581] GetFileType (hFile=0x274) returned 0x1 [0043.581] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x18575 [0043.581] ReadFile (in: hFile=0x274, lpBuffer=0x2bb4b18, nNumberOfBytesToRead=0x18575, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2bb4b18*, lpNumberOfBytesRead=0x2ae390*=0x18575, lpOverlapped=0x0) returned 1 [0043.591] CloseHandle (hObject=0x274) returned 1 [0043.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.604] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.606] GetFileType (hFile=0x274) returned 0x1 [0043.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.606] GetFileType (hFile=0x274) returned 0x1 [0043.606] WriteFile (in: hFile=0x274, lpBuffer=0x2c2e6d0*, nNumberOfBytesToWrite=0x18580, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c2e6d0*, lpNumberOfBytesWritten=0x2ae384*=0x18580, lpOverlapped=0x0) returned 1 [0043.609] CloseHandle (hObject=0x274) returned 1 [0043.610] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.610] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0043.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.610] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbff14e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8ef8350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18580)) returned 1 [0043.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf.anonymous")) returned 1 [0043.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.611] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN", lpFilePart=0x0) returned 0x49 [0043.611] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\", lpFilePart=0x0) returned 0x4a [0043.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0043.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.613] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0043.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.613] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN", lpFilePart=0x0) returned 0x49 [0043.613] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\", lpFilePart=0x0) returned 0x4a [0043.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0043.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.614] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.614] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0043.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.614] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.614] GetFileType (hFile=0x274) returned 0x1 [0043.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.614] GetFileType (hFile=0x274) returned 0x1 [0043.615] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xcc2c [0043.615] ReadFile (in: hFile=0x274, lpBuffer=0x1b1be7c, nNumberOfBytesToRead=0xcc2c, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b1be7c*, lpNumberOfBytesRead=0x2ae390*=0xcc2c, lpOverlapped=0x0) returned 1 [0043.636] CloseHandle (hObject=0x274) returned 1 [0043.673] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.673] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.674] GetFileType (hFile=0x274) returned 0x1 [0043.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.674] GetFileType (hFile=0x274) returned 0x1 [0043.675] WriteFile (in: hFile=0x274, lpBuffer=0x199c57c*, nNumberOfBytesToWrite=0xcc30, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x199c57c*, lpNumberOfBytesWritten=0x2ae384*=0xcc30, lpOverlapped=0x0) returned 1 [0043.676] CloseHandle (hObject=0x274) returned 1 [0043.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0043.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.677] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc03d7a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb8f908d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcc30)) returned 1 [0043.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf.anonymous")) returned 1 [0043.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0043.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.699] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.699] GetFileType (hFile=0x274) returned 0x1 [0043.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.699] GetFileType (hFile=0x274) returned 0x1 [0043.699] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xffc9 [0043.699] ReadFile (in: hFile=0x274, lpBuffer=0x19a9684, nNumberOfBytesToRead=0xffc9, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19a9684*, lpNumberOfBytesRead=0x2ae390*=0xffc9, lpOverlapped=0x0) returned 1 [0043.706] CloseHandle (hObject=0x274) returned 1 [0043.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0043.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.719] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.721] GetFileType (hFile=0x274) returned 0x1 [0043.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.721] GetFileType (hFile=0x274) returned 0x1 [0043.721] WriteFile (in: hFile=0x274, lpBuffer=0x1a26550*, nNumberOfBytesToWrite=0xffd0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a26550*, lpNumberOfBytesWritten=0x2ae384*=0xffd0, lpOverlapped=0x0) returned 1 [0043.723] CloseHandle (hObject=0x274) returned 1 [0043.724] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0043.724] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0043.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.724] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc03d7a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9002cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xffd0)) returned 1 [0043.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf.anonymous")) returned 1 [0043.725] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.725] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.725] GetFileType (hFile=0x274) returned 0x1 [0043.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.725] GetFileType (hFile=0x274) returned 0x1 [0043.725] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa447 [0043.725] ReadFile (in: hFile=0x274, lpBuffer=0x1a369f4, nNumberOfBytesToRead=0xa447, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a369f4*, lpNumberOfBytesRead=0x2ae390*=0xa447, lpOverlapped=0x0) returned 1 [0043.730] CloseHandle (hObject=0x274) returned 1 [0043.743] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.743] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.745] GetFileType (hFile=0x274) returned 0x1 [0043.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.745] GetFileType (hFile=0x274) returned 0x1 [0043.745] WriteFile (in: hFile=0x274, lpBuffer=0x1ab6d70*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ab6d70*, lpNumberOfBytesWritten=0x2ae384*=0xa450, lpOverlapped=0x0) returned 1 [0043.746] CloseHandle (hObject=0x274) returned 1 [0043.747] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.748] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc03d7a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9028e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa450)) returned 1 [0043.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf.anonymous")) returned 1 [0043.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.749] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.749] GetFileType (hFile=0x274) returned 0x1 [0043.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.749] GetFileType (hFile=0x274) returned 0x1 [0043.749] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c005 [0043.749] ReadFile (in: hFile=0x274, lpBuffer=0x2c80470, nNumberOfBytesToRead=0x1c005, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c80470*, lpNumberOfBytesRead=0x2ae390*=0x1c005, lpOverlapped=0x0) returned 1 [0043.759] CloseHandle (hObject=0x274) returned 1 [0043.776] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.777] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.779] GetFileType (hFile=0x274) returned 0x1 [0043.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.779] GetFileType (hFile=0x274) returned 0x1 [0043.779] WriteFile (in: hFile=0x274, lpBuffer=0x29c5388*, nNumberOfBytesToWrite=0x1c010, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x29c5388*, lpNumberOfBytesWritten=0x2ae384*=0x1c010, lpOverlapped=0x0) returned 1 [0043.782] CloseHandle (hObject=0x274) returned 1 [0043.783] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.783] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0043.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.783] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc03d7a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb909b270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c010)) returned 1 [0043.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf.anonymous")) returned 1 [0043.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.784] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR", lpFilePart=0x0) returned 0x49 [0043.784] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", lpFilePart=0x0) returned 0x4a [0043.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0043.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.785] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0043.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0043.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR", lpFilePart=0x0) returned 0x49 [0043.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", lpFilePart=0x0) returned 0x4a [0043.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0043.786] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.786] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.786] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.786] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.786] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0043.786] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0043.787] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0043.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0043.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0043.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.787] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.787] GetFileType (hFile=0x274) returned 0x1 [0043.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.787] GetFileType (hFile=0x274) returned 0x1 [0043.787] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x12b04 [0043.787] ReadFile (in: hFile=0x274, lpBuffer=0x193398c, nNumberOfBytesToRead=0x12b04, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x193398c*, lpNumberOfBytesRead=0x2ae390*=0x12b04, lpOverlapped=0x0) returned 1 [0043.806] CloseHandle (hObject=0x274) returned 1 [0043.843] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.843] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.845] GetFileType (hFile=0x274) returned 0x1 [0043.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.845] GetFileType (hFile=0x274) returned 0x1 [0043.845] WriteFile (in: hFile=0x274, lpBuffer=0x19b8a14*, nNumberOfBytesToWrite=0x12b10, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19b8a14*, lpNumberOfBytesWritten=0x2ae384*=0x12b10, lpOverlapped=0x0) returned 1 [0043.847] CloseHandle (hObject=0x274) returned 1 [0043.848] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0043.848] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0043.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.848] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc03d7a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb91337f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12b10)) returned 1 [0043.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf.anonymous")) returned 1 [0043.850] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0043.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.850] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.850] GetFileType (hFile=0x274) returned 0x1 [0043.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.851] GetFileType (hFile=0x274) returned 0x1 [0043.851] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xeac1 [0043.851] ReadFile (in: hFile=0x274, lpBuffer=0x19cb9fc, nNumberOfBytesToRead=0xeac1, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19cb9fc*, lpNumberOfBytesRead=0x2ae390*=0xeac1, lpOverlapped=0x0) returned 1 [0043.867] CloseHandle (hObject=0x274) returned 1 [0043.886] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0043.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.886] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.888] GetFileType (hFile=0x274) returned 0x1 [0043.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.888] GetFileType (hFile=0x274) returned 0x1 [0043.888] WriteFile (in: hFile=0x274, lpBuffer=0x1a4486c*, nNumberOfBytesToWrite=0xead0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a4486c*, lpNumberOfBytesWritten=0x2ae384*=0xead0, lpOverlapped=0x0) returned 1 [0043.890] CloseHandle (hObject=0x274) returned 1 [0043.891] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf", lpFilePart=0x0) returned 0x53 [0043.891] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0043.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.891] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc03d7a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb91a5c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xead0)) returned 1 [0043.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf.anonymous")) returned 1 [0043.892] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.892] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.893] GetFileType (hFile=0x274) returned 0x1 [0043.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.893] GetFileType (hFile=0x274) returned 0x1 [0043.893] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xd074 [0043.893] ReadFile (in: hFile=0x274, lpBuffer=0x1a53810, nNumberOfBytesToRead=0xd074, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a53810*, lpNumberOfBytesRead=0x2ae390*=0xd074, lpOverlapped=0x0) returned 1 [0043.895] CloseHandle (hObject=0x274) returned 1 [0043.908] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0043.908] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.909] GetFileType (hFile=0x274) returned 0x1 [0043.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0043.909] GetFileType (hFile=0x274) returned 0x1 [0043.909] WriteFile (in: hFile=0x274, lpBuffer=0x1ac778c*, nNumberOfBytesToWrite=0xd080, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ac778c*, lpNumberOfBytesWritten=0x2ae384*=0xd080, lpOverlapped=0x0) returned 1 [0043.911] CloseHandle (hObject=0x274) returned 1 [0043.912] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0043.912] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0043.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0043.912] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc063900, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb91cbd70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd080)) returned 1 [0043.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0043.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf.anonymous")) returned 1 [0043.913] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0043.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0043.913] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0043.913] GetFileType (hFile=0x274) returned 0x1 [0043.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0043.913] GetFileType (hFile=0x274) returned 0x1 [0043.914] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x24f7f [0043.914] ReadFile (in: hFile=0x274, lpBuffer=0x2a58ec0, nNumberOfBytesToRead=0x24f7f, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a58ec0*, lpNumberOfBytesRead=0x2ae390*=0x24f7f, lpOverlapped=0x0) returned 1 [0043.988] CloseHandle (hObject=0x274) returned 1 [0044.004] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.004] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.006] GetFileType (hFile=0x274) returned 0x1 [0044.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.006] GetFileType (hFile=0x274) returned 0x1 [0044.006] WriteFile (in: hFile=0x274, lpBuffer=0x2b11c80*, nNumberOfBytesToWrite=0x24f80, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b11c80*, lpNumberOfBytesWritten=0x2ae384*=0x24f80, lpOverlapped=0x0) returned 1 [0044.010] CloseHandle (hObject=0x274) returned 1 [0044.012] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.012] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0044.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.012] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc063900, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb92b05b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24f80)) returned 1 [0044.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf.anonymous")) returned 1 [0044.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.013] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD", lpFilePart=0x0) returned 0x49 [0044.013] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpFilePart=0x0) returned 0x4a [0044.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0044.013] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.013] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.013] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.013] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.014] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.014] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0044.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.014] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD", lpFilePart=0x0) returned 0x49 [0044.014] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpFilePart=0x0) returned 0x4a [0044.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0044.014] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.014] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.014] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.015] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.015] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.015] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0044.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.015] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.015] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.015] GetFileType (hFile=0x274) returned 0x1 [0044.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.015] GetFileType (hFile=0x274) returned 0x1 [0044.015] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xff3a [0044.015] ReadFile (in: hFile=0x274, lpBuffer=0x1b24290, nNumberOfBytesToRead=0xff3a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b24290*, lpNumberOfBytesRead=0x2ae390*=0xff3a, lpOverlapped=0x0) returned 1 [0044.053] CloseHandle (hObject=0x274) returned 1 [0044.093] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.093] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.095] GetFileType (hFile=0x274) returned 0x1 [0044.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.095] GetFileType (hFile=0x274) returned 0x1 [0044.095] WriteFile (in: hFile=0x274, lpBuffer=0x19adae4*, nNumberOfBytesToWrite=0xff40, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19adae4*, lpNumberOfBytesWritten=0x2ae384*=0xff40, lpOverlapped=0x0) returned 1 [0044.097] CloseHandle (hObject=0x274) returned 1 [0044.098] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.098] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0044.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.098] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfa5220, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9394df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xff40)) returned 1 [0044.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf.anonymous")) returned 1 [0044.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.099] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.099] GetFileType (hFile=0x274) returned 0x1 [0044.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.099] GetFileType (hFile=0x274) returned 0x1 [0044.099] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9542 [0044.100] ReadFile (in: hFile=0x274, lpBuffer=0x19bdf0c, nNumberOfBytesToRead=0x9542, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19bdf0c*, lpNumberOfBytesRead=0x2ae390*=0x9542, lpOverlapped=0x0) returned 1 [0044.115] CloseHandle (hObject=0x274) returned 1 [0044.129] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.129] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.130] GetFileType (hFile=0x274) returned 0x1 [0044.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.130] GetFileType (hFile=0x274) returned 0x1 [0044.130] WriteFile (in: hFile=0x274, lpBuffer=0x1a398e4*, nNumberOfBytesToWrite=0x9550, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a398e4*, lpNumberOfBytesWritten=0x2ae384*=0x9550, lpOverlapped=0x0) returned 1 [0044.132] CloseHandle (hObject=0x274) returned 1 [0044.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0044.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.133] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfcb380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb93e10b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9550)) returned 1 [0044.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf.anonymous")) returned 1 [0044.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.136] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.136] GetFileType (hFile=0x274) returned 0x1 [0044.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.136] GetFileType (hFile=0x274) returned 0x1 [0044.136] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x180e0 [0044.136] ReadFile (in: hFile=0x274, lpBuffer=0x2b56aa0, nNumberOfBytesToRead=0x180e0, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b56aa0*, lpNumberOfBytesRead=0x2ae390*=0x180e0, lpOverlapped=0x0) returned 1 [0044.152] CloseHandle (hObject=0x274) returned 1 [0044.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.169] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.172] GetFileType (hFile=0x274) returned 0x1 [0044.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.172] GetFileType (hFile=0x274) returned 0x1 [0044.172] WriteFile (in: hFile=0x274, lpBuffer=0x2bcef80*, nNumberOfBytesToWrite=0x180f0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bcef80*, lpNumberOfBytesWritten=0x2ae384*=0x180f0, lpOverlapped=0x0) returned 1 [0044.176] CloseHandle (hObject=0x274) returned 1 [0044.178] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.178] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0044.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.178] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbfa5220, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb94534d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180f0)) returned 1 [0044.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf.anonymous")) returned 1 [0044.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR", lpFilePart=0x0) returned 0x49 [0044.179] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpFilePart=0x0) returned 0x4a [0044.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed18 [0044.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.180] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.180] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.180] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0044.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR", lpFilePart=0x0) returned 0x49 [0044.180] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpFilePart=0x0) returned 0x4a [0044.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed18 [0044.180] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.180] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.181] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.181] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.181] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.181] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0044.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.181] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.181] GetFileType (hFile=0x274) returned 0x1 [0044.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.181] GetFileType (hFile=0x274) returned 0x1 [0044.181] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xfbd7 [0044.181] ReadFile (in: hFile=0x274, lpBuffer=0x1a928c4, nNumberOfBytesToRead=0xfbd7, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a928c4*, lpNumberOfBytesRead=0x2ae390*=0xfbd7, lpOverlapped=0x0) returned 1 [0044.207] CloseHandle (hObject=0x274) returned 1 [0044.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.221] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.223] GetFileType (hFile=0x274) returned 0x1 [0044.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.223] GetFileType (hFile=0x274) returned 0x1 [0044.223] WriteFile (in: hFile=0x274, lpBuffer=0x1b0ea64*, nNumberOfBytesToWrite=0xfbe0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b0ea64*, lpNumberOfBytesWritten=0x2ae384*=0xfbe0, lpOverlapped=0x0) returned 1 [0044.225] CloseHandle (hObject=0x274) returned 1 [0044.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0044.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.226] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc063900, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb94c58f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfbe0)) returned 1 [0044.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf.anonymous")) returned 1 [0044.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.227] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.227] GetFileType (hFile=0x274) returned 0x1 [0044.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.227] GetFileType (hFile=0x274) returned 0x1 [0044.227] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x95a4 [0044.227] ReadFile (in: hFile=0x274, lpBuffer=0x1b1eb2c, nNumberOfBytesToRead=0x95a4, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b1eb2c*, lpNumberOfBytesRead=0x2ae390*=0x95a4, lpOverlapped=0x0) returned 1 [0044.239] CloseHandle (hObject=0x274) returned 1 [0044.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.277] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.279] GetFileType (hFile=0x274) returned 0x1 [0044.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.279] GetFileType (hFile=0x274) returned 0x1 [0044.279] WriteFile (in: hFile=0x274, lpBuffer=0x19a429c*, nNumberOfBytesToWrite=0x95b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19a429c*, lpNumberOfBytesWritten=0x2ae384*=0x95b0, lpOverlapped=0x0) returned 1 [0044.281] CloseHandle (hObject=0x274) returned 1 [0044.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0044.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.282] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc063900, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb955de70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x95b0)) returned 1 [0044.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf.anonymous")) returned 1 [0044.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.287] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.287] GetFileType (hFile=0x274) returned 0x1 [0044.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.287] GetFileType (hFile=0x274) returned 0x1 [0044.287] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x17ff8 [0044.287] ReadFile (in: hFile=0x274, lpBuffer=0x2c06850, nNumberOfBytesToRead=0x17ff8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c06850*, lpNumberOfBytesRead=0x2ae390*=0x17ff8, lpOverlapped=0x0) returned 1 [0044.305] CloseHandle (hObject=0x274) returned 1 [0044.320] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.320] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.322] GetFileType (hFile=0x274) returned 0x1 [0044.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.323] GetFileType (hFile=0x274) returned 0x1 [0044.323] WriteFile (in: hFile=0x274, lpBuffer=0x2ce3198*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2ce3198*, lpNumberOfBytesWritten=0x2ae384*=0x18000, lpOverlapped=0x0) returned 1 [0044.326] CloseHandle (hObject=0x274) returned 1 [0044.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0044.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.328] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc063900, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb95d0290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18000)) returned 1 [0044.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf.anonymous")) returned 1 [0044.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL", lpFilePart=0x0) returned 0x49 [0044.329] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpFilePart=0x0) returned 0x4a [0044.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0044.427] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.428] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.428] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0044.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.429] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL", lpFilePart=0x0) returned 0x49 [0044.429] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpFilePart=0x0) returned 0x4a [0044.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbecd8 [0044.430] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.431] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.431] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0044.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.433] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.433] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.434] GetFileType (hFile=0x274) returned 0x1 [0044.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.434] GetFileType (hFile=0x274) returned 0x1 [0044.434] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x907a [0044.434] ReadFile (in: hFile=0x274, lpBuffer=0x19fdf0c, nNumberOfBytesToRead=0x907a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19fdf0c*, lpNumberOfBytesRead=0x2ae390*=0x907a, lpOverlapped=0x0) returned 1 [0044.440] CloseHandle (hObject=0x274) returned 1 [0044.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.452] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.454] GetFileType (hFile=0x274) returned 0x1 [0044.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.454] GetFileType (hFile=0x274) returned 0x1 [0044.454] WriteFile (in: hFile=0x274, lpBuffer=0x1a77f78*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a77f78*, lpNumberOfBytesWritten=0x2ae384*=0x9080, lpOverlapped=0x0) returned 1 [0044.456] CloseHandle (hObject=0x274) returned 1 [0044.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0044.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.457] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf90540, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9700d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9080)) returned 1 [0044.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf.anonymous")) returned 1 [0044.458] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0044.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.458] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.458] GetFileType (hFile=0x274) returned 0x1 [0044.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.458] GetFileType (hFile=0x274) returned 0x1 [0044.458] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0044.458] ReadFile (in: hFile=0x274, lpBuffer=0x1a814d0, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a814d0*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0044.460] CloseHandle (hObject=0x274) returned 1 [0044.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0044.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.480] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.482] GetFileType (hFile=0x274) returned 0x1 [0044.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.482] GetFileType (hFile=0x274) returned 0x1 [0044.482] WriteFile (in: hFile=0x274, lpBuffer=0x1af67bc*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1af67bc*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0044.484] CloseHandle (hObject=0x274) returned 1 [0044.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0044.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0044.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.485] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb974d050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0044.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf.anonymous")) returned 1 [0044.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0044.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.486] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.486] GetFileType (hFile=0x274) returned 0x1 [0044.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.486] GetFileType (hFile=0x274) returned 0x1 [0044.486] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0044.486] ReadFile (in: hFile=0x274, lpBuffer=0x1afed90, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1afed90*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0044.493] CloseHandle (hObject=0x274) returned 1 [0044.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0044.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.552] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.553] GetFileType (hFile=0x274) returned 0x1 [0044.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.553] GetFileType (hFile=0x274) returned 0x1 [0044.553] WriteFile (in: hFile=0x274, lpBuffer=0x195f3c4*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x195f3c4*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0044.555] CloseHandle (hObject=0x274) returned 1 [0044.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0044.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0044.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.556] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb97e55d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0044.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf.anonymous")) returned 1 [0044.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.557] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.557] GetFileType (hFile=0x274) returned 0x1 [0044.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.557] GetFileType (hFile=0x274) returned 0x1 [0044.557] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x4fff9 [0044.557] ReadFile (in: hFile=0x274, lpBuffer=0x29a41e8, nNumberOfBytesToRead=0x4fff9, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x29a41e8*, lpNumberOfBytesRead=0x2ae390*=0x4fff9, lpOverlapped=0x0) returned 1 [0044.585] CloseHandle (hObject=0x274) returned 1 [0044.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.616] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.620] GetFileType (hFile=0x274) returned 0x1 [0044.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.620] GetFileType (hFile=0x274) returned 0x1 [0044.620] WriteFile (in: hFile=0x274, lpBuffer=0x2b597c0*, nNumberOfBytesToWrite=0x50000, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b597c0*, lpNumberOfBytesWritten=0x2ae384*=0x50000, lpOverlapped=0x0) returned 1 [0044.626] CloseHandle (hObject=0x274) returned 1 [0044.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0044.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.630] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf90540, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb98a3cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50000)) returned 1 [0044.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf.anonymous")) returned 1 [0044.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0044.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.631] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.631] GetFileType (hFile=0x274) returned 0x1 [0044.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.631] GetFileType (hFile=0x274) returned 0x1 [0044.631] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0044.632] ReadFile (in: hFile=0x274, lpBuffer=0x2ba97e0, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2ba97e0*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0044.642] CloseHandle (hObject=0x274) returned 1 [0044.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0044.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.669] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.672] GetFileType (hFile=0x274) returned 0x1 [0044.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.672] GetFileType (hFile=0x274) returned 0x1 [0044.672] WriteFile (in: hFile=0x274, lpBuffer=0x2c37118*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c37118*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0044.676] CloseHandle (hObject=0x274) returned 1 [0044.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0044.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0044.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.677] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf90540, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb99160d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0044.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf.anonymous")) returned 1 [0044.678] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.678] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.678] GetFileType (hFile=0x274) returned 0x1 [0044.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.679] GetFileType (hFile=0x274) returned 0x1 [0044.679] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x10873 [0044.679] ReadFile (in: hFile=0x274, lpBuffer=0x1a05760, nNumberOfBytesToRead=0x10873, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a05760*, lpNumberOfBytesRead=0x2ae390*=0x10873, lpOverlapped=0x0) returned 1 [0044.695] CloseHandle (hObject=0x274) returned 1 [0044.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.719] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.721] GetFileType (hFile=0x274) returned 0x1 [0044.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.721] GetFileType (hFile=0x274) returned 0x1 [0044.721] WriteFile (in: hFile=0x274, lpBuffer=0x1a83ee0*, nNumberOfBytesToWrite=0x10880, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a83ee0*, lpNumberOfBytesWritten=0x2ae384*=0x10880, lpOverlapped=0x0) returned 1 [0044.724] CloseHandle (hObject=0x274) returned 1 [0044.725] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.726] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0044.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.726] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb99884f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10880)) returned 1 [0044.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf.anonymous")) returned 1 [0044.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB", lpFilePart=0x0) returned 0x49 [0044.727] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpFilePart=0x0) returned 0x4a [0044.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbead8 [0044.727] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.727] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.727] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.728] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.728] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.728] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0044.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB", lpFilePart=0x0) returned 0x49 [0044.728] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpFilePart=0x0) returned 0x4a [0044.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbead8 [0044.729] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.729] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.729] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.729] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.729] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.729] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0044.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.730] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.730] GetFileType (hFile=0x274) returned 0x1 [0044.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.730] GetFileType (hFile=0x274) returned 0x1 [0044.730] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xc4a8 [0044.730] ReadFile (in: hFile=0x274, lpBuffer=0x1a96ed8, nNumberOfBytesToRead=0xc4a8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a96ed8*, lpNumberOfBytesRead=0x2ae390*=0xc4a8, lpOverlapped=0x0) returned 1 [0044.733] CloseHandle (hObject=0x274) returned 1 [0044.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.752] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.754] GetFileType (hFile=0x274) returned 0x1 [0044.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.754] GetFileType (hFile=0x274) returned 0x1 [0044.754] WriteFile (in: hFile=0x274, lpBuffer=0x1b08ae4*, nNumberOfBytesToWrite=0xc4b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b08ae4*, lpNumberOfBytesWritten=0x2ae384*=0xc4b0, lpOverlapped=0x0) returned 1 [0044.756] CloseHandle (hObject=0x274) returned 1 [0044.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0044.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.760] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc0d5d20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb99d47b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc4b0)) returned 1 [0044.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf.anonymous")) returned 1 [0044.761] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.761] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.761] GetFileType (hFile=0x274) returned 0x1 [0044.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.761] GetFileType (hFile=0x274) returned 0x1 [0044.761] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9c53 [0044.762] ReadFile (in: hFile=0x274, lpBuffer=0x1b1547c, nNumberOfBytesToRead=0x9c53, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b1547c*, lpNumberOfBytesRead=0x2ae390*=0x9c53, lpOverlapped=0x0) returned 1 [0044.771] CloseHandle (hObject=0x274) returned 1 [0044.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.820] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.822] GetFileType (hFile=0x274) returned 0x1 [0044.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.822] GetFileType (hFile=0x274) returned 0x1 [0044.822] WriteFile (in: hFile=0x274, lpBuffer=0x199d418*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x199d418*, lpNumberOfBytesWritten=0x2ae384*=0x9c60, lpOverlapped=0x0) returned 1 [0044.823] CloseHandle (hObject=0x274) returned 1 [0044.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0044.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0044.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.824] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc194400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9a6cd30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c60)) returned 1 [0044.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf.anonymous")) returned 1 [0044.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.827] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.827] GetFileType (hFile=0x274) returned 0x1 [0044.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.827] GetFileType (hFile=0x274) returned 0x1 [0044.827] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x19c87 [0044.827] ReadFile (in: hFile=0x274, lpBuffer=0x2c8d098, nNumberOfBytesToRead=0x19c87, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c8d098*, lpNumberOfBytesRead=0x2ae390*=0x19c87, lpOverlapped=0x0) returned 1 [0044.835] CloseHandle (hObject=0x274) returned 1 [0044.853] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0044.853] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.855] GetFileType (hFile=0x274) returned 0x1 [0044.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0044.855] GetFileType (hFile=0x274) returned 0x1 [0044.855] WriteFile (in: hFile=0x274, lpBuffer=0x29da928*, nNumberOfBytesToWrite=0x19c90, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x29da928*, lpNumberOfBytesWritten=0x2ae384*=0x19c90, lpOverlapped=0x0) returned 1 [0044.858] CloseHandle (hObject=0x274) returned 1 [0044.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0044.860] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0044.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0044.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd80700, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc194400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9adf150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19c90)) returned 1 [0044.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0044.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf.anonymous")) returned 1 [0044.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM", lpFilePart=0x0) returned 0x49 [0044.861] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpFilePart=0x0) returned 0x4a [0044.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec58 [0044.870] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.871] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.871] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.871] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.871] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.878] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.878] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.878] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.879] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0044.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0044.880] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM", lpFilePart=0x0) returned 0x49 [0044.880] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpFilePart=0x0) returned 0x4a [0044.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec58 [0044.882] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.882] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.882] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.882] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.882] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.882] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.883] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0044.883] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0044.883] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0044.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0044.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0044.884] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0044.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0044.885] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0044.886] GetFileType (hFile=0x274) returned 0x1 [0044.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0044.887] GetFileType (hFile=0x274) returned 0x1 [0044.887] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x15fc8 [0044.887] ReadFile (in: hFile=0x274, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0x15fc8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae390*=0x15fc8, lpOverlapped=0x0) returned 1 [0044.938] CloseHandle (hObject=0x274) returned 1 [0045.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.025] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.029] GetFileType (hFile=0x274) returned 0x1 [0045.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.029] GetFileType (hFile=0x274) returned 0x1 [0045.029] WriteFile (in: hFile=0x274, lpBuffer=0x2a876e8*, nNumberOfBytesToWrite=0x15fd0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a876e8*, lpNumberOfBytesWritten=0x2ae384*=0x15fd0, lpOverlapped=0x0) returned 1 [0045.031] CloseHandle (hObject=0x274) returned 1 [0045.033] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.033] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0045.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.033] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9c82070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15fd0)) returned 1 [0045.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf.anonymous")) returned 1 [0045.033] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.034] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.034] GetFileType (hFile=0x274) returned 0x1 [0045.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.034] GetFileType (hFile=0x274) returned 0x1 [0045.034] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0045.034] ReadFile (in: hFile=0x274, lpBuffer=0x19813e8, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19813e8*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0045.047] CloseHandle (hObject=0x274) returned 1 [0045.065] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.065] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.066] GetFileType (hFile=0x274) returned 0x1 [0045.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.066] GetFileType (hFile=0x274) returned 0x1 [0045.067] WriteFile (in: hFile=0x274, lpBuffer=0x19f66d4*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19f66d4*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0045.068] CloseHandle (hObject=0x274) returned 1 [0045.068] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0045.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.069] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9cce330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0045.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf.anonymous")) returned 1 [0045.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.069] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.070] GetFileType (hFile=0x274) returned 0x1 [0045.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.070] GetFileType (hFile=0x274) returned 0x1 [0045.070] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0045.070] ReadFile (in: hFile=0x274, lpBuffer=0x19feca8, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19feca8*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0045.075] CloseHandle (hObject=0x274) returned 1 [0045.088] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.088] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.090] GetFileType (hFile=0x274) returned 0x1 [0045.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.090] GetFileType (hFile=0x274) returned 0x1 [0045.090] WriteFile (in: hFile=0x274, lpBuffer=0x1a6e068*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a6e068*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0045.092] CloseHandle (hObject=0x274) returned 1 [0045.092] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.092] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.092] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9d1a5f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0045.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf.anonymous")) returned 1 [0045.093] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.093] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.093] GetFileType (hFile=0x274) returned 0x1 [0045.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.093] GetFileType (hFile=0x274) returned 0x1 [0045.093] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xe736 [0045.093] ReadFile (in: hFile=0x274, lpBuffer=0x1a79ca4, nNumberOfBytesToRead=0xe736, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a79ca4*, lpNumberOfBytesRead=0x2ae390*=0xe736, lpOverlapped=0x0) returned 1 [0045.102] CloseHandle (hObject=0x274) returned 1 [0045.115] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.116] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.117] GetFileType (hFile=0x274) returned 0x1 [0045.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.117] GetFileType (hFile=0x274) returned 0x1 [0045.117] WriteFile (in: hFile=0x274, lpBuffer=0x1af2064*, nNumberOfBytesToWrite=0xe740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1af2064*, lpNumberOfBytesWritten=0x2ae384*=0xe740, lpOverlapped=0x0) returned 1 [0045.119] CloseHandle (hObject=0x274) returned 1 [0045.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9d40750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe740)) returned 1 [0045.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf.anonymous")) returned 1 [0045.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.122] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.122] GetFileType (hFile=0x274) returned 0x1 [0045.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.122] GetFileType (hFile=0x274) returned 0x1 [0045.122] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0045.122] ReadFile (in: hFile=0x274, lpBuffer=0x2ad13d8, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2ad13d8*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0045.124] CloseHandle (hObject=0x274) returned 1 [0045.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.180] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.182] GetFileType (hFile=0x274) returned 0x1 [0045.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.182] GetFileType (hFile=0x274) returned 0x1 [0045.182] WriteFile (in: hFile=0x274, lpBuffer=0x2b5ed10*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b5ed10*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0045.187] CloseHandle (hObject=0x274) returned 1 [0045.188] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.188] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.188] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf6a3e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9dfee30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0045.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf.anonymous")) returned 1 [0045.189] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.189] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.189] GetFileType (hFile=0x274) returned 0x1 [0045.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.189] GetFileType (hFile=0x274) returned 0x1 [0045.189] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2fe62 [0045.190] ReadFile (in: hFile=0x274, lpBuffer=0x2b7b230, nNumberOfBytesToRead=0x2fe62, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b7b230*, lpNumberOfBytesRead=0x2ae390*=0x2fe62, lpOverlapped=0x0) returned 1 [0045.211] CloseHandle (hObject=0x274) returned 1 [0045.237] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.237] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.240] GetFileType (hFile=0x274) returned 0x1 [0045.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.240] GetFileType (hFile=0x274) returned 0x1 [0045.240] WriteFile (in: hFile=0x274, lpBuffer=0x2cc09e0*, nNumberOfBytesToWrite=0x2fe70, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2cc09e0*, lpNumberOfBytesWritten=0x2ae384*=0x2fe70, lpOverlapped=0x0) returned 1 [0045.246] CloseHandle (hObject=0x274) returned 1 [0045.248] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.248] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0045.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.249] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9e973b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2fe70)) returned 1 [0045.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf.anonymous")) returned 1 [0045.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0045.249] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS", lpFilePart=0x0) returned 0x49 [0045.250] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpFilePart=0x0) returned 0x4a [0045.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.268] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.269] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0045.269] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0045.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0045.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0045.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0045.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS", lpFilePart=0x0) returned 0x49 [0045.270] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpFilePart=0x0) returned 0x4a [0045.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0045.272] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.272] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.272] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.272] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.272] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.273] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.273] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.273] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0045.273] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0045.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0045.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0045.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.275] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.277] GetFileType (hFile=0x274) returned 0x1 [0045.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.277] GetFileType (hFile=0x274) returned 0x1 [0045.277] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xeac7 [0045.277] ReadFile (in: hFile=0x274, lpBuffer=0x199ea9c, nNumberOfBytesToRead=0xeac7, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x199ea9c*, lpNumberOfBytesRead=0x2ae390*=0xeac7, lpOverlapped=0x0) returned 1 [0045.294] CloseHandle (hObject=0x274) returned 1 [0045.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.307] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.309] GetFileType (hFile=0x274) returned 0x1 [0045.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.309] GetFileType (hFile=0x274) returned 0x1 [0045.309] WriteFile (in: hFile=0x274, lpBuffer=0x1a1790c*, nNumberOfBytesToWrite=0xead0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a1790c*, lpNumberOfBytesWritten=0x2ae384*=0xead0, lpOverlapped=0x0) returned 1 [0045.310] CloseHandle (hObject=0x274) returned 1 [0045.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0045.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.312] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9f2f930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xead0)) returned 1 [0045.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf.anonymous")) returned 1 [0045.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.312] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.313] GetFileType (hFile=0x274) returned 0x1 [0045.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.313] GetFileType (hFile=0x274) returned 0x1 [0045.313] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0045.313] ReadFile (in: hFile=0x274, lpBuffer=0x1a268b4, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a268b4*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0045.323] CloseHandle (hObject=0x274) returned 1 [0045.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.338] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.340] GetFileType (hFile=0x274) returned 0x1 [0045.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.341] GetFileType (hFile=0x274) returned 0x1 [0045.341] WriteFile (in: hFile=0x274, lpBuffer=0x1a9bba0*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a9bba0*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0045.343] CloseHandle (hObject=0x274) returned 1 [0045.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0045.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9f7bbf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0045.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf.anonymous")) returned 1 [0045.345] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.345] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.345] GetFileType (hFile=0x274) returned 0x1 [0045.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.345] GetFileType (hFile=0x274) returned 0x1 [0045.345] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0045.346] ReadFile (in: hFile=0x274, lpBuffer=0x1aa4174, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aa4174*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0045.348] CloseHandle (hObject=0x274) returned 1 [0045.391] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.391] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.393] GetFileType (hFile=0x274) returned 0x1 [0045.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.393] GetFileType (hFile=0x274) returned 0x1 [0045.393] WriteFile (in: hFile=0x274, lpBuffer=0x1947e98*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1947e98*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0045.395] CloseHandle (hObject=0x274) returned 1 [0045.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.395] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xb9fee010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0045.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf.anonymous")) returned 1 [0045.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.396] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.396] GetFileType (hFile=0x274) returned 0x1 [0045.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.396] GetFileType (hFile=0x274) returned 0x1 [0045.396] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa118 [0045.396] ReadFile (in: hFile=0x274, lpBuffer=0x1953ad4, nNumberOfBytesToRead=0xa118, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1953ad4*, lpNumberOfBytesRead=0x2ae390*=0xa118, lpOverlapped=0x0) returned 1 [0045.486] CloseHandle (hObject=0x274) returned 1 [0045.522] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.522] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.524] GetFileType (hFile=0x274) returned 0x1 [0045.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.524] GetFileType (hFile=0x274) returned 0x1 [0045.524] WriteFile (in: hFile=0x274, lpBuffer=0x19d2fb8*, nNumberOfBytesToWrite=0xa120, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19d2fb8*, lpNumberOfBytesWritten=0x2ae384*=0xa120, lpOverlapped=0x0) returned 1 [0045.526] CloseHandle (hObject=0x274) returned 1 [0045.527] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.527] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.527] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba144c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa120)) returned 1 [0045.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf.anonymous")) returned 1 [0045.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.528] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.528] GetFileType (hFile=0x274) returned 0x1 [0045.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.528] GetFileType (hFile=0x274) returned 0x1 [0045.528] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0045.528] ReadFile (in: hFile=0x274, lpBuffer=0x29a41e8, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x29a41e8*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0045.553] CloseHandle (hObject=0x274) returned 1 [0045.568] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.568] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.570] GetFileType (hFile=0x274) returned 0x1 [0045.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.570] GetFileType (hFile=0x274) returned 0x1 [0045.571] WriteFile (in: hFile=0x274, lpBuffer=0x2a521a0*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a521a0*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0045.573] CloseHandle (hObject=0x274) returned 1 [0045.574] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.575] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba1b7090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0045.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf.anonymous")) returned 1 [0045.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.575] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.575] GetFileType (hFile=0x274) returned 0x1 [0045.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.576] GetFileType (hFile=0x274) returned 0x1 [0045.576] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1ac4e [0045.576] ReadFile (in: hFile=0x274, lpBuffer=0x2a6e6c0, nNumberOfBytesToRead=0x1ac4e, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a6e6c0*, lpNumberOfBytesRead=0x2ae390*=0x1ac4e, lpOverlapped=0x0) returned 1 [0045.607] CloseHandle (hObject=0x274) returned 1 [0045.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.632] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.635] GetFileType (hFile=0x274) returned 0x1 [0045.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.635] GetFileType (hFile=0x274) returned 0x1 [0045.635] WriteFile (in: hFile=0x274, lpBuffer=0x2af4490*, nNumberOfBytesToWrite=0x1ac50, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2af4490*, lpNumberOfBytesWritten=0x2ae384*=0x1ac50, lpOverlapped=0x0) returned 1 [0045.638] CloseHandle (hObject=0x274) returned 1 [0045.640] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.640] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0045.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.640] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf44280, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba24f610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ac50)) returned 1 [0045.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf.anonymous")) returned 1 [0045.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0045.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY", lpFilePart=0x0) returned 0x49 [0045.641] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpFilePart=0x0) returned 0x4a [0045.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0045.660] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.660] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.661] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.661] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.661] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.661] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.661] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.661] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0045.662] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0045.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0045.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0045.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0045.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY", lpFilePart=0x0) returned 0x49 [0045.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpFilePart=0x0) returned 0x4a [0045.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0045.664] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.665] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.665] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.665] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.665] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.665] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.665] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.666] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0045.666] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0045.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0045.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0045.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.667] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.669] GetFileType (hFile=0x274) returned 0x1 [0045.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.669] GetFileType (hFile=0x274) returned 0x1 [0045.669] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa85d [0045.669] ReadFile (in: hFile=0x274, lpBuffer=0x1a7a92c, nNumberOfBytesToRead=0xa85d, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a7a92c*, lpNumberOfBytesRead=0x2ae390*=0xa85d, lpOverlapped=0x0) returned 1 [0045.755] CloseHandle (hObject=0x274) returned 1 [0045.791] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.791] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.793] GetFileType (hFile=0x274) returned 0x1 [0045.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.793] GetFileType (hFile=0x274) returned 0x1 [0045.793] WriteFile (in: hFile=0x274, lpBuffer=0x1ae704c*, nNumberOfBytesToWrite=0xa860, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ae704c*, lpNumberOfBytesWritten=0x2ae384*=0xa860, lpOverlapped=0x0) returned 1 [0045.794] CloseHandle (hObject=0x274) returned 1 [0045.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0045.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.796] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba3cc3d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa860)) returned 1 [0045.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf.anonymous")) returned 1 [0045.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.796] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.797] GetFileType (hFile=0x274) returned 0x1 [0045.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.797] GetFileType (hFile=0x274) returned 0x1 [0045.797] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0045.797] ReadFile (in: hFile=0x274, lpBuffer=0x1af1d84, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1af1d84*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0045.799] CloseHandle (hObject=0x274) returned 1 [0045.817] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.817] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.818] GetFileType (hFile=0x274) returned 0x1 [0045.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.818] GetFileType (hFile=0x274) returned 0x1 [0045.818] WriteFile (in: hFile=0x274, lpBuffer=0x19710b4*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19710b4*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0045.820] CloseHandle (hObject=0x274) returned 1 [0045.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0045.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0045.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba3f2530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0045.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf.anonymous")) returned 1 [0045.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.821] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.821] GetFileType (hFile=0x274) returned 0x1 [0045.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.822] GetFileType (hFile=0x274) returned 0x1 [0045.822] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0045.822] ReadFile (in: hFile=0x274, lpBuffer=0x1979688, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1979688*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0045.823] CloseHandle (hObject=0x274) returned 1 [0045.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.862] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.863] GetFileType (hFile=0x274) returned 0x1 [0045.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.863] GetFileType (hFile=0x274) returned 0x1 [0045.863] WriteFile (in: hFile=0x274, lpBuffer=0x19e8ba4*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19e8ba4*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0045.865] CloseHandle (hObject=0x274) returned 1 [0045.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0045.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.866] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba464950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0045.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf.anonymous")) returned 1 [0045.867] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.867] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.867] GetFileType (hFile=0x274) returned 0x1 [0045.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.867] GetFileType (hFile=0x274) returned 0x1 [0045.867] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb9dd [0045.867] ReadFile (in: hFile=0x274, lpBuffer=0x19f47e0, nNumberOfBytesToRead=0xb9dd, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19f47e0*, lpNumberOfBytesRead=0x2ae390*=0xb9dd, lpOverlapped=0x0) returned 1 [0045.869] CloseHandle (hObject=0x274) returned 1 [0045.889] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.889] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.891] GetFileType (hFile=0x274) returned 0x1 [0045.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.891] GetFileType (hFile=0x274) returned 0x1 [0045.891] WriteFile (in: hFile=0x274, lpBuffer=0x1a64380*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a64380*, lpNumberOfBytesWritten=0x2ae384*=0xb9e0, lpOverlapped=0x0) returned 1 [0045.893] CloseHandle (hObject=0x274) returned 1 [0045.894] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0045.894] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.894] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba4b0c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb9e0)) returned 1 [0045.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf.anonymous")) returned 1 [0045.895] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.895] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.895] GetFileType (hFile=0x274) returned 0x1 [0045.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.895] GetFileType (hFile=0x274) returned 0x1 [0045.895] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0045.896] ReadFile (in: hFile=0x274, lpBuffer=0x2b52400, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b52400*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0045.905] CloseHandle (hObject=0x274) returned 1 [0045.926] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.926] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.928] GetFileType (hFile=0x274) returned 0x1 [0045.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.928] GetFileType (hFile=0x274) returned 0x1 [0045.928] WriteFile (in: hFile=0x274, lpBuffer=0x2bdfd38*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bdfd38*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0045.931] CloseHandle (hObject=0x274) returned 1 [0045.932] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0045.932] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0045.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.932] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba4fced0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0045.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf.anonymous")) returned 1 [0045.932] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.933] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.933] GetFileType (hFile=0x274) returned 0x1 [0045.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.933] GetFileType (hFile=0x274) returned 0x1 [0045.933] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x14758 [0045.933] ReadFile (in: hFile=0x274, lpBuffer=0x1abd570, nNumberOfBytesToRead=0x14758, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1abd570*, lpNumberOfBytesRead=0x2ae390*=0x14758, lpOverlapped=0x0) returned 1 [0045.944] CloseHandle (hObject=0x274) returned 1 [0045.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0045.959] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.961] GetFileType (hFile=0x274) returned 0x1 [0045.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0045.961] GetFileType (hFile=0x274) returned 0x1 [0045.961] WriteFile (in: hFile=0x274, lpBuffer=0x1b4798c*, nNumberOfBytesToWrite=0x14760, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b4798c*, lpNumberOfBytesWritten=0x2ae384*=0x14760, lpOverlapped=0x0) returned 1 [0045.964] CloseHandle (hObject=0x274) returned 1 [0045.965] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0045.965] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0045.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0045.965] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba56f2f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14760)) returned 1 [0045.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0045.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf.anonymous")) returned 1 [0045.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0045.966] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV", lpFilePart=0x0) returned 0x49 [0045.966] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpFilePart=0x0) returned 0x4a [0045.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea58 [0045.969] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.969] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.969] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.969] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.971] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.971] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.971] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.972] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0045.972] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0045.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0045.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0045.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0045.973] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV", lpFilePart=0x0) returned 0x49 [0045.973] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpFilePart=0x0) returned 0x4a [0045.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea58 [0045.974] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.974] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.974] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.974] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.975] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.975] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.975] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0045.975] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0045.975] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0045.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0045.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0045.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0045.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0045.976] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0045.977] GetFileType (hFile=0x274) returned 0x1 [0045.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0045.977] GetFileType (hFile=0x274) returned 0x1 [0045.977] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1e146 [0045.978] ReadFile (in: hFile=0x274, lpBuffer=0x2c25118, nNumberOfBytesToRead=0x1e146, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c25118*, lpNumberOfBytesRead=0x2ae390*=0x1e146, lpOverlapped=0x0) returned 1 [0045.987] CloseHandle (hObject=0x274) returned 1 [0046.034] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.034] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.036] GetFileType (hFile=0x274) returned 0x1 [0046.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.036] GetFileType (hFile=0x274) returned 0x1 [0046.036] WriteFile (in: hFile=0x274, lpBuffer=0x2c43280*, nNumberOfBytesToWrite=0x1e150, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c43280*, lpNumberOfBytesWritten=0x2ae384*=0x1e150, lpOverlapped=0x0) returned 1 [0046.039] CloseHandle (hObject=0x274) returned 1 [0046.041] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.041] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0046.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.041] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba607870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e150)) returned 1 [0046.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf.anonymous")) returned 1 [0046.042] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0046.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.042] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.042] GetFileType (hFile=0x274) returned 0x1 [0046.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.043] GetFileType (hFile=0x274) returned 0x1 [0046.043] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0046.043] ReadFile (in: hFile=0x274, lpBuffer=0x1931404, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1931404*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0046.044] CloseHandle (hObject=0x274) returned 1 [0046.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0046.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.083] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.085] GetFileType (hFile=0x274) returned 0x1 [0046.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.085] GetFileType (hFile=0x274) returned 0x1 [0046.085] WriteFile (in: hFile=0x274, lpBuffer=0x19a684c*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19a684c*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0046.086] CloseHandle (hObject=0x274) returned 1 [0046.087] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0046.087] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0046.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.087] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcf1e120, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba679c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0046.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf.anonymous")) returned 1 [0046.088] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0046.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.088] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.088] GetFileType (hFile=0x274) returned 0x1 [0046.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.088] GetFileType (hFile=0x274) returned 0x1 [0046.088] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0046.088] ReadFile (in: hFile=0x274, lpBuffer=0x19aee20, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19aee20*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0046.090] CloseHandle (hObject=0x274) returned 1 [0046.103] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0046.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.103] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.105] GetFileType (hFile=0x274) returned 0x1 [0046.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.105] GetFileType (hFile=0x274) returned 0x1 [0046.105] WriteFile (in: hFile=0x274, lpBuffer=0x1a1e1e0*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a1e1e0*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0046.107] CloseHandle (hObject=0x274) returned 1 [0046.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0046.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0046.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.108] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba6c5f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0046.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf.anonymous")) returned 1 [0046.109] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.109] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.109] GetFileType (hFile=0x274) returned 0x1 [0046.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.109] GetFileType (hFile=0x274) returned 0x1 [0046.109] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x12fb3 [0046.109] ReadFile (in: hFile=0x274, lpBuffer=0x1a29e1c, nNumberOfBytesToRead=0x12fb3, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a29e1c*, lpNumberOfBytesRead=0x2ae390*=0x12fb3, lpOverlapped=0x0) returned 1 [0046.122] CloseHandle (hObject=0x274) returned 1 [0046.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.135] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.137] GetFileType (hFile=0x274) returned 0x1 [0046.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.137] GetFileType (hFile=0x274) returned 0x1 [0046.137] WriteFile (in: hFile=0x274, lpBuffer=0x1aafb5c*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aafb5c*, lpNumberOfBytesWritten=0x2ae384*=0x12fc0, lpOverlapped=0x0) returned 1 [0046.139] CloseHandle (hObject=0x274) returned 1 [0046.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0046.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.141] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba712210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12fc0)) returned 1 [0046.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf.anonymous")) returned 1 [0046.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0046.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.142] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.142] GetFileType (hFile=0x274) returned 0x1 [0046.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.142] GetFileType (hFile=0x274) returned 0x1 [0046.142] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0046.142] ReadFile (in: hFile=0x274, lpBuffer=0x29b32e8, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x29b32e8*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0046.177] CloseHandle (hObject=0x274) returned 1 [0046.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0046.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.192] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.194] GetFileType (hFile=0x274) returned 0x1 [0046.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.194] GetFileType (hFile=0x274) returned 0x1 [0046.194] WriteFile (in: hFile=0x274, lpBuffer=0x2a6e6b0*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a6e6b0*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0046.197] CloseHandle (hObject=0x274) returned 1 [0046.198] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0046.198] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0046.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.198] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba7aa790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0046.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf.anonymous")) returned 1 [0046.199] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.199] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.199] GetFileType (hFile=0x274) returned 0x1 [0046.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.199] GetFileType (hFile=0x274) returned 0x1 [0046.199] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x26254 [0046.199] ReadFile (in: hFile=0x274, lpBuffer=0x2a8abd0, nNumberOfBytesToRead=0x26254, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a8abd0*, lpNumberOfBytesRead=0x2ae390*=0x26254, lpOverlapped=0x0) returned 1 [0046.209] CloseHandle (hObject=0x274) returned 1 [0046.249] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.249] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.251] GetFileType (hFile=0x274) returned 0x1 [0046.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.251] GetFileType (hFile=0x274) returned 0x1 [0046.251] WriteFile (in: hFile=0x274, lpBuffer=0x2b497e0*, nNumberOfBytesToWrite=0x26260, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b497e0*, lpNumberOfBytesWritten=0x2ae384*=0x26260, lpOverlapped=0x0) returned 1 [0046.254] CloseHandle (hObject=0x274) returned 1 [0046.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0046.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.256] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba81cbb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26260)) returned 1 [0046.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf.anonymous")) returned 1 [0046.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0046.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO", lpFilePart=0x0) returned 0x49 [0046.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpFilePart=0x0) returned 0x4a [0046.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0046.257] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.258] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.258] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.258] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.258] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0046.258] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0046.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0046.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0046.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0046.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO", lpFilePart=0x0) returned 0x49 [0046.258] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpFilePart=0x0) returned 0x4a [0046.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0046.258] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.259] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.259] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.259] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.259] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0046.259] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0046.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0046.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0046.259] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.259] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.259] GetFileType (hFile=0x274) returned 0x1 [0046.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.260] GetFileType (hFile=0x274) returned 0x1 [0046.260] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xe7e1 [0046.260] ReadFile (in: hFile=0x274, lpBuffer=0x195fc98, nNumberOfBytesToRead=0xe7e1, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x195fc98*, lpNumberOfBytesRead=0x2ae390*=0xe7e1, lpOverlapped=0x0) returned 1 [0046.267] CloseHandle (hObject=0x274) returned 1 [0046.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.281] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.283] GetFileType (hFile=0x274) returned 0x1 [0046.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.283] GetFileType (hFile=0x274) returned 0x1 [0046.283] WriteFile (in: hFile=0x274, lpBuffer=0x19d83c4*, nNumberOfBytesToWrite=0xe7f0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19d83c4*, lpNumberOfBytesWritten=0x2ae384*=0xe7f0, lpOverlapped=0x0) returned 1 [0046.285] CloseHandle (hObject=0x274) returned 1 [0046.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0046.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.286] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb66bce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba868e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe7f0)) returned 1 [0046.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf.anonymous")) returned 1 [0046.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.287] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.288] GetFileType (hFile=0x274) returned 0x1 [0046.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.288] GetFileType (hFile=0x274) returned 0x1 [0046.288] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9cbb [0046.288] ReadFile (in: hFile=0x274, lpBuffer=0x19e709c, nNumberOfBytesToRead=0x9cbb, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19e709c*, lpNumberOfBytesRead=0x2ae390*=0x9cbb, lpOverlapped=0x0) returned 1 [0046.297] CloseHandle (hObject=0x274) returned 1 [0046.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.310] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.311] GetFileType (hFile=0x274) returned 0x1 [0046.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.312] GetFileType (hFile=0x274) returned 0x1 [0046.312] WriteFile (in: hFile=0x274, lpBuffer=0x1a64e48*, nNumberOfBytesToWrite=0x9cc0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a64e48*, lpNumberOfBytesWritten=0x2ae384*=0x9cc0, lpOverlapped=0x0) returned 1 [0046.313] CloseHandle (hObject=0x274) returned 1 [0046.314] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.314] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0046.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.314] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb66bce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba8b5130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9cc0)) returned 1 [0046.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf.anonymous")) returned 1 [0046.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.316] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.317] GetFileType (hFile=0x274) returned 0x1 [0046.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.317] GetFileType (hFile=0x274) returned 0x1 [0046.317] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x16f99 [0046.317] ReadFile (in: hFile=0x274, lpBuffer=0x2b8ca40, nNumberOfBytesToRead=0x16f99, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b8ca40*, lpNumberOfBytesRead=0x2ae390*=0x16f99, lpOverlapped=0x0) returned 1 [0046.339] CloseHandle (hObject=0x274) returned 1 [0046.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.354] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.356] GetFileType (hFile=0x274) returned 0x1 [0046.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.356] GetFileType (hFile=0x274) returned 0x1 [0046.356] WriteFile (in: hFile=0x274, lpBuffer=0x2bff898*, nNumberOfBytesToWrite=0x16fa0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bff898*, lpNumberOfBytesWritten=0x2ae384*=0x16fa0, lpOverlapped=0x0) returned 1 [0046.359] CloseHandle (hObject=0x274) returned 1 [0046.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0046.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.361] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb66bce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba927550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16fa0)) returned 1 [0046.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf.anonymous")) returned 1 [0046.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0046.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE", lpFilePart=0x0) returned 0x49 [0046.363] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpFilePart=0x0) returned 0x4a [0046.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0046.363] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.363] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.364] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.364] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.364] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0046.364] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0046.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0046.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0046.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0046.364] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE", lpFilePart=0x0) returned 0x49 [0046.364] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpFilePart=0x0) returned 0x4a [0046.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0046.365] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.365] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.365] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.365] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0046.365] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0046.365] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0046.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0046.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0046.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.366] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.366] GetFileType (hFile=0x274) returned 0x1 [0046.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.366] GetFileType (hFile=0x274) returned 0x1 [0046.366] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xe5af [0046.366] ReadFile (in: hFile=0x274, lpBuffer=0x1abe590, nNumberOfBytesToRead=0xe5af, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1abe590*, lpNumberOfBytesRead=0x2ae390*=0xe5af, lpOverlapped=0x0) returned 1 [0046.368] CloseHandle (hObject=0x274) returned 1 [0046.392] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.392] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.394] GetFileType (hFile=0x274) returned 0x1 [0046.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.394] GetFileType (hFile=0x274) returned 0x1 [0046.394] WriteFile (in: hFile=0x274, lpBuffer=0x19403c8*, nNumberOfBytesToWrite=0xe5b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19403c8*, lpNumberOfBytesWritten=0x2ae384*=0xe5b0, lpOverlapped=0x0) returned 1 [0046.396] CloseHandle (hObject=0x274) returned 1 [0046.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0046.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0046.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc017640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xba973810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe5b0)) returned 1 [0046.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf.anonymous")) returned 1 [0046.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.399] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.399] GetFileType (hFile=0x274) returned 0x1 [0046.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.399] GetFileType (hFile=0x274) returned 0x1 [0046.399] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa6a0 [0046.399] ReadFile (in: hFile=0x274, lpBuffer=0x194ee60, nNumberOfBytesToRead=0xa6a0, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x194ee60*, lpNumberOfBytesRead=0x2ae390*=0xa6a0, lpOverlapped=0x0) returned 1 [0046.411] CloseHandle (hObject=0x274) returned 1 [0046.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.447] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.449] GetFileType (hFile=0x274) returned 0x1 [0046.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.449] GetFileType (hFile=0x274) returned 0x1 [0046.449] WriteFile (in: hFile=0x274, lpBuffer=0x19bb1c8*, nNumberOfBytesToWrite=0xa6b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19bb1c8*, lpNumberOfBytesWritten=0x2ae384*=0xa6b0, lpOverlapped=0x0) returned 1 [0046.451] CloseHandle (hObject=0x274) returned 1 [0046.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0046.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0046.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.452] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc017640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbaa0bd90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa6b0)) returned 1 [0046.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf.anonymous")) returned 1 [0046.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0046.456] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.456] GetFileType (hFile=0x274) returned 0x1 [0046.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0046.456] GetFileType (hFile=0x274) returned 0x1 [0046.456] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x18efb [0046.457] ReadFile (in: hFile=0x274, lpBuffer=0x2cd8340, nNumberOfBytesToRead=0x18efb, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2cd8340*, lpNumberOfBytesRead=0x2ae390*=0x18efb, lpOverlapped=0x0) returned 1 [0046.468] CloseHandle (hObject=0x274) returned 1 [0046.490] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0046.490] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0046.492] GetFileType (hFile=0x274) returned 0x1 [0046.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0046.492] GetFileType (hFile=0x274) returned 0x1 [0046.492] WriteFile (in: hFile=0x274, lpBuffer=0x29bf168*, nNumberOfBytesToWrite=0x18f00, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x29bf168*, lpNumberOfBytesWritten=0x2ae384*=0x18f00, lpOverlapped=0x0) returned 1 [0046.495] CloseHandle (hObject=0x274) returned 1 [0046.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0046.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0046.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0046.497] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b75ad00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc017640, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbaa7e1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18f00)) returned 1 [0046.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0046.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf.anonymous")) returned 1 [0046.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0046.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR", lpFilePart=0x0) returned 0x49 [0046.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpFilePart=0x0) returned 0x4a [0046.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea58 [0047.343] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.344] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0047.345] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0047.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0047.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0047.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0047.346] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR", lpFilePart=0x0) returned 0x49 [0047.346] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpFilePart=0x0) returned 0x4a [0047.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea58 [0047.377] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.377] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.377] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.377] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.377] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.378] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.378] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.378] FindNextFileW (in: hFindFile=0xbea58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0047.378] FindClose (in: hFindFile=0xbea58 | out: hFindFile=0xbea58) returned 1 [0047.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0047.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0047.379] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0047.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.379] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.439] GetFileType (hFile=0x274) returned 0x1 [0047.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.439] GetFileType (hFile=0x274) returned 0x1 [0047.439] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xe27c [0047.439] ReadFile (in: hFile=0x274, lpBuffer=0x1933ff8, nNumberOfBytesToRead=0xe27c, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1933ff8*, lpNumberOfBytesRead=0x2ae390*=0xe27c, lpOverlapped=0x0) returned 1 [0047.441] CloseHandle (hObject=0x274) returned 1 [0047.490] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0047.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.490] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.492] GetFileType (hFile=0x274) returned 0x1 [0047.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.492] GetFileType (hFile=0x274) returned 0x1 [0047.492] WriteFile (in: hFile=0x274, lpBuffer=0x19ab6d0*, nNumberOfBytesToWrite=0xe280, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19ab6d0*, lpNumberOfBytesWritten=0x2ae384*=0xe280, lpOverlapped=0x0) returned 1 [0047.494] CloseHandle (hObject=0x274) returned 1 [0047.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0047.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0047.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.496] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb4039b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe280)) returned 1 [0047.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf.anonymous")) returned 1 [0047.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0047.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.497] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.497] GetFileType (hFile=0x274) returned 0x1 [0047.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.497] GetFileType (hFile=0x274) returned 0x1 [0047.497] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0047.497] ReadFile (in: hFile=0x274, lpBuffer=0x19b9e28, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19b9e28*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0047.517] CloseHandle (hObject=0x274) returned 1 [0047.536] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0047.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.536] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.538] GetFileType (hFile=0x274) returned 0x1 [0047.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.538] GetFileType (hFile=0x274) returned 0x1 [0047.538] WriteFile (in: hFile=0x274, lpBuffer=0x1a2f114*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a2f114*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0047.539] CloseHandle (hObject=0x274) returned 1 [0047.540] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0047.540] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0047.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.540] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb475dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0047.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf.anonymous")) returned 1 [0047.541] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0047.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.541] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.541] GetFileType (hFile=0x274) returned 0x1 [0047.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.541] GetFileType (hFile=0x274) returned 0x1 [0047.541] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0047.541] ReadFile (in: hFile=0x274, lpBuffer=0x1a376e8, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a376e8*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0047.558] CloseHandle (hObject=0x274) returned 1 [0047.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0047.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.577] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.579] GetFileType (hFile=0x274) returned 0x1 [0047.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.579] GetFileType (hFile=0x274) returned 0x1 [0047.579] WriteFile (in: hFile=0x274, lpBuffer=0x1aa6aa8*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aa6aa8*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0047.581] CloseHandle (hObject=0x274) returned 1 [0047.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0047.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0047.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.582] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdced1e60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb4c2090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0047.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf.anonymous")) returned 1 [0047.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0047.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.583] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.584] GetFileType (hFile=0x274) returned 0x1 [0047.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.584] GetFileType (hFile=0x274) returned 0x1 [0047.584] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x992b [0047.584] ReadFile (in: hFile=0x274, lpBuffer=0x1ab26e4, nNumberOfBytesToRead=0x992b, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1ab26e4*, lpNumberOfBytesRead=0x2ae390*=0x992b, lpOverlapped=0x0) returned 1 [0047.599] CloseHandle (hObject=0x274) returned 1 [0047.618] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0047.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.618] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.620] GetFileType (hFile=0x274) returned 0x1 [0047.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.621] GetFileType (hFile=0x274) returned 0x1 [0047.621] WriteFile (in: hFile=0x274, lpBuffer=0x1b2f2c0*, nNumberOfBytesToWrite=0x9930, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b2f2c0*, lpNumberOfBytesWritten=0x2ae384*=0x9930, lpOverlapped=0x0) returned 1 [0047.623] CloseHandle (hObject=0x274) returned 1 [0047.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0047.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0047.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.624] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdced1e60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb5344b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9930)) returned 1 [0047.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf.anonymous")) returned 1 [0047.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0047.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.625] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.625] GetFileType (hFile=0x274) returned 0x1 [0047.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.625] GetFileType (hFile=0x274) returned 0x1 [0047.625] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0047.625] ReadFile (in: hFile=0x274, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0047.628] CloseHandle (hObject=0x274) returned 1 [0047.696] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0047.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.696] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.699] GetFileType (hFile=0x274) returned 0x1 [0047.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.699] GetFileType (hFile=0x274) returned 0x1 [0047.699] WriteFile (in: hFile=0x274, lpBuffer=0x2aa70d8*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2aa70d8*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0047.702] CloseHandle (hObject=0x274) returned 1 [0047.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0047.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0047.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.704] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdcef7fc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb5f2b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0047.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf.anonymous")) returned 1 [0047.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0047.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.705] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.705] GetFileType (hFile=0x274) returned 0x1 [0047.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.705] GetFileType (hFile=0x274) returned 0x1 [0047.705] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1804a [0047.705] ReadFile (in: hFile=0x274, lpBuffer=0x2ac35f8, nNumberOfBytesToRead=0x1804a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2ac35f8*, lpNumberOfBytesRead=0x2ae390*=0x1804a, lpOverlapped=0x0) returned 1 [0047.708] CloseHandle (hObject=0x274) returned 1 [0047.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0047.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.729] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.731] GetFileType (hFile=0x274) returned 0x1 [0047.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.731] GetFileType (hFile=0x274) returned 0x1 [0047.731] WriteFile (in: hFile=0x274, lpBuffer=0x2b3b7c0*, nNumberOfBytesToWrite=0x18050, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b3b7c0*, lpNumberOfBytesWritten=0x2ae384*=0x18050, lpOverlapped=0x0) returned 1 [0047.734] CloseHandle (hObject=0x274) returned 1 [0047.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0047.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0047.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.744] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a6100, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdced1e60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb63ee50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18050)) returned 1 [0047.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf.anonymous")) returned 1 [0047.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0047.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR", lpFilePart=0x0) returned 0x49 [0047.746] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpFilePart=0x0) returned 0x4a [0047.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbead8 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.757] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.758] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0047.758] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0047.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0047.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0047.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0047.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR", lpFilePart=0x0) returned 0x49 [0047.759] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpFilePart=0x0) returned 0x4a [0047.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbead8 [0047.761] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.761] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.761] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.761] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.762] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.762] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.762] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0047.762] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0047.762] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0047.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0047.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0047.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0047.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.764] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.766] GetFileType (hFile=0x274) returned 0x1 [0047.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.766] GetFileType (hFile=0x274) returned 0x1 [0047.766] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x18b15 [0047.766] ReadFile (in: hFile=0x274, lpBuffer=0x2b53830, nNumberOfBytesToRead=0x18b15, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2b53830*, lpNumberOfBytesRead=0x2ae390*=0x18b15, lpOverlapped=0x0) returned 1 [0047.777] CloseHandle (hObject=0x274) returned 1 [0047.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0047.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.828] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.830] GetFileType (hFile=0x274) returned 0x1 [0047.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.831] GetFileType (hFile=0x274) returned 0x1 [0047.831] WriteFile (in: hFile=0x274, lpBuffer=0x2bcf008*, nNumberOfBytesToWrite=0x18b20, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2bcf008*, lpNumberOfBytesWritten=0x2ae384*=0x18b20, lpOverlapped=0x0) returned 1 [0047.834] CloseHandle (hObject=0x274) returned 1 [0047.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", lpFilePart=0x0) returned 0x55 [0047.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.anonymous", lpFilePart=0x0) returned 0x5f [0047.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.836] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdced1e60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb7497f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18b20)) returned 1 [0047.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf.anonymous")) returned 1 [0047.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0047.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.837] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.838] GetFileType (hFile=0x274) returned 0x1 [0047.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.838] GetFileType (hFile=0x274) returned 0x1 [0047.838] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x80f5 [0047.838] ReadFile (in: hFile=0x274, lpBuffer=0x1a1bad8, nNumberOfBytesToRead=0x80f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a1bad8*, lpNumberOfBytesRead=0x2ae390*=0x80f5, lpOverlapped=0x0) returned 1 [0047.844] CloseHandle (hObject=0x274) returned 1 [0047.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0047.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.863] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.865] GetFileType (hFile=0x274) returned 0x1 [0047.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.865] GetFileType (hFile=0x274) returned 0x1 [0047.865] WriteFile (in: hFile=0x274, lpBuffer=0x1a90dc4*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a90dc4*, lpNumberOfBytesWritten=0x2ae384*=0x8100, lpOverlapped=0x0) returned 1 [0047.867] CloseHandle (hObject=0x274) returned 1 [0047.867] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", lpFilePart=0x0) returned 0x53 [0047.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.anonymous", lpFilePart=0x0) returned 0x5d [0047.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.868] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdced1e60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb795ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8100)) returned 1 [0047.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf.anonymous")) returned 1 [0047.869] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0047.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.869] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.869] GetFileType (hFile=0x274) returned 0x1 [0047.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.869] GetFileType (hFile=0x274) returned 0x1 [0047.869] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb731 [0047.869] ReadFile (in: hFile=0x274, lpBuffer=0x1a99398, nNumberOfBytesToRead=0xb731, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a99398*, lpNumberOfBytesRead=0x2ae390*=0xb731, lpOverlapped=0x0) returned 1 [0047.877] CloseHandle (hObject=0x274) returned 1 [0047.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0047.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.902] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.904] GetFileType (hFile=0x274) returned 0x1 [0047.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.904] GetFileType (hFile=0x274) returned 0x1 [0047.904] WriteFile (in: hFile=0x274, lpBuffer=0x1b08758*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b08758*, lpNumberOfBytesWritten=0x2ae384*=0xb740, lpOverlapped=0x0) returned 1 [0047.906] CloseHandle (hObject=0x274) returned 1 [0047.907] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", lpFilePart=0x0) returned 0x56 [0047.907] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0047.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.907] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdceabd00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb7e1d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb740)) returned 1 [0047.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf.anonymous")) returned 1 [0047.908] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0047.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.908] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.908] GetFileType (hFile=0x274) returned 0x1 [0047.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.908] GetFileType (hFile=0x274) returned 0x1 [0047.909] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb189 [0047.909] ReadFile (in: hFile=0x274, lpBuffer=0x1b14394, nNumberOfBytesToRead=0xb189, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b14394*, lpNumberOfBytesRead=0x2ae390*=0xb189, lpOverlapped=0x0) returned 1 [0047.911] CloseHandle (hObject=0x274) returned 1 [0047.963] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0047.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0047.963] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.965] GetFileType (hFile=0x274) returned 0x1 [0047.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0047.965] GetFileType (hFile=0x274) returned 0x1 [0047.965] WriteFile (in: hFile=0x274, lpBuffer=0x198e284*, nNumberOfBytesToWrite=0xb190, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x198e284*, lpNumberOfBytesWritten=0x2ae384*=0xb190, lpOverlapped=0x0) returned 1 [0047.967] CloseHandle (hObject=0x274) returned 1 [0047.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", lpFilePart=0x0) returned 0x56 [0047.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0047.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0047.969] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdceabd00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb87a2f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb190)) returned 1 [0047.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0047.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf.anonymous")) returned 1 [0047.970] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0047.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0047.970] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0047.970] GetFileType (hFile=0x274) returned 0x1 [0047.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0047.970] GetFileType (hFile=0x274) returned 0x1 [0047.970] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x1c4f5 [0047.971] ReadFile (in: hFile=0x274, lpBuffer=0x2c14ce8, nNumberOfBytesToRead=0x1c4f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c14ce8*, lpNumberOfBytesRead=0x2ae390*=0x1c4f5, lpOverlapped=0x0) returned 1 [0048.083] CloseHandle (hObject=0x274) returned 1 [0048.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0048.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0048.105] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.107] GetFileType (hFile=0x274) returned 0x1 [0048.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0048.107] GetFileType (hFile=0x274) returned 0x1 [0048.108] WriteFile (in: hFile=0x274, lpBuffer=0x2c31200*, nNumberOfBytesToWrite=0x1c500, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c31200*, lpNumberOfBytesWritten=0x2ae384*=0x1c500, lpOverlapped=0x0) returned 1 [0048.110] CloseHandle (hObject=0x274) returned 1 [0048.111] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", lpFilePart=0x0) returned 0x56 [0048.111] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.anonymous", lpFilePart=0x0) returned 0x60 [0048.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0048.112] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdced1e60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbb9d0f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c500)) returned 1 [0048.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0048.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf.anonymous")) returned 1 [0048.112] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0048.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0048.112] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.113] GetFileType (hFile=0x274) returned 0x1 [0048.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0048.113] GetFileType (hFile=0x274) returned 0x1 [0048.113] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x58891 [0048.113] ReadFile (in: hFile=0x274, lpBuffer=0x298d368, nNumberOfBytesToRead=0x58891, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesRead=0x2ae390*=0x58891, lpOverlapped=0x0) returned 1 [0048.160] CloseHandle (hObject=0x274) returned 1 [0048.202] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0048.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0048.202] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.207] GetFileType (hFile=0x274) returned 0x1 [0048.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0048.207] GetFileType (hFile=0x274) returned 0x1 [0048.207] WriteFile (in: hFile=0x274, lpBuffer=0x2b7ba40*, nNumberOfBytesToWrite=0x588a0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2b7ba40*, lpNumberOfBytesWritten=0x2ae384*=0x588a0, lpOverlapped=0x0) returned 1 [0048.214] CloseHandle (hObject=0x274) returned 1 [0048.217] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", lpFilePart=0x0) returned 0x5e [0048.217] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.anonymous", lpFilePart=0x0) returned 0x68 [0048.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0048.217] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316b8e00, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdceabd00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbadb8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x588a0)) returned 1 [0048.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0048.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf.anonymous")) returned 1 [0048.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0048.218] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia", lpFilePart=0x0) returned 0x3d [0048.218] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpFilePart=0x0) returned 0x3e [0048.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.237] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.238] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.238] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.238] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.238] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.238] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0048.238] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0048.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0048.239] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia", lpFilePart=0x0) returned 0x3d [0048.239] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpFilePart=0x0) returned 0x3e [0048.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0048.240] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.241] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.242] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0048.242] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0048.242] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0048.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP", lpFilePart=0x0) returned 0x41 [0048.243] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpFilePart=0x0) returned 0x42 [0048.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.250] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.251] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.252] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.253] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.254] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.255] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.255] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.255] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.256] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.257] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.258] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.259] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.260] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.260] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.260] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.260] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.260] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP", lpFilePart=0x0) returned 0x41 [0048.261] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpFilePart=0x0) returned 0x42 [0048.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.262] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.262] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.263] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.264] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.265] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.266] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.267] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.267] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE", lpFilePart=0x0) returned 0x45 [0048.269] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpFilePart=0x0) returned 0x46 [0048.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.269] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.269] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.270] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE", lpFilePart=0x0) returned 0x45 [0048.270] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpFilePart=0x0) returned 0x46 [0048.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.270] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.270] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.271] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV", lpFilePart=0x0) returned 0x45 [0048.271] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpFilePart=0x0) returned 0x46 [0048.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.271] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.271] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.272] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.272] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV", lpFilePart=0x0) returned 0x45 [0048.272] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpFilePart=0x0) returned 0x46 [0048.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.272] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.272] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.272] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN", lpFilePart=0x0) returned 0x45 [0048.272] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpFilePart=0x0) returned 0x46 [0048.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.273] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.273] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.273] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.273] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.273] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.273] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.273] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN", lpFilePart=0x0) returned 0x45 [0048.274] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpFilePart=0x0) returned 0x46 [0048.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.274] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.274] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.274] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.274] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.274] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.274] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.274] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL", lpFilePart=0x0) returned 0x45 [0048.274] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpFilePart=0x0) returned 0x46 [0048.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.275] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL", lpFilePart=0x0) returned 0x45 [0048.275] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpFilePart=0x0) returned 0x46 [0048.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.275] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.275] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.276] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM", lpFilePart=0x0) returned 0x45 [0048.276] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpFilePart=0x0) returned 0x46 [0048.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.276] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.276] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.276] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.276] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.276] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.276] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.277] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM", lpFilePart=0x0) returned 0x45 [0048.277] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpFilePart=0x0) returned 0x46 [0048.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.277] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.277] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.277] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.277] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.277] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.277] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.277] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS", lpFilePart=0x0) returned 0x45 [0048.277] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpFilePart=0x0) returned 0x46 [0048.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.278] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.278] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.278] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.278] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.278] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.278] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.278] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS", lpFilePart=0x0) returned 0x45 [0048.278] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpFilePart=0x0) returned 0x46 [0048.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.279] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.279] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.279] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.279] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.279] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.279] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.279] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.279] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY", lpFilePart=0x0) returned 0x45 [0048.279] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpFilePart=0x0) returned 0x46 [0048.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0048.280] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.280] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY", lpFilePart=0x0) returned 0x45 [0048.280] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpFilePart=0x0) returned 0x46 [0048.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.280] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.281] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.281] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0048.281] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV", lpFilePart=0x0) returned 0x45 [0048.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpFilePart=0x0) returned 0x46 [0048.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.282] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV", lpFilePart=0x0) returned 0x45 [0048.282] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpFilePart=0x0) returned 0x46 [0048.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.283] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR", lpFilePart=0x0) returned 0x45 [0048.283] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpFilePart=0x0) returned 0x46 [0048.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.283] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.284] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR", lpFilePart=0x0) returned 0x45 [0048.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpFilePart=0x0) returned 0x46 [0048.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.284] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.284] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR", lpFilePart=0x0) returned 0x45 [0048.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpFilePart=0x0) returned 0x46 [0048.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.287] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0048.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR", lpFilePart=0x0) returned 0x45 [0048.287] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpFilePart=0x0) returned 0x46 [0048.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0048.287] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0048.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0048.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d", lpFilePart=0x0) returned 0x34 [0048.287] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\", lpFilePart=0x0) returned 0x35 [0048.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.295] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.296] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d", lpFilePart=0x0) returned 0x34 [0048.296] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\", lpFilePart=0x0) returned 0x35 [0048.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.297] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0048.299] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc", lpFilePart=0x0) returned 0x38 [0048.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\", lpFilePart=0x0) returned 0x39 [0048.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0048.300] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0048.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0048.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc", lpFilePart=0x0) returned 0x38 [0048.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\", lpFilePart=0x0) returned 0x39 [0048.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0048.300] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0048.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services", lpFilePart=0x0) returned 0x32 [0048.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services\\", lpFilePart=0x0) returned 0x33 [0048.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.301] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services", lpFilePart=0x0) returned 0x32 [0048.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services\\", lpFilePart=0x0) returned 0x33 [0048.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Services\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.301] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins", lpFilePart=0x0) returned 0x33 [0048.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\", lpFilePart=0x0) returned 0x34 [0048.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.302] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins", lpFilePart=0x0) returned 0x33 [0048.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\", lpFilePart=0x0) returned 0x34 [0048.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.302] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker", lpFilePart=0x0) returned 0x31 [0048.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpFilePart=0x0) returned 0x32 [0048.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.315] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0048.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker", lpFilePart=0x0) returned 0x31 [0048.316] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpFilePart=0x0) returned 0x32 [0048.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0048.318] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0048.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0048.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0048.319] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", lpFilePart=0x0) returned 0x42 [0048.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.319] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.320] GetFileType (hFile=0x274) returned 0x1 [0048.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.320] GetFileType (hFile=0x274) returned 0x1 [0048.321] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x53a [0048.330] CloseHandle (hObject=0x274) returned 1 [0048.343] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", lpFilePart=0x0) returned 0x42 [0048.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.343] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.344] GetFileType (hFile=0x274) returned 0x1 [0048.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.344] GetFileType (hFile=0x274) returned 0x1 [0048.344] WriteFile (in: hFile=0x274, lpBuffer=0x1a09ca4*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a09ca4*, lpNumberOfBytesWritten=0x2ae4b4*=0x540, lpOverlapped=0x0) returned 1 [0048.345] CloseHandle (hObject=0x274) returned 1 [0048.346] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", lpFilePart=0x0) returned 0x42 [0048.346] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.anonymous", lpFilePart=0x0) returned 0x4c [0048.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbc0c3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0048.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif.anonymous")) returned 1 [0048.347] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", lpFilePart=0x0) returned 0x38 [0048.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.347] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.348] GetFileType (hFile=0x274) returned 0x1 [0048.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.348] GetFileType (hFile=0x274) returned 0x1 [0048.348] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x53 [0048.349] CloseHandle (hObject=0x274) returned 1 [0048.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", lpFilePart=0x0) returned 0x38 [0048.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.362] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.364] GetFileType (hFile=0x274) returned 0x1 [0048.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.364] GetFileType (hFile=0x274) returned 0x1 [0048.364] WriteFile (in: hFile=0x274, lpBuffer=0x1a590e0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a590e0*, lpNumberOfBytesWritten=0x2ae4b4*=0x60, lpOverlapped=0x0) returned 1 [0048.365] CloseHandle (hObject=0x274) returned 1 [0048.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", lpFilePart=0x0) returned 0x38 [0048.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.anonymous", lpFilePart=0x0) returned 0x42 [0048.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.366] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbc32550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0048.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\bl.gif.anonymous")) returned 1 [0048.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", lpFilePart=0x0) returned 0x38 [0048.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.366] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.367] GetFileType (hFile=0x274) returned 0x1 [0048.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.367] GetFileType (hFile=0x274) returned 0x1 [0048.367] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x52 [0048.368] CloseHandle (hObject=0x274) returned 1 [0048.393] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", lpFilePart=0x0) returned 0x38 [0048.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.393] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.394] GetFileType (hFile=0x274) returned 0x1 [0048.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.394] GetFileType (hFile=0x274) returned 0x1 [0048.395] CloseHandle (hObject=0x274) returned 1 [0048.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", lpFilePart=0x0) returned 0x38 [0048.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.anonymous", lpFilePart=0x0) returned 0x42 [0048.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbc7e810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0048.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\br.gif.anonymous")) returned 1 [0048.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", lpFilePart=0x0) returned 0x41 [0048.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.396] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.396] GetFileType (hFile=0x274) returned 0x1 [0048.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.397] GetFileType (hFile=0x274) returned 0x1 [0048.397] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x4aa [0048.402] CloseHandle (hObject=0x274) returned 1 [0048.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", lpFilePart=0x0) returned 0x41 [0048.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.415] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.416] GetFileType (hFile=0x274) returned 0x1 [0048.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.416] GetFileType (hFile=0x274) returned 0x1 [0048.416] WriteFile (in: hFile=0x274, lpBuffer=0x1af92fc*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1af92fc*, lpNumberOfBytesWritten=0x2ae4b4*=0x4b0, lpOverlapped=0x0) returned 1 [0048.417] CloseHandle (hObject=0x274) returned 1 [0048.418] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", lpFilePart=0x0) returned 0x41 [0048.418] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.anonymous", lpFilePart=0x0) returned 0x4b [0048.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.418] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbccaad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4b0)) returned 1 [0048.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif.anonymous")) returned 1 [0048.419] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", lpFilePart=0x0) returned 0x45 [0048.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.419] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.420] GetFileType (hFile=0x274) returned 0x1 [0048.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.420] GetFileType (hFile=0x274) returned 0x1 [0048.420] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x335 [0048.431] CloseHandle (hObject=0x274) returned 1 [0048.463] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", lpFilePart=0x0) returned 0x45 [0048.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.464] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.465] GetFileType (hFile=0x274) returned 0x1 [0048.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.465] GetFileType (hFile=0x274) returned 0x1 [0048.465] WriteFile (in: hFile=0x274, lpBuffer=0x194b7fc*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x194b7fc*, lpNumberOfBytesWritten=0x2ae4b4*=0x340, lpOverlapped=0x0) returned 1 [0048.466] CloseHandle (hObject=0x274) returned 1 [0048.467] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", lpFilePart=0x0) returned 0x45 [0048.467] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.anonymous", lpFilePart=0x0) returned 0x4f [0048.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.467] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc9c2fa0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbd3cef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0048.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif.anonymous")) returned 1 [0048.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", lpFilePart=0x0) returned 0x3f [0048.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.468] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.468] GetFileType (hFile=0x274) returned 0x1 [0048.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.468] GetFileType (hFile=0x274) returned 0x1 [0048.468] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5a3 [0048.468] ReadFile (in: hFile=0x274, lpBuffer=0x194d0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x194d0cc*, lpNumberOfBytesRead=0x2ae4ec*=0x5a3, lpOverlapped=0x0) returned 1 [0048.470] CloseHandle (hObject=0x274) returned 1 [0048.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", lpFilePart=0x0) returned 0x3f [0048.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.483] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.484] GetFileType (hFile=0x274) returned 0x1 [0048.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.484] GetFileType (hFile=0x274) returned 0x1 [0048.484] WriteFile (in: hFile=0x274, lpBuffer=0x199cdac*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x199cdac*, lpNumberOfBytesWritten=0x2ae4b4*=0x5b0, lpOverlapped=0x0) returned 1 [0048.485] CloseHandle (hObject=0x274) returned 1 [0048.486] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", lpFilePart=0x0) returned 0x3f [0048.486] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.anonymous", lpFilePart=0x0) returned 0x49 [0048.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.486] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbd63050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0048.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif.anonymous")) returned 1 [0048.487] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", lpFilePart=0x0) returned 0x45 [0048.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.487] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.487] GetFileType (hFile=0x274) returned 0x1 [0048.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.487] GetFileType (hFile=0x274) returned 0x1 [0048.487] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x550 [0048.487] ReadFile (in: hFile=0x274, lpBuffer=0x199e61c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x199e61c*, lpNumberOfBytesRead=0x2ae4ec*=0x550, lpOverlapped=0x0) returned 1 [0048.497] CloseHandle (hObject=0x274) returned 1 [0048.510] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", lpFilePart=0x0) returned 0x45 [0048.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.510] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.512] GetFileType (hFile=0x274) returned 0x1 [0048.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.512] GetFileType (hFile=0x274) returned 0x1 [0048.512] WriteFile (in: hFile=0x274, lpBuffer=0x19ee028*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19ee028*, lpNumberOfBytesWritten=0x2ae4b4*=0x560, lpOverlapped=0x0) returned 1 [0048.513] CloseHandle (hObject=0x274) returned 1 [0048.514] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", lpFilePart=0x0) returned 0x45 [0048.514] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.anonymous", lpFilePart=0x0) returned 0x4f [0048.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.514] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbdaf310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0048.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif.anonymous")) returned 1 [0048.515] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", lpFilePart=0x0) returned 0x4a [0048.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.515] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.515] GetFileType (hFile=0x274) returned 0x1 [0048.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.515] GetFileType (hFile=0x274) returned 0x1 [0048.515] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x327 [0048.515] ReadFile (in: hFile=0x274, lpBuffer=0x19ef6ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19ef6ac*, lpNumberOfBytesRead=0x2ae4ec*=0x327, lpOverlapped=0x0) returned 1 [0048.519] CloseHandle (hObject=0x274) returned 1 [0048.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", lpFilePart=0x0) returned 0x4a [0048.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.531] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.532] GetFileType (hFile=0x274) returned 0x1 [0048.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.532] GetFileType (hFile=0x274) returned 0x1 [0048.532] WriteFile (in: hFile=0x274, lpBuffer=0x1a3e5dc*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a3e5dc*, lpNumberOfBytesWritten=0x2ae4b4*=0x330, lpOverlapped=0x0) returned 1 [0048.533] CloseHandle (hObject=0x274) returned 1 [0048.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", lpFilePart=0x0) returned 0x4a [0048.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.anonymous", lpFilePart=0x0) returned 0x54 [0048.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.534] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc9c2fa0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbdd5470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0048.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif.anonymous")) returned 1 [0048.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", lpFilePart=0x0) returned 0x40 [0048.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.535] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.535] GetFileType (hFile=0x274) returned 0x1 [0048.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.535] GetFileType (hFile=0x274) returned 0x1 [0048.535] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x384 [0048.536] ReadFile (in: hFile=0x274, lpBuffer=0x1a3fcb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a3fcb8*, lpNumberOfBytesRead=0x2ae4ec*=0x384, lpOverlapped=0x0) returned 1 [0048.539] CloseHandle (hObject=0x274) returned 1 [0048.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", lpFilePart=0x0) returned 0x40 [0048.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.551] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.553] GetFileType (hFile=0x274) returned 0x1 [0048.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.553] GetFileType (hFile=0x274) returned 0x1 [0048.553] WriteFile (in: hFile=0x274, lpBuffer=0x1a8eda0*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a8eda0*, lpNumberOfBytesWritten=0x2ae4b4*=0x390, lpOverlapped=0x0) returned 1 [0048.554] CloseHandle (hObject=0x274) returned 1 [0048.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", lpFilePart=0x0) returned 0x40 [0048.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.anonymous", lpFilePart=0x0) returned 0x4a [0048.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.555] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbe21730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1 [0048.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif.anonymous")) returned 1 [0048.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", lpFilePart=0x0) returned 0x47 [0048.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.556] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.557] GetFileType (hFile=0x274) returned 0x1 [0048.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.557] GetFileType (hFile=0x274) returned 0x1 [0048.557] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x265 [0048.557] ReadFile (in: hFile=0x274, lpBuffer=0x1a9033c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a9033c*, lpNumberOfBytesRead=0x2ae4ec*=0x265, lpOverlapped=0x0) returned 1 [0048.566] CloseHandle (hObject=0x274) returned 1 [0048.585] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", lpFilePart=0x0) returned 0x47 [0048.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.585] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.587] GetFileType (hFile=0x274) returned 0x1 [0048.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.587] GetFileType (hFile=0x274) returned 0x1 [0048.587] WriteFile (in: hFile=0x274, lpBuffer=0x1adee9c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1adee9c*, lpNumberOfBytesWritten=0x2ae4b4*=0x270, lpOverlapped=0x0) returned 1 [0048.589] CloseHandle (hObject=0x274) returned 1 [0048.590] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", lpFilePart=0x0) returned 0x47 [0048.590] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.anonymous", lpFilePart=0x0) returned 0x51 [0048.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.590] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbe6d9f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0048.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif.anonymous")) returned 1 [0048.591] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", lpFilePart=0x0) returned 0x44 [0048.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.591] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.591] GetFileType (hFile=0x274) returned 0x1 [0048.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.591] GetFileType (hFile=0x274) returned 0x1 [0048.591] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x267 [0048.591] ReadFile (in: hFile=0x274, lpBuffer=0x1ae0454, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ae0454*, lpNumberOfBytesRead=0x2ae4ec*=0x267, lpOverlapped=0x0) returned 1 [0048.601] CloseHandle (hObject=0x274) returned 1 [0048.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", lpFilePart=0x0) returned 0x44 [0048.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.615] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.616] GetFileType (hFile=0x274) returned 0x1 [0048.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.616] GetFileType (hFile=0x274) returned 0x1 [0048.616] WriteFile (in: hFile=0x274, lpBuffer=0x1b2efac*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b2efac*, lpNumberOfBytesWritten=0x2ae4b4*=0x270, lpOverlapped=0x0) returned 1 [0048.617] CloseHandle (hObject=0x274) returned 1 [0048.618] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", lpFilePart=0x0) returned 0x44 [0048.618] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.anonymous", lpFilePart=0x0) returned 0x4e [0048.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.618] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc9c2fa0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbeb9cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0048.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif.anonymous")) returned 1 [0048.618] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", lpFilePart=0x0) returned 0x41 [0048.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.619] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.619] GetFileType (hFile=0x274) returned 0x1 [0048.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.619] GetFileType (hFile=0x274) returned 0x1 [0048.619] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x228 [0048.619] ReadFile (in: hFile=0x274, lpBuffer=0x1b30508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b30508*, lpNumberOfBytesRead=0x2ae4ec*=0x228, lpOverlapped=0x0) returned 1 [0048.620] CloseHandle (hObject=0x274) returned 1 [0048.675] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", lpFilePart=0x0) returned 0x41 [0048.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.675] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.677] GetFileType (hFile=0x274) returned 0x1 [0048.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.677] GetFileType (hFile=0x274) returned 0x1 [0048.677] WriteFile (in: hFile=0x274, lpBuffer=0x197fc60*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x197fc60*, lpNumberOfBytesWritten=0x2ae4b4*=0x230, lpOverlapped=0x0) returned 1 [0048.678] CloseHandle (hObject=0x274) returned 1 [0048.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", lpFilePart=0x0) returned 0x41 [0048.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.anonymous", lpFilePart=0x0) returned 0x4b [0048.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.679] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc9c2fa0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbf52230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0048.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif.anonymous")) returned 1 [0048.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", lpFilePart=0x0) returned 0x44 [0048.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.680] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.680] GetFileType (hFile=0x274) returned 0x1 [0048.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.680] GetFileType (hFile=0x274) returned 0x1 [0048.680] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3c9 [0048.680] ReadFile (in: hFile=0x274, lpBuffer=0x1981358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1981358*, lpNumberOfBytesRead=0x2ae4ec*=0x3c9, lpOverlapped=0x0) returned 1 [0048.696] CloseHandle (hObject=0x274) returned 1 [0048.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", lpFilePart=0x0) returned 0x44 [0048.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.709] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.711] GetFileType (hFile=0x274) returned 0x1 [0048.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.711] GetFileType (hFile=0x274) returned 0x1 [0048.711] WriteFile (in: hFile=0x274, lpBuffer=0x19d06e8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19d06e8*, lpNumberOfBytesWritten=0x2ae4b4*=0x3d0, lpOverlapped=0x0) returned 1 [0048.714] CloseHandle (hObject=0x274) returned 1 [0048.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", lpFilePart=0x0) returned 0x44 [0048.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.anonymous", lpFilePart=0x0) returned 0x4e [0048.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.714] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbf9e4f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0048.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif.anonymous")) returned 1 [0048.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", lpFilePart=0x0) returned 0x3a [0048.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.717] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.717] GetFileType (hFile=0x274) returned 0x1 [0048.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.717] GetFileType (hFile=0x274) returned 0x1 [0048.717] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x242 [0048.717] ReadFile (in: hFile=0x274, lpBuffer=0x19d1c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19d1c48*, lpNumberOfBytesRead=0x2ae4ec*=0x242, lpOverlapped=0x0) returned 1 [0048.720] CloseHandle (hObject=0x274) returned 1 [0048.733] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", lpFilePart=0x0) returned 0x3a [0048.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.733] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.734] GetFileType (hFile=0x274) returned 0x1 [0048.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.735] GetFileType (hFile=0x274) returned 0x1 [0048.735] WriteFile (in: hFile=0x274, lpBuffer=0x1a206dc*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a206dc*, lpNumberOfBytesWritten=0x2ae4b4*=0x250, lpOverlapped=0x0) returned 1 [0048.736] CloseHandle (hObject=0x274) returned 1 [0048.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", lpFilePart=0x0) returned 0x3a [0048.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.anonymous", lpFilePart=0x0) returned 0x44 [0048.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.736] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbbfc4650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0048.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\info.gif.anonymous")) returned 1 [0048.737] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", lpFilePart=0x0) returned 0x48 [0048.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.737] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.744] GetFileType (hFile=0x274) returned 0x1 [0048.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.744] GetFileType (hFile=0x274) returned 0x1 [0048.744] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x326 [0048.744] ReadFile (in: hFile=0x274, lpBuffer=0x1a21d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a21d34*, lpNumberOfBytesRead=0x2ae4ec*=0x326, lpOverlapped=0x0) returned 1 [0048.764] CloseHandle (hObject=0x274) returned 1 [0048.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", lpFilePart=0x0) returned 0x48 [0048.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.775] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.777] GetFileType (hFile=0x274) returned 0x1 [0048.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.777] GetFileType (hFile=0x274) returned 0x1 [0048.777] WriteFile (in: hFile=0x274, lpBuffer=0x1a70c5c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a70c5c*, lpNumberOfBytesWritten=0x2ae4b4*=0x330, lpOverlapped=0x0) returned 1 [0048.778] CloseHandle (hObject=0x274) returned 1 [0048.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", lpFilePart=0x0) returned 0x48 [0048.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.anonymous", lpFilePart=0x0) returned 0x52 [0048.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.778] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc9c2fa0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc036a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0048.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif.anonymous")) returned 1 [0048.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", lpFilePart=0x0) returned 0x39 [0048.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.779] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.780] GetFileType (hFile=0x274) returned 0x1 [0048.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.780] GetFileType (hFile=0x274) returned 0x1 [0048.780] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1e0 [0048.780] ReadFile (in: hFile=0x274, lpBuffer=0x1a72168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a72168*, lpNumberOfBytesRead=0x2ae4ec*=0x1e0, lpOverlapped=0x0) returned 1 [0048.781] CloseHandle (hObject=0x274) returned 1 [0048.793] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", lpFilePart=0x0) returned 0x39 [0048.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.793] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.794] GetFileType (hFile=0x274) returned 0x1 [0048.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.794] GetFileType (hFile=0x274) returned 0x1 [0048.794] WriteFile (in: hFile=0x274, lpBuffer=0x1ac0a14*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1ac0a14*, lpNumberOfBytesWritten=0x2ae4b4*=0x1f0, lpOverlapped=0x0) returned 1 [0048.795] CloseHandle (hObject=0x274) returned 1 [0048.795] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", lpFilePart=0x0) returned 0x39 [0048.795] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.anonymous", lpFilePart=0x0) returned 0x43 [0048.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.795] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc05cbd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1 [0048.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif.anonymous")) returned 1 [0048.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", lpFilePart=0x0) returned 0x3f [0048.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.796] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.796] GetFileType (hFile=0x274) returned 0x1 [0048.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.796] GetFileType (hFile=0x274) returned 0x1 [0048.796] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5ac [0048.796] ReadFile (in: hFile=0x274, lpBuffer=0x1ac22a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ac22a4*, lpNumberOfBytesRead=0x2ae4ec*=0x5ac, lpOverlapped=0x0) returned 1 [0048.814] CloseHandle (hObject=0x274) returned 1 [0048.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", lpFilePart=0x0) returned 0x3f [0048.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.829] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.830] GetFileType (hFile=0x274) returned 0x1 [0048.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.830] GetFileType (hFile=0x274) returned 0x1 [0048.830] WriteFile (in: hFile=0x274, lpBuffer=0x1b11e1c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b11e1c*, lpNumberOfBytesWritten=0x2ae4b4*=0x5b0, lpOverlapped=0x0) returned 1 [0048.831] CloseHandle (hObject=0x274) returned 1 [0048.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", lpFilePart=0x0) returned 0x3f [0048.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.anonymous", lpFilePart=0x0) returned 0x49 [0048.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.831] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc0a8e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0048.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif.anonymous")) returned 1 [0048.832] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", lpFilePart=0x0) returned 0x44 [0048.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.832] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.832] GetFileType (hFile=0x274) returned 0x1 [0048.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.832] GetFileType (hFile=0x274) returned 0x1 [0048.832] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x392 [0048.832] ReadFile (in: hFile=0x274, lpBuffer=0x1b134d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b134d0*, lpNumberOfBytesRead=0x2ae4ec*=0x392, lpOverlapped=0x0) returned 1 [0048.854] CloseHandle (hObject=0x274) returned 1 [0048.895] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", lpFilePart=0x0) returned 0x44 [0048.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.895] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.942] GetFileType (hFile=0x274) returned 0x1 [0048.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.942] GetFileType (hFile=0x274) returned 0x1 [0048.942] WriteFile (in: hFile=0x274, lpBuffer=0x19632a4*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19632a4*, lpNumberOfBytesWritten=0x2ae4b4*=0x3a0, lpOverlapped=0x0) returned 1 [0048.943] CloseHandle (hObject=0x274) returned 1 [0048.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", lpFilePart=0x0) returned 0x44 [0048.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.anonymous", lpFilePart=0x0) returned 0x4e [0048.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.943] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc1d9990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0048.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif.anonymous")) returned 1 [0048.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", lpFilePart=0x0) returned 0x42 [0048.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.944] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.944] GetFileType (hFile=0x274) returned 0x1 [0048.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.944] GetFileType (hFile=0x274) returned 0x1 [0048.944] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x38d [0048.944] ReadFile (in: hFile=0x274, lpBuffer=0x1964970, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1964970*, lpNumberOfBytesRead=0x2ae4ec*=0x38d, lpOverlapped=0x0) returned 1 [0048.949] CloseHandle (hObject=0x274) returned 1 [0048.964] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", lpFilePart=0x0) returned 0x42 [0048.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.964] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.966] GetFileType (hFile=0x274) returned 0x1 [0048.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.966] GetFileType (hFile=0x274) returned 0x1 [0048.966] WriteFile (in: hFile=0x274, lpBuffer=0x19b3bb4*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19b3bb4*, lpNumberOfBytesWritten=0x2ae4b4*=0x390, lpOverlapped=0x0) returned 1 [0048.967] CloseHandle (hObject=0x274) returned 1 [0048.967] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", lpFilePart=0x0) returned 0x42 [0048.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.anonymous", lpFilePart=0x0) returned 0x4c [0048.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc1ffaf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1 [0048.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif.anonymous")) returned 1 [0048.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", lpFilePart=0x0) returned 0x43 [0048.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.969] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.969] GetFileType (hFile=0x274) returned 0x1 [0048.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.969] GetFileType (hFile=0x274) returned 0x1 [0048.969] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x32e [0048.969] ReadFile (in: hFile=0x274, lpBuffer=0x19b5214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19b5214*, lpNumberOfBytesRead=0x2ae4ec*=0x32e, lpOverlapped=0x0) returned 1 [0048.971] CloseHandle (hObject=0x274) returned 1 [0048.988] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", lpFilePart=0x0) returned 0x43 [0048.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0048.988] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.990] GetFileType (hFile=0x274) returned 0x1 [0048.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0048.990] GetFileType (hFile=0x274) returned 0x1 [0048.990] WriteFile (in: hFile=0x274, lpBuffer=0x1a0411c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a0411c*, lpNumberOfBytesWritten=0x2ae4b4*=0x330, lpOverlapped=0x0) returned 1 [0048.991] CloseHandle (hObject=0x274) returned 1 [0048.991] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", lpFilePart=0x0) returned 0x43 [0048.991] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.anonymous", lpFilePart=0x0) returned 0x4d [0048.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0048.992] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc24bdb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0048.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0048.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif.anonymous")) returned 1 [0048.992] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", lpFilePart=0x0) returned 0x44 [0048.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0048.992] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0048.993] GetFileType (hFile=0x274) returned 0x1 [0048.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0048.993] GetFileType (hFile=0x274) returned 0x1 [0048.993] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x47f [0048.993] ReadFile (in: hFile=0x274, lpBuffer=0x1a058d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a058d4*, lpNumberOfBytesRead=0x2ae4ec*=0x47f, lpOverlapped=0x0) returned 1 [0049.005] CloseHandle (hObject=0x274) returned 1 [0049.023] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", lpFilePart=0x0) returned 0x44 [0049.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.023] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.025] GetFileType (hFile=0x274) returned 0x1 [0049.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.025] GetFileType (hFile=0x274) returned 0x1 [0049.025] WriteFile (in: hFile=0x274, lpBuffer=0x1a54e74*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a54e74*, lpNumberOfBytesWritten=0x2ae4b4*=0x480, lpOverlapped=0x0) returned 1 [0049.026] CloseHandle (hObject=0x274) returned 1 [0049.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", lpFilePart=0x0) returned 0x44 [0049.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.anonymous", lpFilePart=0x0) returned 0x4e [0049.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.026] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc298070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1 [0049.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif.anonymous")) returned 1 [0049.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", lpFilePart=0x0) returned 0x42 [0049.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.027] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.028] GetFileType (hFile=0x274) returned 0x1 [0049.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.028] GetFileType (hFile=0x274) returned 0x1 [0049.028] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x57d [0049.028] ReadFile (in: hFile=0x274, lpBuffer=0x1a56730, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a56730*, lpNumberOfBytesRead=0x2ae4ec*=0x57d, lpOverlapped=0x0) returned 1 [0049.030] CloseHandle (hObject=0x274) returned 1 [0049.047] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", lpFilePart=0x0) returned 0x42 [0049.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.048] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.049] GetFileType (hFile=0x274) returned 0x1 [0049.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.049] GetFileType (hFile=0x274) returned 0x1 [0049.049] WriteFile (in: hFile=0x274, lpBuffer=0x1aa61c8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1aa61c8*, lpNumberOfBytesWritten=0x2ae4b4*=0x580, lpOverlapped=0x0) returned 1 [0049.051] CloseHandle (hObject=0x274) returned 1 [0049.051] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", lpFilePart=0x0) returned 0x42 [0049.051] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.anonymous", lpFilePart=0x0) returned 0x4c [0049.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.051] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc92aa20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc2be1d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x580)) returned 1 [0049.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif.anonymous")) returned 1 [0049.052] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", lpFilePart=0x0) returned 0x4b [0049.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.053] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.053] GetFileType (hFile=0x274) returned 0x1 [0049.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.053] GetFileType (hFile=0x274) returned 0x1 [0049.053] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3c2 [0049.053] ReadFile (in: hFile=0x274, lpBuffer=0x1aa78dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aa78dc*, lpNumberOfBytesRead=0x2ae4ec*=0x3c2, lpOverlapped=0x0) returned 1 [0049.060] CloseHandle (hObject=0x274) returned 1 [0049.078] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", lpFilePart=0x0) returned 0x4b [0049.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.078] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.079] GetFileType (hFile=0x274) returned 0x1 [0049.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.080] GetFileType (hFile=0x274) returned 0x1 [0049.080] WriteFile (in: hFile=0x274, lpBuffer=0x1af6b30*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1af6b30*, lpNumberOfBytesWritten=0x2ae4b4*=0x3d0, lpOverlapped=0x0) returned 1 [0049.081] CloseHandle (hObject=0x274) returned 1 [0049.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", lpFilePart=0x0) returned 0x4b [0049.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.anonymous", lpFilePart=0x0) returned 0x55 [0049.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.081] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc9c2fa0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc30a490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0049.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif.anonymous")) returned 1 [0049.082] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", lpFilePart=0x0) returned 0x43 [0049.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.082] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.082] GetFileType (hFile=0x274) returned 0x1 [0049.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.082] GetFileType (hFile=0x274) returned 0x1 [0049.083] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x555 [0049.083] ReadFile (in: hFile=0x274, lpBuffer=0x1af83e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1af83e8*, lpNumberOfBytesRead=0x2ae4ec*=0x555, lpOverlapped=0x0) returned 1 [0049.091] CloseHandle (hObject=0x274) returned 1 [0049.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", lpFilePart=0x0) returned 0x43 [0049.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.142] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.144] GetFileType (hFile=0x274) returned 0x1 [0049.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.144] GetFileType (hFile=0x274) returned 0x1 [0049.144] WriteFile (in: hFile=0x274, lpBuffer=0x1948f68*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1948f68*, lpNumberOfBytesWritten=0x2ae4b4*=0x560, lpOverlapped=0x0) returned 1 [0049.146] CloseHandle (hObject=0x274) returned 1 [0049.146] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", lpFilePart=0x0) returned 0x43 [0049.146] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.anonymous", lpFilePart=0x0) returned 0x4d [0049.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.146] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc92aa20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc3a2a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0049.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif.anonymous")) returned 1 [0049.147] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", lpFilePart=0x0) returned 0x39 [0049.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.147] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.147] GetFileType (hFile=0x274) returned 0x1 [0049.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.147] GetFileType (hFile=0x274) returned 0x1 [0049.147] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xde [0049.147] ReadFile (in: hFile=0x274, lpBuffer=0x194a350, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x194a350*, lpNumberOfBytesRead=0x2ae4ec*=0xde, lpOverlapped=0x0) returned 1 [0049.149] CloseHandle (hObject=0x274) returned 1 [0049.166] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", lpFilePart=0x0) returned 0x39 [0049.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.166] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.168] GetFileType (hFile=0x274) returned 0x1 [0049.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.168] GetFileType (hFile=0x274) returned 0x1 [0049.168] WriteFile (in: hFile=0x274, lpBuffer=0x1998680*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1998680*, lpNumberOfBytesWritten=0x2ae4b4*=0xe0, lpOverlapped=0x0) returned 1 [0049.169] CloseHandle (hObject=0x274) returned 1 [0049.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", lpFilePart=0x0) returned 0x39 [0049.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.anonymous", lpFilePart=0x0) returned 0x43 [0049.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc3eecd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0049.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\rss.gif.anonymous")) returned 1 [0049.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", lpFilePart=0x0) returned 0x42 [0049.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.170] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.170] GetFileType (hFile=0x274) returned 0x1 [0049.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.170] GetFileType (hFile=0x274) returned 0x1 [0049.171] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x240 [0049.171] ReadFile (in: hFile=0x274, lpBuffer=0x1999bb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1999bb4*, lpNumberOfBytesRead=0x2ae4ec*=0x240, lpOverlapped=0x0) returned 1 [0049.172] CloseHandle (hObject=0x274) returned 1 [0049.189] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", lpFilePart=0x0) returned 0x42 [0049.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.189] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.191] GetFileType (hFile=0x274) returned 0x1 [0049.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.191] GetFileType (hFile=0x274) returned 0x1 [0049.191] WriteFile (in: hFile=0x274, lpBuffer=0x19e8668*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19e8668*, lpNumberOfBytesWritten=0x2ae4b4*=0x250, lpOverlapped=0x0) returned 1 [0049.192] CloseHandle (hObject=0x274) returned 1 [0049.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", lpFilePart=0x0) returned 0x42 [0049.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.anonymous", lpFilePart=0x0) returned 0x4c [0049.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.192] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc414e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0049.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif.anonymous")) returned 1 [0049.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", lpFilePart=0x0) returned 0x3f [0049.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.194] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.194] GetFileType (hFile=0x274) returned 0x1 [0049.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.194] GetFileType (hFile=0x274) returned 0x1 [0049.194] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x4e7 [0049.194] ReadFile (in: hFile=0x274, lpBuffer=0x19e9e70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19e9e70*, lpNumberOfBytesRead=0x2ae4ec*=0x4e7, lpOverlapped=0x0) returned 1 [0049.198] CloseHandle (hObject=0x274) returned 1 [0049.216] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", lpFilePart=0x0) returned 0x3f [0049.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.216] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.217] GetFileType (hFile=0x274) returned 0x1 [0049.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.217] GetFileType (hFile=0x274) returned 0x1 [0049.218] WriteFile (in: hFile=0x274, lpBuffer=0x1a39630*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a39630*, lpNumberOfBytesWritten=0x2ae4b4*=0x4f0, lpOverlapped=0x0) returned 1 [0049.219] CloseHandle (hObject=0x274) returned 1 [0049.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", lpFilePart=0x0) returned 0x3f [0049.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.anonymous", lpFilePart=0x0) returned 0x49 [0049.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc4610f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0049.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif.anonymous")) returned 1 [0049.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", lpFilePart=0x0) returned 0x3f [0049.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.220] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.221] GetFileType (hFile=0x274) returned 0x1 [0049.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.221] GetFileType (hFile=0x274) returned 0x1 [0049.221] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xe1 [0049.221] ReadFile (in: hFile=0x274, lpBuffer=0x1a3aa1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a3aa1c*, lpNumberOfBytesRead=0x2ae4ec*=0xe1, lpOverlapped=0x0) returned 1 [0049.222] CloseHandle (hObject=0x274) returned 1 [0049.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", lpFilePart=0x0) returned 0x3f [0049.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.240] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.242] GetFileType (hFile=0x274) returned 0x1 [0049.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.242] GetFileType (hFile=0x274) returned 0x1 [0049.242] WriteFile (in: hFile=0x274, lpBuffer=0x1a88c34*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a88c34*, lpNumberOfBytesWritten=0x2ae4b4*=0xf0, lpOverlapped=0x0) returned 1 [0049.243] CloseHandle (hObject=0x274) returned 1 [0049.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", lpFilePart=0x0) returned 0x3f [0049.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif.anonymous", lpFilePart=0x0) returned 0x49 [0049.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.244] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc4ad3b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0049.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif.anonymous")) returned 1 [0049.245] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", lpFilePart=0x0) returned 0x4a [0049.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.245] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.245] GetFileType (hFile=0x274) returned 0x1 [0049.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.245] GetFileType (hFile=0x274) returned 0x1 [0049.245] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x393 [0049.245] ReadFile (in: hFile=0x274, lpBuffer=0x1a8a300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a8a300*, lpNumberOfBytesRead=0x2ae4ec*=0x393, lpOverlapped=0x0) returned 1 [0049.247] CloseHandle (hObject=0x274) returned 1 [0049.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", lpFilePart=0x0) returned 0x4a [0049.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.263] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.265] GetFileType (hFile=0x274) returned 0x1 [0049.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.265] GetFileType (hFile=0x274) returned 0x1 [0049.265] WriteFile (in: hFile=0x274, lpBuffer=0x1ad9464*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1ad9464*, lpNumberOfBytesWritten=0x2ae4b4*=0x3a0, lpOverlapped=0x0) returned 1 [0049.266] CloseHandle (hObject=0x274) returned 1 [0049.266] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", lpFilePart=0x0) returned 0x4a [0049.266] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.anonymous", lpFilePart=0x0) returned 0x54 [0049.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.266] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc4d3510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0049.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif.anonymous")) returned 1 [0049.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", lpFilePart=0x0) returned 0x48 [0049.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.267] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.267] GetFileType (hFile=0x274) returned 0x1 [0049.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.267] GetFileType (hFile=0x274) returned 0x1 [0049.267] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x38a [0049.267] ReadFile (in: hFile=0x274, lpBuffer=0x1adab68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1adab68*, lpNumberOfBytesRead=0x2ae4ec*=0x38a, lpOverlapped=0x0) returned 1 [0049.272] CloseHandle (hObject=0x274) returned 1 [0049.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", lpFilePart=0x0) returned 0x48 [0049.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.283] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.285] GetFileType (hFile=0x274) returned 0x1 [0049.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.285] GetFileType (hFile=0x274) returned 0x1 [0049.285] WriteFile (in: hFile=0x274, lpBuffer=0x1b29c6c*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b29c6c*, lpNumberOfBytesWritten=0x2ae4b4*=0x390, lpOverlapped=0x0) returned 1 [0049.286] CloseHandle (hObject=0x274) returned 1 [0049.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", lpFilePart=0x0) returned 0x48 [0049.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.anonymous", lpFilePart=0x0) returned 0x52 [0049.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.286] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc4f9670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1 [0049.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif.anonymous")) returned 1 [0049.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", lpFilePart=0x0) returned 0x38 [0049.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.287] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.287] GetFileType (hFile=0x274) returned 0x1 [0049.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.287] GetFileType (hFile=0x274) returned 0x1 [0049.288] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x55 [0049.288] ReadFile (in: hFile=0x274, lpBuffer=0x1b2aff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b2aff0*, lpNumberOfBytesRead=0x2ae4ec*=0x55, lpOverlapped=0x0) returned 1 [0049.289] CloseHandle (hObject=0x274) returned 1 [0049.324] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", lpFilePart=0x0) returned 0x38 [0049.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.325] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.326] GetFileType (hFile=0x274) returned 0x1 [0049.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.326] GetFileType (hFile=0x274) returned 0x1 [0049.326] WriteFile (in: hFile=0x274, lpBuffer=0x197a0a4*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x197a0a4*, lpNumberOfBytesWritten=0x2ae4b4*=0x60, lpOverlapped=0x0) returned 1 [0049.327] CloseHandle (hObject=0x274) returned 1 [0049.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", lpFilePart=0x0) returned 0x38 [0049.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.anonymous", lpFilePart=0x0) returned 0x42 [0049.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.327] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc56ba90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0049.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tl.gif.anonymous")) returned 1 [0049.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", lpFilePart=0x0) returned 0x38 [0049.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.328] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.328] GetFileType (hFile=0x274) returned 0x1 [0049.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.328] GetFileType (hFile=0x274) returned 0x1 [0049.328] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x55 [0049.328] ReadFile (in: hFile=0x274, lpBuffer=0x197b3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x197b3c8*, lpNumberOfBytesRead=0x2ae4ec*=0x55, lpOverlapped=0x0) returned 1 [0049.329] CloseHandle (hObject=0x274) returned 1 [0049.341] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", lpFilePart=0x0) returned 0x38 [0049.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.341] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.342] GetFileType (hFile=0x274) returned 0x1 [0049.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.342] GetFileType (hFile=0x274) returned 0x1 [0049.342] WriteFile (in: hFile=0x274, lpBuffer=0x19c9600*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19c9600*, lpNumberOfBytesWritten=0x2ae4b4*=0x60, lpOverlapped=0x0) returned 1 [0049.343] CloseHandle (hObject=0x274) returned 1 [0049.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", lpFilePart=0x0) returned 0x38 [0049.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.anonymous", lpFilePart=0x0) returned 0x42 [0049.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc591bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0049.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\tr.gif.anonymous")) returned 1 [0049.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", lpFilePart=0x0) returned 0x3b [0049.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.344] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.344] GetFileType (hFile=0x274) returned 0x1 [0049.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.344] GetFileType (hFile=0x274) returned 0x1 [0049.345] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x489 [0049.345] ReadFile (in: hFile=0x274, lpBuffer=0x19cad60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19cad60*, lpNumberOfBytesRead=0x2ae4ec*=0x489, lpOverlapped=0x0) returned 1 [0049.348] CloseHandle (hObject=0x274) returned 1 [0049.360] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", lpFilePart=0x0) returned 0x3b [0049.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.360] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.361] GetFileType (hFile=0x274) returned 0x1 [0049.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.361] GetFileType (hFile=0x274) returned 0x1 [0049.361] WriteFile (in: hFile=0x274, lpBuffer=0x1a1a32c*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a1a32c*, lpNumberOfBytesWritten=0x2ae4b4*=0x490, lpOverlapped=0x0) returned 1 [0049.362] CloseHandle (hObject=0x274) returned 1 [0049.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", lpFilePart=0x0) returned 0x3b [0049.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.anonymous", lpFilePart=0x0) returned 0x45 [0049.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.362] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc950b80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc5b7d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x490)) returned 1 [0049.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\trash.gif.anonymous")) returned 1 [0049.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", lpFilePart=0x0) returned 0x52 [0049.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.363] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.363] GetFileType (hFile=0x274) returned 0x1 [0049.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.363] GetFileType (hFile=0x274) returned 0x1 [0049.363] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x338 [0049.363] ReadFile (in: hFile=0x274, lpBuffer=0x1a1b9a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a1b9a4*, lpNumberOfBytesRead=0x2ae4ec*=0x338, lpOverlapped=0x0) returned 1 [0049.365] CloseHandle (hObject=0x274) returned 1 [0049.377] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", lpFilePart=0x0) returned 0x52 [0049.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.377] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.378] GetFileType (hFile=0x274) returned 0x1 [0049.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.378] GetFileType (hFile=0x274) returned 0x1 [0049.378] WriteFile (in: hFile=0x274, lpBuffer=0x1a6a940*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a6a940*, lpNumberOfBytesWritten=0x2ae4b4*=0x340, lpOverlapped=0x0) returned 1 [0049.379] CloseHandle (hObject=0x274) returned 1 [0049.379] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", lpFilePart=0x0) returned 0x52 [0049.379] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.anonymous", lpFilePart=0x0) returned 0x5c [0049.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc5ddeb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0049.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif.anonymous")) returned 1 [0049.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", lpFilePart=0x0) returned 0x4f [0049.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.380] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.380] GetFileType (hFile=0x274) returned 0x1 [0049.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.380] GetFileType (hFile=0x274) returned 0x1 [0049.380] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3e3 [0049.381] ReadFile (in: hFile=0x274, lpBuffer=0x1a6c0e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a6c0e4*, lpNumberOfBytesRead=0x2ae4ec*=0x3e3, lpOverlapped=0x0) returned 1 [0049.390] CloseHandle (hObject=0x274) returned 1 [0049.409] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", lpFilePart=0x0) returned 0x4f [0049.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.410] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.411] GetFileType (hFile=0x274) returned 0x1 [0049.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.412] GetFileType (hFile=0x274) returned 0x1 [0049.412] WriteFile (in: hFile=0x274, lpBuffer=0x1abb3e8*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1abb3e8*, lpNumberOfBytesWritten=0x2ae4b4*=0x3f0, lpOverlapped=0x0) returned 1 [0049.413] CloseHandle (hObject=0x274) returned 1 [0049.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", lpFilePart=0x0) returned 0x4f [0049.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.anonymous", lpFilePart=0x0) returned 0x59 [0049.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.413] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc99ce40, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc6502d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0049.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif.anonymous")) returned 1 [0049.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", lpFilePart=0x0) returned 0x51 [0049.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.414] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.414] GetFileType (hFile=0x274) returned 0x1 [0049.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.414] GetFileType (hFile=0x274) returned 0x1 [0049.414] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x33f [0049.415] ReadFile (in: hFile=0x274, lpBuffer=0x1abcad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1abcad8*, lpNumberOfBytesRead=0x2ae4ec*=0x33f, lpOverlapped=0x0) returned 1 [0049.416] CloseHandle (hObject=0x274) returned 1 [0049.435] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", lpFilePart=0x0) returned 0x51 [0049.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.435] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.436] GetFileType (hFile=0x274) returned 0x1 [0049.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.436] GetFileType (hFile=0x274) returned 0x1 [0049.437] WriteFile (in: hFile=0x274, lpBuffer=0x1b0ba68*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b0ba68*, lpNumberOfBytesWritten=0x2ae4b4*=0x340, lpOverlapped=0x0) returned 1 [0049.438] CloseHandle (hObject=0x274) returned 1 [0049.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", lpFilePart=0x0) returned 0x51 [0049.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.anonymous", lpFilePart=0x0) returned 0x5b [0049.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.438] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc676430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0049.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif.anonymous")) returned 1 [0049.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", lpFilePart=0x0) returned 0x4e [0049.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.439] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.439] GetFileType (hFile=0x274) returned 0x1 [0049.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.439] GetFileType (hFile=0x274) returned 0x1 [0049.439] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3ea [0049.440] ReadFile (in: hFile=0x274, lpBuffer=0x1b0d208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b0d208*, lpNumberOfBytesRead=0x2ae4ec*=0x3ea, lpOverlapped=0x0) returned 1 [0049.444] CloseHandle (hObject=0x274) returned 1 [0049.493] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", lpFilePart=0x0) returned 0x4e [0049.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.493] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.495] GetFileType (hFile=0x274) returned 0x1 [0049.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.495] GetFileType (hFile=0x274) returned 0x1 [0049.495] WriteFile (in: hFile=0x274, lpBuffer=0x195ce8c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x195ce8c*, lpNumberOfBytesWritten=0x2ae4b4*=0x3f0, lpOverlapped=0x0) returned 1 [0049.496] CloseHandle (hObject=0x274) returned 1 [0049.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", lpFilePart=0x0) returned 0x4e [0049.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.anonymous", lpFilePart=0x0) returned 0x58 [0049.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.497] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc70e9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0049.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif.anonymous")) returned 1 [0049.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", lpFilePart=0x0) returned 0x3d [0049.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0049.497] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.498] GetFileType (hFile=0x274) returned 0x1 [0049.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0049.498] GetFileType (hFile=0x274) returned 0x1 [0049.498] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x171 [0049.498] ReadFile (in: hFile=0x274, lpBuffer=0x195e360, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x195e360*, lpNumberOfBytesRead=0x2ae4ec*=0x171, lpOverlapped=0x0) returned 1 [0049.499] CloseHandle (hObject=0x274) returned 1 [0049.518] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", lpFilePart=0x0) returned 0x3d [0049.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0049.518] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.519] GetFileType (hFile=0x274) returned 0x1 [0049.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0049.520] GetFileType (hFile=0x274) returned 0x1 [0049.520] WriteFile (in: hFile=0x274, lpBuffer=0x19acb48*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19acb48*, lpNumberOfBytesWritten=0x2ae4b4*=0x180, lpOverlapped=0x0) returned 1 [0049.521] CloseHandle (hObject=0x274) returned 1 [0049.521] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", lpFilePart=0x0) returned 0x3d [0049.521] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.anonymous", lpFilePart=0x0) returned 0x47 [0049.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0049.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdc976ce0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc75ac70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0049.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\reader\\tracker\\warning.gif.anonymous")) returned 1 [0049.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0049.522] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource", lpFilePart=0x0) returned 0x2b [0049.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\", lpFilePart=0x0) returned 0x2c [0049.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0049.522] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.523] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.523] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.523] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.523] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.523] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.523] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.524] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.524] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0049.524] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0049.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0049.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0049.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0049.524] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource", lpFilePart=0x0) returned 0x2b [0049.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\", lpFilePart=0x0) returned 0x2c [0049.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0049.524] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0049.525] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0049.526] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0049.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0049.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0049.526] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", lpFilePart=0x0) returned 0x36 [0049.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0049.526] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\enutxt.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.526] GetFileType (hFile=0x274) returned 0x1 [0049.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0049.526] GetFileType (hFile=0x274) returned 0x1 [0049.526] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1d9e [0049.526] ReadFile (in: hFile=0x274, lpBuffer=0x19b00c4, nNumberOfBytesToRead=0x1d9e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19b00c4*, lpNumberOfBytesRead=0x2ae560*=0x1d9e, lpOverlapped=0x0) returned 1 [0049.541] CloseHandle (hObject=0x274) returned 1 [0049.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", lpFilePart=0x0) returned 0x36 [0049.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0049.559] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\enutxt.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.561] GetFileType (hFile=0x274) returned 0x1 [0049.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0049.561] GetFileType (hFile=0x274) returned 0x1 [0049.561] WriteFile (in: hFile=0x274, lpBuffer=0x1a062d0*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a062d0*, lpNumberOfBytesWritten=0x2ae554*=0x1da0, lpOverlapped=0x0) returned 1 [0049.563] CloseHandle (hObject=0x274) returned 1 [0049.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", lpFilePart=0x0) returned 0x36 [0049.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf.anonymous", lpFilePart=0x0) returned 0x40 [0049.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0049.563] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\enutxt.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdbf7f0c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc7a6f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1da0)) returned 1 [0049.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\enutxt.pdf.anonymous")) returned 1 [0049.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.564] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont", lpFilePart=0x0) returned 0x33 [0049.564] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpFilePart=0x0) returned 0x34 [0049.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.565] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.565] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.566] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.567] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0049.567] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.568] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont", lpFilePart=0x0) returned 0x33 [0049.568] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpFilePart=0x0) returned 0x34 [0049.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.569] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.570] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.570] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.570] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.570] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.570] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.571] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.571] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.571] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.571] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0049.571] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap", lpFilePart=0x0) returned 0x30 [0049.573] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpFilePart=0x0) returned 0x31 [0049.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.574] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.585] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.585] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.585] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.586] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.587] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.588] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.589] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.590] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.590] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.590] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.590] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.590] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.591] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.592] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.593] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.594] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.594] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.594] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.594] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.594] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.594] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.595] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.596] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.597] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.598] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.599] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.599] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.599] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.599] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.599] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.599] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0049.599] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.601] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap", lpFilePart=0x0) returned 0x30 [0049.601] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpFilePart=0x0) returned 0x31 [0049.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\CMap\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.602] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.602] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.602] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.602] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.602] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.602] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.603] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.604] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.605] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0049.606] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font", lpFilePart=0x0) returned 0x30 [0049.608] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\", lpFilePart=0x0) returned 0x31 [0049.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.610] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.611] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font", lpFilePart=0x0) returned 0x30 [0049.611] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\", lpFilePart=0x0) returned 0x31 [0049.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.613] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0049.614] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM", lpFilePart=0x0) returned 0x34 [0049.614] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpFilePart=0x0) returned 0x35 [0049.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0049.616] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0049.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0049.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM", lpFilePart=0x0) returned 0x34 [0049.616] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpFilePart=0x0) returned 0x35 [0049.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0049.616] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0049.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.617] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics", lpFilePart=0x0) returned 0x37 [0049.617] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\", lpFilePart=0x0) returned 0x38 [0049.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.617] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0049.617] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics", lpFilePart=0x0) returned 0x37 [0049.617] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\", lpFilePart=0x0) returned 0x38 [0049.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbebd8 [0049.618] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0049.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0049.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0049.618] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2", lpFilePart=0x0) returned 0x46 [0049.618] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpFilePart=0x0) returned 0x47 [0049.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0049.641] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0049.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0049.642] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2", lpFilePart=0x0) returned 0x46 [0049.642] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpFilePart=0x0) returned 0x47 [0049.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbebd8 [0049.646] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0049.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0049.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0049.648] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", lpFilePart=0x0) returned 0x62 [0049.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.648] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.650] GetFileType (hFile=0x274) returned 0x1 [0049.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.650] GetFileType (hFile=0x274) returned 0x1 [0049.650] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c88 [0049.660] CloseHandle (hObject=0x274) returned 1 [0049.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", lpFilePart=0x0) returned 0x62 [0049.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.679] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.680] GetFileType (hFile=0x274) returned 0x1 [0049.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.680] GetFileType (hFile=0x274) returned 0x1 [0049.680] WriteFile (in: hFile=0x274, lpBuffer=0x1ac7088*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ac7088*, lpNumberOfBytesWritten=0x2ae46c*=0x6c90, lpOverlapped=0x0) returned 1 [0049.682] CloseHandle (hObject=0x274) returned 1 [0049.682] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", lpFilePart=0x0) returned 0x62 [0049.682] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt.anonymous", lpFilePart=0x0) returned 0x6c [0049.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc8d7a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c90)) returned 1 [0049.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt.anonymous")) returned 1 [0049.684] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", lpFilePart=0x0) returned 0x65 [0049.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.684] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.685] GetFileType (hFile=0x274) returned 0x1 [0049.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.685] GetFileType (hFile=0x274) returned 0x1 [0049.685] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c88 [0049.687] CloseHandle (hObject=0x274) returned 1 [0049.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", lpFilePart=0x0) returned 0x65 [0049.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.702] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.703] GetFileType (hFile=0x274) returned 0x1 [0049.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.703] GetFileType (hFile=0x274) returned 0x1 [0049.703] WriteFile (in: hFile=0x274, lpBuffer=0x195378c*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x195378c*, lpNumberOfBytesWritten=0x2ae46c*=0x6c90, lpOverlapped=0x0) returned 1 [0049.705] CloseHandle (hObject=0x274) returned 1 [0049.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", lpFilePart=0x0) returned 0x65 [0049.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.705] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc8fdb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c90)) returned 1 [0049.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt.anonymous")) returned 1 [0049.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", lpFilePart=0x0) returned 0x65 [0049.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.706] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.706] GetFileType (hFile=0x274) returned 0x1 [0049.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.706] GetFileType (hFile=0x274) returned 0x1 [0049.706] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.706] ReadFile (in: hFile=0x274, lpBuffer=0x195a9ec, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x195a9ec*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.708] CloseHandle (hObject=0x274) returned 1 [0049.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", lpFilePart=0x0) returned 0x65 [0049.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.742] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.744] GetFileType (hFile=0x274) returned 0x1 [0049.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.744] GetFileType (hFile=0x274) returned 0x1 [0049.744] WriteFile (in: hFile=0x274, lpBuffer=0x19c9854*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19c9854*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.745] CloseHandle (hObject=0x274) returned 1 [0049.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", lpFilePart=0x0) returned 0x65 [0049.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.746] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc96ffb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt.anonymous")) returned 1 [0049.746] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", lpFilePart=0x0) returned 0x65 [0049.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.746] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.746] GetFileType (hFile=0x274) returned 0x1 [0049.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.746] GetFileType (hFile=0x274) returned 0x1 [0049.747] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.747] ReadFile (in: hFile=0x274, lpBuffer=0x19d0ac4, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19d0ac4*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.754] CloseHandle (hObject=0x274) returned 1 [0049.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", lpFilePart=0x0) returned 0x65 [0049.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.766] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.768] GetFileType (hFile=0x274) returned 0x1 [0049.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.768] GetFileType (hFile=0x274) returned 0x1 [0049.768] WriteFile (in: hFile=0x274, lpBuffer=0x1a3f7d0*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3f7d0*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.777] CloseHandle (hObject=0x274) returned 1 [0049.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", lpFilePart=0x0) returned 0x65 [0049.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.777] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbc9bc270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt.anonymous")) returned 1 [0049.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", lpFilePart=0x0) returned 0x65 [0049.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.778] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.779] GetFileType (hFile=0x274) returned 0x1 [0049.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.779] GetFileType (hFile=0x274) returned 0x1 [0049.779] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.779] ReadFile (in: hFile=0x274, lpBuffer=0x1a46a40, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a46a40*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.790] CloseHandle (hObject=0x274) returned 1 [0049.802] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", lpFilePart=0x0) returned 0x65 [0049.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.802] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.803] GetFileType (hFile=0x274) returned 0x1 [0049.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.803] GetFileType (hFile=0x274) returned 0x1 [0049.803] WriteFile (in: hFile=0x274, lpBuffer=0x1ab574c*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ab574c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.805] CloseHandle (hObject=0x274) returned 1 [0049.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", lpFilePart=0x0) returned 0x65 [0049.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.805] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbca08530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt.anonymous")) returned 1 [0049.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", lpFilePart=0x0) returned 0x65 [0049.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.806] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.806] GetFileType (hFile=0x274) returned 0x1 [0049.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.806] GetFileType (hFile=0x274) returned 0x1 [0049.806] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.806] ReadFile (in: hFile=0x274, lpBuffer=0x1abc9bc, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1abc9bc*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.808] CloseHandle (hObject=0x274) returned 1 [0049.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", lpFilePart=0x0) returned 0x65 [0049.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.821] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.822] GetFileType (hFile=0x274) returned 0x1 [0049.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.823] GetFileType (hFile=0x274) returned 0x1 [0049.823] WriteFile (in: hFile=0x274, lpBuffer=0x1b2b6c8*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b2b6c8*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.824] CloseHandle (hObject=0x274) returned 1 [0049.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", lpFilePart=0x0) returned 0x65 [0049.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.824] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbca2e690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt.anonymous")) returned 1 [0049.825] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", lpFilePart=0x0) returned 0x65 [0049.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.825] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.825] GetFileType (hFile=0x274) returned 0x1 [0049.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.825] GetFileType (hFile=0x274) returned 0x1 [0049.825] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.825] ReadFile (in: hFile=0x274, lpBuffer=0x1b32938, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b32938*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.834] CloseHandle (hObject=0x274) returned 1 [0049.878] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", lpFilePart=0x0) returned 0x65 [0049.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.878] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.884] GetFileType (hFile=0x274) returned 0x1 [0049.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.884] GetFileType (hFile=0x274) returned 0x1 [0049.884] WriteFile (in: hFile=0x274, lpBuffer=0x19a86e4*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19a86e4*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.886] CloseHandle (hObject=0x274) returned 1 [0049.886] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", lpFilePart=0x0) returned 0x65 [0049.886] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.886] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcac6c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt.anonymous")) returned 1 [0049.887] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", lpFilePart=0x0) returned 0x65 [0049.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.887] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.887] GetFileType (hFile=0x274) returned 0x1 [0049.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.887] GetFileType (hFile=0x274) returned 0x1 [0049.887] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.887] ReadFile (in: hFile=0x274, lpBuffer=0x19af954, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19af954*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.889] CloseHandle (hObject=0x274) returned 1 [0049.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", lpFilePart=0x0) returned 0x65 [0049.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.902] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.903] GetFileType (hFile=0x274) returned 0x1 [0049.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.903] GetFileType (hFile=0x274) returned 0x1 [0049.903] WriteFile (in: hFile=0x274, lpBuffer=0x1a1e7bc*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a1e7bc*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.905] CloseHandle (hObject=0x274) returned 1 [0049.905] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", lpFilePart=0x0) returned 0x65 [0049.905] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.905] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcaecd70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt.anonymous")) returned 1 [0049.905] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt", lpFilePart=0x0) returned 0x65 [0049.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.906] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.906] GetFileType (hFile=0x274) returned 0x1 [0049.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.906] GetFileType (hFile=0x274) returned 0x1 [0049.906] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.906] ReadFile (in: hFile=0x274, lpBuffer=0x1a25a2c, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a25a2c*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.908] CloseHandle (hObject=0x274) returned 1 [0049.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt", lpFilePart=0x0) returned 0x65 [0049.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.920] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.922] GetFileType (hFile=0x274) returned 0x1 [0049.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.922] GetFileType (hFile=0x274) returned 0x1 [0049.922] WriteFile (in: hFile=0x274, lpBuffer=0x1a94738*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a94738*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.923] CloseHandle (hObject=0x274) returned 1 [0049.923] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt", lpFilePart=0x0) returned 0x65 [0049.923] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.923] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcb12ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt.anonymous")) returned 1 [0049.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", lpFilePart=0x0) returned 0x65 [0049.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.924] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.924] GetFileType (hFile=0x274) returned 0x1 [0049.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.924] GetFileType (hFile=0x274) returned 0x1 [0049.925] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.925] ReadFile (in: hFile=0x274, lpBuffer=0x1a9b9a8, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a9b9a8*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.926] CloseHandle (hObject=0x274) returned 1 [0049.938] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", lpFilePart=0x0) returned 0x65 [0049.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.939] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.940] GetFileType (hFile=0x274) returned 0x1 [0049.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.940] GetFileType (hFile=0x274) returned 0x1 [0049.940] WriteFile (in: hFile=0x274, lpBuffer=0x1b0a6b4*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b0a6b4*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.942] CloseHandle (hObject=0x274) returned 1 [0049.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", lpFilePart=0x0) returned 0x65 [0049.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.942] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcb5f190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt.anonymous")) returned 1 [0049.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt", lpFilePart=0x0) returned 0x65 [0049.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.943] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.943] GetFileType (hFile=0x274) returned 0x1 [0049.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.943] GetFileType (hFile=0x274) returned 0x1 [0049.943] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.943] ReadFile (in: hFile=0x274, lpBuffer=0x1b11924, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b11924*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.945] CloseHandle (hObject=0x274) returned 1 [0049.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt", lpFilePart=0x0) returned 0x65 [0049.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0049.982] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.983] GetFileType (hFile=0x274) returned 0x1 [0049.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0049.984] GetFileType (hFile=0x274) returned 0x1 [0049.984] WriteFile (in: hFile=0x274, lpBuffer=0x1980664*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1980664*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0049.985] CloseHandle (hObject=0x274) returned 1 [0049.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt", lpFilePart=0x0) returned 0x65 [0049.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt.anonymous", lpFilePart=0x0) returned 0x6f [0049.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0049.985] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcbab450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0049.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0049.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt.anonymous")) returned 1 [0049.986] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt", lpFilePart=0x0) returned 0x65 [0049.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0049.986] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0049.986] GetFileType (hFile=0x274) returned 0x1 [0049.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0049.986] GetFileType (hFile=0x274) returned 0x1 [0049.986] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0049.986] ReadFile (in: hFile=0x274, lpBuffer=0x19878d4, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19878d4*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0049.993] CloseHandle (hObject=0x274) returned 1 [0050.005] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt", lpFilePart=0x0) returned 0x65 [0050.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.006] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.007] GetFileType (hFile=0x274) returned 0x1 [0050.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.007] GetFileType (hFile=0x274) returned 0x1 [0050.007] WriteFile (in: hFile=0x274, lpBuffer=0x19f673c*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19f673c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.009] CloseHandle (hObject=0x274) returned 1 [0050.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt", lpFilePart=0x0) returned 0x65 [0050.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcbf7710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt.anonymous")) returned 1 [0050.010] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", lpFilePart=0x0) returned 0x65 [0050.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.010] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.054] GetFileType (hFile=0x274) returned 0x1 [0050.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.054] GetFileType (hFile=0x274) returned 0x1 [0050.054] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.054] ReadFile (in: hFile=0x274, lpBuffer=0x19fd9ac, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19fd9ac*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.055] CloseHandle (hObject=0x274) returned 1 [0050.068] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", lpFilePart=0x0) returned 0x65 [0050.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.068] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.069] GetFileType (hFile=0x274) returned 0x1 [0050.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.069] GetFileType (hFile=0x274) returned 0x1 [0050.069] WriteFile (in: hFile=0x274, lpBuffer=0x1a6c6b8*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a6c6b8*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.071] CloseHandle (hObject=0x274) returned 1 [0050.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", lpFilePart=0x0) returned 0x65 [0050.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.071] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4c8dc0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcc8fc90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt.anonymous")) returned 1 [0050.072] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt", lpFilePart=0x0) returned 0x65 [0050.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.072] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.072] GetFileType (hFile=0x274) returned 0x1 [0050.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.072] GetFileType (hFile=0x274) returned 0x1 [0050.072] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.072] ReadFile (in: hFile=0x274, lpBuffer=0x1a73928, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a73928*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.127] CloseHandle (hObject=0x274) returned 1 [0050.139] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt", lpFilePart=0x0) returned 0x65 [0050.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.139] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.141] GetFileType (hFile=0x274) returned 0x1 [0050.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.141] GetFileType (hFile=0x274) returned 0x1 [0050.141] WriteFile (in: hFile=0x274, lpBuffer=0x1ae2634*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ae2634*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.142] CloseHandle (hObject=0x274) returned 1 [0050.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt", lpFilePart=0x0) returned 0x65 [0050.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcd28210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt.anonymous")) returned 1 [0050.143] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt", lpFilePart=0x0) returned 0x65 [0050.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.143] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.143] GetFileType (hFile=0x274) returned 0x1 [0050.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.143] GetFileType (hFile=0x274) returned 0x1 [0050.143] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.143] ReadFile (in: hFile=0x274, lpBuffer=0x1ae98a4, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae98a4*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.145] CloseHandle (hObject=0x274) returned 1 [0050.157] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt", lpFilePart=0x0) returned 0x65 [0050.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.157] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.158] GetFileType (hFile=0x274) returned 0x1 [0050.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.158] GetFileType (hFile=0x274) returned 0x1 [0050.158] WriteFile (in: hFile=0x274, lpBuffer=0x1b585b0*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b585b0*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.162] CloseHandle (hObject=0x274) returned 1 [0050.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt", lpFilePart=0x0) returned 0x65 [0050.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.162] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcd744d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt.anonymous")) returned 1 [0050.175] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt", lpFilePart=0x0) returned 0x65 [0050.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.178] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.178] GetFileType (hFile=0x274) returned 0x1 [0050.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.178] GetFileType (hFile=0x274) returned 0x1 [0050.178] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.178] ReadFile (in: hFile=0x274, lpBuffer=0x19539ec, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19539ec*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.199] CloseHandle (hObject=0x274) returned 1 [0050.235] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt", lpFilePart=0x0) returned 0x65 [0050.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.235] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.236] GetFileType (hFile=0x274) returned 0x1 [0050.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.236] GetFileType (hFile=0x274) returned 0x1 [0050.236] WriteFile (in: hFile=0x274, lpBuffer=0x19c2854*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19c2854*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.238] CloseHandle (hObject=0x274) returned 1 [0050.238] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt", lpFilePart=0x0) returned 0x65 [0050.238] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.238] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbce0ca50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt.anonymous")) returned 1 [0050.239] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt", lpFilePart=0x0) returned 0x65 [0050.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.239] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.240] GetFileType (hFile=0x274) returned 0x1 [0050.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.240] GetFileType (hFile=0x274) returned 0x1 [0050.241] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.241] ReadFile (in: hFile=0x274, lpBuffer=0x19c9ac4, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19c9ac4*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.242] CloseHandle (hObject=0x274) returned 1 [0050.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt", lpFilePart=0x0) returned 0x65 [0050.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.254] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.256] GetFileType (hFile=0x274) returned 0x1 [0050.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.256] GetFileType (hFile=0x274) returned 0x1 [0050.256] WriteFile (in: hFile=0x274, lpBuffer=0x1a387d0*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a387d0*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.257] CloseHandle (hObject=0x274) returned 1 [0050.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt", lpFilePart=0x0) returned 0x65 [0050.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbce58d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt.anonymous")) returned 1 [0050.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt", lpFilePart=0x0) returned 0x65 [0050.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.258] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.258] GetFileType (hFile=0x274) returned 0x1 [0050.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.258] GetFileType (hFile=0x274) returned 0x1 [0050.259] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.259] ReadFile (in: hFile=0x274, lpBuffer=0x1a3fa40, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a3fa40*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.261] CloseHandle (hObject=0x274) returned 1 [0050.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt", lpFilePart=0x0) returned 0x65 [0050.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.275] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.278] GetFileType (hFile=0x274) returned 0x1 [0050.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.278] GetFileType (hFile=0x274) returned 0x1 [0050.278] WriteFile (in: hFile=0x274, lpBuffer=0x1aae74c*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1aae74c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.281] CloseHandle (hObject=0x274) returned 1 [0050.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt", lpFilePart=0x0) returned 0x65 [0050.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.281] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbce7ee70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt.anonymous")) returned 1 [0050.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt", lpFilePart=0x0) returned 0x65 [0050.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.282] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.282] GetFileType (hFile=0x274) returned 0x1 [0050.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.282] GetFileType (hFile=0x274) returned 0x1 [0050.282] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6c96 [0050.282] ReadFile (in: hFile=0x274, lpBuffer=0x1ab59bc, nNumberOfBytesToRead=0x6c96, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ab59bc*, lpNumberOfBytesRead=0x2ae478*=0x6c96, lpOverlapped=0x0) returned 1 [0050.284] CloseHandle (hObject=0x274) returned 1 [0050.296] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt", lpFilePart=0x0) returned 0x65 [0050.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.296] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.297] GetFileType (hFile=0x274) returned 0x1 [0050.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.297] GetFileType (hFile=0x274) returned 0x1 [0050.297] WriteFile (in: hFile=0x274, lpBuffer=0x1b246c8*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b246c8*, lpNumberOfBytesWritten=0x2ae46c*=0x6ca0, lpOverlapped=0x0) returned 1 [0050.299] CloseHandle (hObject=0x274) returned 1 [0050.299] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt", lpFilePart=0x0) returned 0x65 [0050.299] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.299] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcea4fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0050.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt.anonymous")) returned 1 [0050.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt", lpFilePart=0x0) returned 0x62 [0050.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.300] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.301] GetFileType (hFile=0x274) returned 0x1 [0050.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.301] GetFileType (hFile=0x274) returned 0x1 [0050.301] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6cde [0050.301] ReadFile (in: hFile=0x274, lpBuffer=0x1b2b92c, nNumberOfBytesToRead=0x6cde, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2b92c*, lpNumberOfBytesRead=0x2ae478*=0x6cde, lpOverlapped=0x0) returned 1 [0050.318] CloseHandle (hObject=0x274) returned 1 [0050.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt", lpFilePart=0x0) returned 0x62 [0050.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.354] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.355] GetFileType (hFile=0x274) returned 0x1 [0050.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.355] GetFileType (hFile=0x274) returned 0x1 [0050.355] WriteFile (in: hFile=0x274, lpBuffer=0x19a16e0*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19a16e0*, lpNumberOfBytesWritten=0x2ae46c*=0x6ce0, lpOverlapped=0x0) returned 1 [0050.357] CloseHandle (hObject=0x274) returned 1 [0050.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt", lpFilePart=0x0) returned 0x62 [0050.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt.anonymous", lpFilePart=0x0) returned 0x6c [0050.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.357] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcf3d550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ce0)) returned 1 [0050.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt.anonymous")) returned 1 [0050.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt", lpFilePart=0x0) returned 0x65 [0050.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.357] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.358] GetFileType (hFile=0x274) returned 0x1 [0050.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.358] GetFileType (hFile=0x274) returned 0x1 [0050.358] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6cde [0050.358] ReadFile (in: hFile=0x274, lpBuffer=0x19a8978, nNumberOfBytesToRead=0x6cde, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19a8978*, lpNumberOfBytesRead=0x2ae478*=0x6cde, lpOverlapped=0x0) returned 1 [0050.360] CloseHandle (hObject=0x274) returned 1 [0050.372] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt", lpFilePart=0x0) returned 0x65 [0050.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.372] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.373] GetFileType (hFile=0x274) returned 0x1 [0050.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.373] GetFileType (hFile=0x274) returned 0x1 [0050.373] WriteFile (in: hFile=0x274, lpBuffer=0x1a17920*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a17920*, lpNumberOfBytesWritten=0x2ae46c*=0x6ce0, lpOverlapped=0x0) returned 1 [0050.375] CloseHandle (hObject=0x274) returned 1 [0050.375] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt", lpFilePart=0x0) returned 0x65 [0050.375] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.375] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcf636b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ce0)) returned 1 [0050.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt.anonymous")) returned 1 [0050.375] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt", lpFilePart=0x0) returned 0x62 [0050.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.376] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.376] GetFileType (hFile=0x274) returned 0x1 [0050.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.376] GetFileType (hFile=0x274) returned 0x1 [0050.376] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6cdc [0050.376] ReadFile (in: hFile=0x274, lpBuffer=0x1a1ebc4, nNumberOfBytesToRead=0x6cdc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a1ebc4*, lpNumberOfBytesRead=0x2ae478*=0x6cdc, lpOverlapped=0x0) returned 1 [0050.393] CloseHandle (hObject=0x274) returned 1 [0050.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt", lpFilePart=0x0) returned 0x62 [0050.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.408] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.410] GetFileType (hFile=0x274) returned 0x1 [0050.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.410] GetFileType (hFile=0x274) returned 0x1 [0050.410] WriteFile (in: hFile=0x274, lpBuffer=0x1a8da0c*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a8da0c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ce0, lpOverlapped=0x0) returned 1 [0050.411] CloseHandle (hObject=0x274) returned 1 [0050.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt", lpFilePart=0x0) returned 0x62 [0050.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt.anonymous", lpFilePart=0x0) returned 0x6c [0050.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.411] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcfd5ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ce0)) returned 1 [0050.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt.anonymous")) returned 1 [0050.412] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt", lpFilePart=0x0) returned 0x65 [0050.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.412] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.412] GetFileType (hFile=0x274) returned 0x1 [0050.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.412] GetFileType (hFile=0x274) returned 0x1 [0050.412] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6cdc [0050.412] ReadFile (in: hFile=0x274, lpBuffer=0x1a94ca4, nNumberOfBytesToRead=0x6cdc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a94ca4*, lpNumberOfBytesRead=0x2ae478*=0x6cdc, lpOverlapped=0x0) returned 1 [0050.414] CloseHandle (hObject=0x274) returned 1 [0050.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt", lpFilePart=0x0) returned 0x65 [0050.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.427] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.428] GetFileType (hFile=0x274) returned 0x1 [0050.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.428] GetFileType (hFile=0x274) returned 0x1 [0050.428] WriteFile (in: hFile=0x274, lpBuffer=0x1b03aec*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b03aec*, lpNumberOfBytesWritten=0x2ae46c*=0x6ce0, lpOverlapped=0x0) returned 1 [0050.430] CloseHandle (hObject=0x274) returned 1 [0050.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt", lpFilePart=0x0) returned 0x65 [0050.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.430] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbcffbc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ce0)) returned 1 [0050.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt.anonymous")) returned 1 [0050.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.431] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.431] GetFileType (hFile=0x274) returned 0x1 [0050.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.431] GetFileType (hFile=0x274) returned 0x1 [0050.431] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6cdc [0050.431] ReadFile (in: hFile=0x274, lpBuffer=0x1b0adbc, nNumberOfBytesToRead=0x6cdc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b0adbc*, lpNumberOfBytesRead=0x2ae478*=0x6cdc, lpOverlapped=0x0) returned 1 [0050.435] CloseHandle (hObject=0x274) returned 1 [0050.471] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.471] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.473] GetFileType (hFile=0x274) returned 0x1 [0050.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.473] GetFileType (hFile=0x274) returned 0x1 [0050.473] WriteFile (in: hFile=0x274, lpBuffer=0x1979c2c*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1979c2c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ce0, lpOverlapped=0x0) returned 1 [0050.474] CloseHandle (hObject=0x274) returned 1 [0050.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0050.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.474] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd06e050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ce0)) returned 1 [0050.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt.anonymous")) returned 1 [0050.475] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt", lpFilePart=0x0) returned 0x62 [0050.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.475] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.476] GetFileType (hFile=0x274) returned 0x1 [0050.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.476] GetFileType (hFile=0x274) returned 0x1 [0050.476] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x74c0 [0050.476] ReadFile (in: hFile=0x274, lpBuffer=0x1980f20, nNumberOfBytesToRead=0x74c0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1980f20*, lpNumberOfBytesRead=0x2ae478*=0x74c0, lpOverlapped=0x0) returned 1 [0050.489] CloseHandle (hObject=0x274) returned 1 [0050.501] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt", lpFilePart=0x0) returned 0x62 [0050.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.501] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.502] GetFileType (hFile=0x274) returned 0x1 [0050.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.502] GetFileType (hFile=0x274) returned 0x1 [0050.502] WriteFile (in: hFile=0x274, lpBuffer=0x19f2674*, nNumberOfBytesToWrite=0x74d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19f2674*, lpNumberOfBytesWritten=0x2ae46c*=0x74d0, lpOverlapped=0x0) returned 1 [0050.504] CloseHandle (hObject=0x274) returned 1 [0050.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt", lpFilePart=0x0) returned 0x62 [0050.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt.anonymous", lpFilePart=0x0) returned 0x6c [0050.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.504] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd0ba310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x74d0)) returned 1 [0050.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt.anonymous")) returned 1 [0050.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt", lpFilePart=0x0) returned 0x65 [0050.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.505] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.505] GetFileType (hFile=0x274) returned 0x1 [0050.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.505] GetFileType (hFile=0x274) returned 0x1 [0050.505] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x74c0 [0050.505] ReadFile (in: hFile=0x274, lpBuffer=0x19fa0fc, nNumberOfBytesToRead=0x74c0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19fa0fc*, lpNumberOfBytesRead=0x2ae478*=0x74c0, lpOverlapped=0x0) returned 1 [0050.516] CloseHandle (hObject=0x274) returned 1 [0050.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt", lpFilePart=0x0) returned 0x65 [0050.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.528] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.531] GetFileType (hFile=0x274) returned 0x1 [0050.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.531] GetFileType (hFile=0x274) returned 0x1 [0050.531] WriteFile (in: hFile=0x274, lpBuffer=0x1a6b6f4*, nNumberOfBytesToWrite=0x74d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a6b6f4*, lpNumberOfBytesWritten=0x2ae46c*=0x74d0, lpOverlapped=0x0) returned 1 [0050.534] CloseHandle (hObject=0x274) returned 1 [0050.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt", lpFilePart=0x0) returned 0x65 [0050.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.534] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd0e0470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x74d0)) returned 1 [0050.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt.anonymous")) returned 1 [0050.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", lpFilePart=0x0) returned 0x62 [0050.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.535] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.535] GetFileType (hFile=0x274) returned 0x1 [0050.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.535] GetFileType (hFile=0x274) returned 0x1 [0050.535] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d72 [0050.535] ReadFile (in: hFile=0x274, lpBuffer=0x1a73188, nNumberOfBytesToRead=0x6d72, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a73188*, lpNumberOfBytesRead=0x2ae478*=0x6d72, lpOverlapped=0x0) returned 1 [0050.540] CloseHandle (hObject=0x274) returned 1 [0050.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", lpFilePart=0x0) returned 0x62 [0050.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.552] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.553] GetFileType (hFile=0x274) returned 0x1 [0050.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.553] GetFileType (hFile=0x274) returned 0x1 [0050.553] WriteFile (in: hFile=0x274, lpBuffer=0x1ae22f4*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ae22f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0050.555] CloseHandle (hObject=0x274) returned 1 [0050.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt", lpFilePart=0x0) returned 0x62 [0050.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt.anonymous", lpFilePart=0x0) returned 0x6c [0050.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.555] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd12c730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0050.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt.anonymous")) returned 1 [0050.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt", lpFilePart=0x0) returned 0x65 [0050.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.556] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.556] GetFileType (hFile=0x274) returned 0x1 [0050.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.556] GetFileType (hFile=0x274) returned 0x1 [0050.556] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d72 [0050.556] ReadFile (in: hFile=0x274, lpBuffer=0x1ae962c, nNumberOfBytesToRead=0x6d72, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae962c*, lpNumberOfBytesRead=0x2ae478*=0x6d72, lpOverlapped=0x0) returned 1 [0050.561] CloseHandle (hObject=0x274) returned 1 [0050.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt", lpFilePart=0x0) returned 0x65 [0050.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.573] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.575] GetFileType (hFile=0x274) returned 0x1 [0050.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.575] GetFileType (hFile=0x274) returned 0x1 [0050.575] WriteFile (in: hFile=0x274, lpBuffer=0x1b58798*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b58798*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0050.576] CloseHandle (hObject=0x274) returned 1 [0050.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt", lpFilePart=0x0) returned 0x65 [0050.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.576] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd152890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0050.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt.anonymous")) returned 1 [0050.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt", lpFilePart=0x0) returned 0x65 [0050.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.577] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.577] GetFileType (hFile=0x274) returned 0x1 [0050.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.577] GetFileType (hFile=0x274) returned 0x1 [0050.577] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x72d6 [0050.580] ReadFile (in: hFile=0x274, lpBuffer=0x19539a0, nNumberOfBytesToRead=0x72d6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19539a0*, lpNumberOfBytesRead=0x2ae478*=0x72d6, lpOverlapped=0x0) returned 1 [0050.591] CloseHandle (hObject=0x274) returned 1 [0050.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt", lpFilePart=0x0) returned 0x65 [0050.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.625] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.626] GetFileType (hFile=0x274) returned 0x1 [0050.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.626] GetFileType (hFile=0x274) returned 0x1 [0050.626] WriteFile (in: hFile=0x274, lpBuffer=0x19c4748*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19c4748*, lpNumberOfBytesWritten=0x2ae46c*=0x72e0, lpOverlapped=0x0) returned 1 [0050.628] CloseHandle (hObject=0x274) returned 1 [0050.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt", lpFilePart=0x0) returned 0x65 [0050.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.628] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd1c4cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x72e0)) returned 1 [0050.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt.anonymous")) returned 1 [0050.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt", lpFilePart=0x0) returned 0x65 [0050.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.629] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.630] GetFileType (hFile=0x274) returned 0x1 [0050.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.630] GetFileType (hFile=0x274) returned 0x1 [0050.630] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7328 [0050.631] ReadFile (in: hFile=0x274, lpBuffer=0x19cbff8, nNumberOfBytesToRead=0x7328, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19cbff8*, lpNumberOfBytesRead=0x2ae478*=0x7328, lpOverlapped=0x0) returned 1 [0050.636] CloseHandle (hObject=0x274) returned 1 [0050.648] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt", lpFilePart=0x0) returned 0x65 [0050.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.649] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.650] GetFileType (hFile=0x274) returned 0x1 [0050.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.650] GetFileType (hFile=0x274) returned 0x1 [0050.650] WriteFile (in: hFile=0x274, lpBuffer=0x1a3cdd0*, nNumberOfBytesToWrite=0x7330, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3cdd0*, lpNumberOfBytesWritten=0x2ae46c*=0x7330, lpOverlapped=0x0) returned 1 [0050.652] CloseHandle (hObject=0x274) returned 1 [0050.652] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt", lpFilePart=0x0) returned 0x65 [0050.652] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.652] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd210f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7330)) returned 1 [0050.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt.anonymous")) returned 1 [0050.653] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.653] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.653] GetFileType (hFile=0x274) returned 0x1 [0050.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.653] GetFileType (hFile=0x274) returned 0x1 [0050.653] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7326 [0050.653] ReadFile (in: hFile=0x274, lpBuffer=0x1a446f0, nNumberOfBytesToRead=0x7326, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a446f0*, lpNumberOfBytesRead=0x2ae478*=0x7326, lpOverlapped=0x0) returned 1 [0050.688] CloseHandle (hObject=0x274) returned 1 [0050.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.704] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.705] GetFileType (hFile=0x274) returned 0x1 [0050.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.706] GetFileType (hFile=0x274) returned 0x1 [0050.706] WriteFile (in: hFile=0x274, lpBuffer=0x1ab54cc*, nNumberOfBytesToWrite=0x7330, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ab54cc*, lpNumberOfBytesWritten=0x2ae46c*=0x7330, lpOverlapped=0x0) returned 1 [0050.708] CloseHandle (hObject=0x274) returned 1 [0050.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0050.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.708] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd2a94f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7330)) returned 1 [0050.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt.anonymous")) returned 1 [0050.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt", lpFilePart=0x0) returned 0x62 [0050.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.709] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.710] GetFileType (hFile=0x274) returned 0x1 [0050.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.710] GetFileType (hFile=0x274) returned 0x1 [0050.710] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e92 [0050.710] ReadFile (in: hFile=0x274, lpBuffer=0x1abce10, nNumberOfBytesToRead=0x6e92, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1abce10*, lpNumberOfBytesRead=0x2ae478*=0x6e92, lpOverlapped=0x0) returned 1 [0050.729] CloseHandle (hObject=0x274) returned 1 [0050.747] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt", lpFilePart=0x0) returned 0x62 [0050.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.747] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.749] GetFileType (hFile=0x274) returned 0x1 [0050.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.749] GetFileType (hFile=0x274) returned 0x1 [0050.749] WriteFile (in: hFile=0x274, lpBuffer=0x1b2c51c*, nNumberOfBytesToWrite=0x6ea0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b2c51c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ea0, lpOverlapped=0x0) returned 1 [0050.751] CloseHandle (hObject=0x274) returned 1 [0050.754] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt", lpFilePart=0x0) returned 0x62 [0050.754] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt.anonymous", lpFilePart=0x0) returned 0x6c [0050.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd2f57b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ea0)) returned 1 [0050.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt.anonymous")) returned 1 [0050.755] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt", lpFilePart=0x0) returned 0x65 [0050.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.755] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.763] GetFileType (hFile=0x274) returned 0x1 [0050.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.763] GetFileType (hFile=0x274) returned 0x1 [0050.763] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e92 [0050.763] ReadFile (in: hFile=0x274, lpBuffer=0x1b33974, nNumberOfBytesToRead=0x6e92, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b33974*, lpNumberOfBytesRead=0x2ae478*=0x6e92, lpOverlapped=0x0) returned 1 [0050.767] CloseHandle (hObject=0x274) returned 1 [0050.816] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt", lpFilePart=0x0) returned 0x65 [0050.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.816] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.819] GetFileType (hFile=0x274) returned 0x1 [0050.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.819] GetFileType (hFile=0x274) returned 0x1 [0050.820] WriteFile (in: hFile=0x274, lpBuffer=0x19aa0f4*, nNumberOfBytesToWrite=0x6ea0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19aa0f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6ea0, lpOverlapped=0x0) returned 1 [0050.823] CloseHandle (hObject=0x274) returned 1 [0050.825] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt", lpFilePart=0x0) returned 0x65 [0050.825] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.825] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd3b3e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ea0)) returned 1 [0050.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt.anonymous")) returned 1 [0050.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.826] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.826] GetFileType (hFile=0x274) returned 0x1 [0050.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.826] GetFileType (hFile=0x274) returned 0x1 [0050.826] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e76 [0050.826] ReadFile (in: hFile=0x274, lpBuffer=0x19b1584, nNumberOfBytesToRead=0x6e76, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19b1584*, lpNumberOfBytesRead=0x2ae478*=0x6e76, lpOverlapped=0x0) returned 1 [0050.846] CloseHandle (hObject=0x274) returned 1 [0050.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.864] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.866] GetFileType (hFile=0x274) returned 0x1 [0050.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.866] GetFileType (hFile=0x274) returned 0x1 [0050.866] WriteFile (in: hFile=0x274, lpBuffer=0x1a20d4c*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a20d4c*, lpNumberOfBytesWritten=0x2ae46c*=0x6e80, lpOverlapped=0x0) returned 1 [0050.868] CloseHandle (hObject=0x274) returned 1 [0050.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0050.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0050.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.868] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd4262b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e80)) returned 1 [0050.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt.anonymous")) returned 1 [0050.869] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt", lpFilePart=0x0) returned 0x65 [0050.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.869] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.869] GetFileType (hFile=0x274) returned 0x1 [0050.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.869] GetFileType (hFile=0x274) returned 0x1 [0050.869] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0050.869] ReadFile (in: hFile=0x274, lpBuffer=0x1a281ec, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a281ec*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0050.885] CloseHandle (hObject=0x274) returned 1 [0050.903] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt", lpFilePart=0x0) returned 0x65 [0050.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.903] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.905] GetFileType (hFile=0x274) returned 0x1 [0050.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.905] GetFileType (hFile=0x274) returned 0x1 [0050.905] WriteFile (in: hFile=0x274, lpBuffer=0x1a978a4*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a978a4*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0050.906] CloseHandle (hObject=0x274) returned 1 [0050.907] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt", lpFilePart=0x0) returned 0x65 [0050.907] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.907] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd472570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0050.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt.anonymous")) returned 1 [0050.908] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt", lpFilePart=0x0) returned 0x65 [0050.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.908] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.908] GetFileType (hFile=0x274) returned 0x1 [0050.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.908] GetFileType (hFile=0x274) returned 0x1 [0050.908] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0050.908] ReadFile (in: hFile=0x274, lpBuffer=0x1a9ed04, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a9ed04*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0050.935] CloseHandle (hObject=0x274) returned 1 [0050.987] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt", lpFilePart=0x0) returned 0x65 [0050.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0050.987] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.989] GetFileType (hFile=0x274) returned 0x1 [0050.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0050.989] GetFileType (hFile=0x274) returned 0x1 [0050.989] WriteFile (in: hFile=0x274, lpBuffer=0x1b0e3bc*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b0e3bc*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0050.991] CloseHandle (hObject=0x274) returned 1 [0050.991] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt", lpFilePart=0x0) returned 0x65 [0050.991] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.anonymous", lpFilePart=0x0) returned 0x6f [0050.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0050.991] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd556db0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0050.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0050.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt.anonymous")) returned 1 [0050.992] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt", lpFilePart=0x0) returned 0x6a [0050.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0050.992] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0050.992] GetFileType (hFile=0x274) returned 0x1 [0050.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0050.992] GetFileType (hFile=0x274) returned 0x1 [0050.993] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0050.993] ReadFile (in: hFile=0x274, lpBuffer=0x1b15830, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b15830*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0051.011] CloseHandle (hObject=0x274) returned 1 [0051.059] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt", lpFilePart=0x0) returned 0x6a [0051.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.059] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.060] GetFileType (hFile=0x274) returned 0x1 [0051.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.060] GetFileType (hFile=0x274) returned 0x1 [0051.060] WriteFile (in: hFile=0x274, lpBuffer=0x1984f28*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1984f28*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0051.062] CloseHandle (hObject=0x274) returned 1 [0051.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt", lpFilePart=0x0) returned 0x6a [0051.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.anonymous", lpFilePart=0x0) returned 0x74 [0051.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.062] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd5ef330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0051.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt.anonymous")) returned 1 [0051.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt", lpFilePart=0x0) returned 0x65 [0051.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.063] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.063] GetFileType (hFile=0x274) returned 0x1 [0051.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.064] GetFileType (hFile=0x274) returned 0x1 [0051.064] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0051.064] ReadFile (in: hFile=0x274, lpBuffer=0x198c3c0, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x198c3c0*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0051.080] CloseHandle (hObject=0x274) returned 1 [0051.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt", lpFilePart=0x0) returned 0x65 [0051.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.098] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.099] GetFileType (hFile=0x274) returned 0x1 [0051.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.099] GetFileType (hFile=0x274) returned 0x1 [0051.099] WriteFile (in: hFile=0x274, lpBuffer=0x19fbbd4*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19fbbd4*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0051.101] CloseHandle (hObject=0x274) returned 1 [0051.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt", lpFilePart=0x0) returned 0x65 [0051.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd661750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0051.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt.anonymous")) returned 1 [0051.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt", lpFilePart=0x0) returned 0x6b [0051.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.102] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.103] GetFileType (hFile=0x274) returned 0x1 [0051.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.103] GetFileType (hFile=0x274) returned 0x1 [0051.103] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0051.103] ReadFile (in: hFile=0x274, lpBuffer=0x1a0304c, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a0304c*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0051.114] CloseHandle (hObject=0x274) returned 1 [0051.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt", lpFilePart=0x0) returned 0x6b [0051.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.132] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.134] GetFileType (hFile=0x274) returned 0x1 [0051.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.134] GetFileType (hFile=0x274) returned 0x1 [0051.134] WriteFile (in: hFile=0x274, lpBuffer=0x1a72704*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a72704*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0051.136] CloseHandle (hObject=0x274) returned 1 [0051.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt", lpFilePart=0x0) returned 0x6b [0051.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.anonymous", lpFilePart=0x0) returned 0x75 [0051.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.136] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaed56c0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd6ada10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0051.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt.anonymous")) returned 1 [0051.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt", lpFilePart=0x0) returned 0x62 [0051.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.137] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.138] GetFileType (hFile=0x274) returned 0x1 [0051.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.138] GetFileType (hFile=0x274) returned 0x1 [0051.138] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec4 [0051.138] ReadFile (in: hFile=0x274, lpBuffer=0x1a79b94, nNumberOfBytesToRead=0x6ec4, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a79b94*, lpNumberOfBytesRead=0x2ae478*=0x6ec4, lpOverlapped=0x0) returned 1 [0051.144] CloseHandle (hObject=0x274) returned 1 [0051.163] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt", lpFilePart=0x0) returned 0x62 [0051.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.163] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.164] GetFileType (hFile=0x274) returned 0x1 [0051.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.165] GetFileType (hFile=0x274) returned 0x1 [0051.165] WriteFile (in: hFile=0x274, lpBuffer=0x1ae938c*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ae938c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.166] CloseHandle (hObject=0x274) returned 1 [0051.166] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt", lpFilePart=0x0) returned 0x62 [0051.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt.anonymous", lpFilePart=0x0) returned 0x6c [0051.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.167] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd6f9cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt.anonymous")) returned 1 [0051.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt", lpFilePart=0x0) returned 0x65 [0051.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.167] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.168] GetFileType (hFile=0x274) returned 0x1 [0051.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.168] GetFileType (hFile=0x274) returned 0x1 [0051.168] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.168] ReadFile (in: hFile=0x274, lpBuffer=0x1af0814, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1af0814*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.177] CloseHandle (hObject=0x274) returned 1 [0051.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt", lpFilePart=0x0) returned 0x65 [0051.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.194] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.195] GetFileType (hFile=0x274) returned 0x1 [0051.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.195] GetFileType (hFile=0x274) returned 0x1 [0051.195] WriteFile (in: hFile=0x274, lpBuffer=0x1968b68*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1968b68*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.197] CloseHandle (hObject=0x274) returned 1 [0051.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt", lpFilePart=0x0) returned 0x65 [0051.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd745f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt.anonymous")) returned 1 [0051.198] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt", lpFilePart=0x0) returned 0x65 [0051.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.198] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.198] GetFileType (hFile=0x274) returned 0x1 [0051.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.198] GetFileType (hFile=0x274) returned 0x1 [0051.198] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.198] ReadFile (in: hFile=0x274, lpBuffer=0x1970008, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1970008*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.207] CloseHandle (hObject=0x274) returned 1 [0051.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt", lpFilePart=0x0) returned 0x65 [0051.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.240] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.241] GetFileType (hFile=0x274) returned 0x1 [0051.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.242] GetFileType (hFile=0x274) returned 0x1 [0051.242] WriteFile (in: hFile=0x274, lpBuffer=0x19df95c*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19df95c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.243] CloseHandle (hObject=0x274) returned 1 [0051.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt", lpFilePart=0x0) returned 0x65 [0051.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.243] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd7b83b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt.anonymous")) returned 1 [0051.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt", lpFilePart=0x0) returned 0x65 [0051.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.244] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.244] GetFileType (hFile=0x274) returned 0x1 [0051.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.245] GetFileType (hFile=0x274) returned 0x1 [0051.245] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.245] ReadFile (in: hFile=0x274, lpBuffer=0x19e6dfc, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e6dfc*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.251] CloseHandle (hObject=0x274) returned 1 [0051.262] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt", lpFilePart=0x0) returned 0x65 [0051.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.262] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.264] GetFileType (hFile=0x274) returned 0x1 [0051.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.264] GetFileType (hFile=0x274) returned 0x1 [0051.264] WriteFile (in: hFile=0x274, lpBuffer=0x1a565f4*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a565f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.265] CloseHandle (hObject=0x274) returned 1 [0051.265] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt", lpFilePart=0x0) returned 0x65 [0051.265] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.265] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd7de510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt.anonymous")) returned 1 [0051.266] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt", lpFilePart=0x0) returned 0x65 [0051.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.266] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.266] GetFileType (hFile=0x274) returned 0x1 [0051.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.267] GetFileType (hFile=0x274) returned 0x1 [0051.267] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ed0 [0051.267] ReadFile (in: hFile=0x274, lpBuffer=0x1a5da94, nNumberOfBytesToRead=0x6ed0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a5da94*, lpNumberOfBytesRead=0x2ae478*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.297] CloseHandle (hObject=0x274) returned 1 [0051.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt", lpFilePart=0x0) returned 0x65 [0051.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.310] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.311] GetFileType (hFile=0x274) returned 0x1 [0051.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.311] GetFileType (hFile=0x274) returned 0x1 [0051.311] WriteFile (in: hFile=0x274, lpBuffer=0x1acd2dc*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1acd2dc*, lpNumberOfBytesWritten=0x2ae46c*=0x6ee0, lpOverlapped=0x0) returned 1 [0051.312] CloseHandle (hObject=0x274) returned 1 [0051.313] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt", lpFilePart=0x0) returned 0x65 [0051.313] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.313] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd850930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ee0)) returned 1 [0051.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt.anonymous")) returned 1 [0051.313] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt", lpFilePart=0x0) returned 0x65 [0051.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.313] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.314] GetFileType (hFile=0x274) returned 0x1 [0051.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.314] GetFileType (hFile=0x274) returned 0x1 [0051.314] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.314] ReadFile (in: hFile=0x274, lpBuffer=0x1ad478c, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ad478c*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.335] CloseHandle (hObject=0x274) returned 1 [0051.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt", lpFilePart=0x0) returned 0x65 [0051.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.354] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.356] GetFileType (hFile=0x274) returned 0x1 [0051.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.356] GetFileType (hFile=0x274) returned 0x1 [0051.356] WriteFile (in: hFile=0x274, lpBuffer=0x1b43f84*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b43f84*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.358] CloseHandle (hObject=0x274) returned 1 [0051.358] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt", lpFilePart=0x0) returned 0x65 [0051.358] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.358] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd8c2d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt.anonymous")) returned 1 [0051.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt", lpFilePart=0x0) returned 0x65 [0051.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.359] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.359] GetFileType (hFile=0x274) returned 0x1 [0051.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.360] GetFileType (hFile=0x274) returned 0x1 [0051.360] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.360] ReadFile (in: hFile=0x274, lpBuffer=0x1b4b424, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b4b424*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.378] CloseHandle (hObject=0x274) returned 1 [0051.421] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt", lpFilePart=0x0) returned 0x65 [0051.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.421] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.424] GetFileType (hFile=0x274) returned 0x1 [0051.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.424] GetFileType (hFile=0x274) returned 0x1 [0051.424] WriteFile (in: hFile=0x274, lpBuffer=0x19acb30*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19acb30*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.426] CloseHandle (hObject=0x274) returned 1 [0051.426] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt", lpFilePart=0x0) returned 0x65 [0051.426] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.426] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd981430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt.anonymous")) returned 1 [0051.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt", lpFilePart=0x0) returned 0x65 [0051.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.427] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.428] GetFileType (hFile=0x274) returned 0x1 [0051.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.428] GetFileType (hFile=0x274) returned 0x1 [0051.428] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec6 [0051.428] ReadFile (in: hFile=0x274, lpBuffer=0x19b3fd0, nNumberOfBytesToRead=0x6ec6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19b3fd0*, lpNumberOfBytesRead=0x2ae478*=0x6ec6, lpOverlapped=0x0) returned 1 [0051.446] CloseHandle (hObject=0x274) returned 1 [0051.464] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt", lpFilePart=0x0) returned 0x65 [0051.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.464] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.466] GetFileType (hFile=0x274) returned 0x1 [0051.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.466] GetFileType (hFile=0x274) returned 0x1 [0051.466] WriteFile (in: hFile=0x274, lpBuffer=0x1a23928*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a23928*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.468] CloseHandle (hObject=0x274) returned 1 [0051.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt", lpFilePart=0x0) returned 0x65 [0051.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.468] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbd9cd6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt.anonymous")) returned 1 [0051.469] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt", lpFilePart=0x0) returned 0x65 [0051.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.469] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.470] GetFileType (hFile=0x274) returned 0x1 [0051.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.470] GetFileType (hFile=0x274) returned 0x1 [0051.470] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec0 [0051.470] ReadFile (in: hFile=0x274, lpBuffer=0x1a2adc8, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2adc8*, lpNumberOfBytesRead=0x2ae478*=0x6ec0, lpOverlapped=0x0) returned 1 [0051.487] CloseHandle (hObject=0x274) returned 1 [0051.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt", lpFilePart=0x0) returned 0x65 [0051.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.505] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.507] GetFileType (hFile=0x274) returned 0x1 [0051.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.507] GetFileType (hFile=0x274) returned 0x1 [0051.507] WriteFile (in: hFile=0x274, lpBuffer=0x1a9a5c0*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a9a5c0*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.509] CloseHandle (hObject=0x274) returned 1 [0051.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt", lpFilePart=0x0) returned 0x65 [0051.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.509] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbda3fb10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt.anonymous")) returned 1 [0051.510] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0051.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.510] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.511] GetFileType (hFile=0x274) returned 0x1 [0051.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.511] GetFileType (hFile=0x274) returned 0x1 [0051.511] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.511] ReadFile (in: hFile=0x274, lpBuffer=0x1aa1a80, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aa1a80*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.527] CloseHandle (hObject=0x274) returned 1 [0051.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0051.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.544] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.545] GetFileType (hFile=0x274) returned 0x1 [0051.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.545] GetFileType (hFile=0x274) returned 0x1 [0051.545] WriteFile (in: hFile=0x274, lpBuffer=0x1b11278*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b11278*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.547] CloseHandle (hObject=0x274) returned 1 [0051.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0051.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0051.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.547] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbda8bdd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt.anonymous")) returned 1 [0051.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt", lpFilePart=0x0) returned 0x65 [0051.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.548] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.549] GetFileType (hFile=0x274) returned 0x1 [0051.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.549] GetFileType (hFile=0x274) returned 0x1 [0051.549] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.549] ReadFile (in: hFile=0x274, lpBuffer=0x1b18768, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b18768*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.550] CloseHandle (hObject=0x274) returned 1 [0051.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt", lpFilePart=0x0) returned 0x65 [0051.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.588] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.589] GetFileType (hFile=0x274) returned 0x1 [0051.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.589] GetFileType (hFile=0x274) returned 0x1 [0051.589] WriteFile (in: hFile=0x274, lpBuffer=0x1987f88*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1987f88*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.591] CloseHandle (hObject=0x274) returned 1 [0051.591] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt", lpFilePart=0x0) returned 0x65 [0051.591] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.591] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdafe1f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt.anonymous")) returned 1 [0051.592] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt", lpFilePart=0x0) returned 0x65 [0051.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.592] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.592] GetFileType (hFile=0x274) returned 0x1 [0051.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.592] GetFileType (hFile=0x274) returned 0x1 [0051.592] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.592] ReadFile (in: hFile=0x274, lpBuffer=0x198f428, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x198f428*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.617] CloseHandle (hObject=0x274) returned 1 [0051.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt", lpFilePart=0x0) returned 0x65 [0051.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.630] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.631] GetFileType (hFile=0x274) returned 0x1 [0051.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.631] GetFileType (hFile=0x274) returned 0x1 [0051.631] WriteFile (in: hFile=0x274, lpBuffer=0x19fed7c*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19fed7c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.632] CloseHandle (hObject=0x274) returned 1 [0051.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt", lpFilePart=0x0) returned 0x65 [0051.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.633] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdb70610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt.anonymous")) returned 1 [0051.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", lpFilePart=0x0) returned 0x65 [0051.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.633] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.634] GetFileType (hFile=0x274) returned 0x1 [0051.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.634] GetFileType (hFile=0x274) returned 0x1 [0051.634] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec0 [0051.634] ReadFile (in: hFile=0x274, lpBuffer=0x1a0621c, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a0621c*, lpNumberOfBytesRead=0x2ae478*=0x6ec0, lpOverlapped=0x0) returned 1 [0051.656] CloseHandle (hObject=0x274) returned 1 [0051.668] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", lpFilePart=0x0) returned 0x65 [0051.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.668] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.669] GetFileType (hFile=0x274) returned 0x1 [0051.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.670] GetFileType (hFile=0x274) returned 0x1 [0051.670] WriteFile (in: hFile=0x274, lpBuffer=0x1a75a14*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a75a14*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.671] CloseHandle (hObject=0x274) returned 1 [0051.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", lpFilePart=0x0) returned 0x65 [0051.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.672] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdbbc8d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt.anonymous")) returned 1 [0051.672] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt", lpFilePart=0x0) returned 0x65 [0051.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.672] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.673] GetFileType (hFile=0x274) returned 0x1 [0051.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.673] GetFileType (hFile=0x274) returned 0x1 [0051.673] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ecc [0051.673] ReadFile (in: hFile=0x274, lpBuffer=0x1a7ceb4, nNumberOfBytesToRead=0x6ecc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a7ceb4*, lpNumberOfBytesRead=0x2ae478*=0x6ecc, lpOverlapped=0x0) returned 1 [0051.694] CloseHandle (hObject=0x274) returned 1 [0051.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt", lpFilePart=0x0) returned 0x65 [0051.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.706] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.707] GetFileType (hFile=0x274) returned 0x1 [0051.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.707] GetFileType (hFile=0x274) returned 0x1 [0051.707] WriteFile (in: hFile=0x274, lpBuffer=0x1aec6ac*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1aec6ac*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.709] CloseHandle (hObject=0x274) returned 1 [0051.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt", lpFilePart=0x0) returned 0x65 [0051.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.709] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdc2ecf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt.anonymous")) returned 1 [0051.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt", lpFilePart=0x0) returned 0x65 [0051.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.710] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.710] GetFileType (hFile=0x274) returned 0x1 [0051.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.710] GetFileType (hFile=0x274) returned 0x1 [0051.710] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.710] ReadFile (in: hFile=0x274, lpBuffer=0x1af3b4c, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1af3b4c*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.712] CloseHandle (hObject=0x274) returned 1 [0051.726] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt", lpFilePart=0x0) returned 0x65 [0051.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.726] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.727] GetFileType (hFile=0x274) returned 0x1 [0051.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.727] GetFileType (hFile=0x274) returned 0x1 [0051.727] WriteFile (in: hFile=0x274, lpBuffer=0x1968b68*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1968b68*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.729] CloseHandle (hObject=0x274) returned 1 [0051.729] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt", lpFilePart=0x0) returned 0x65 [0051.729] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.729] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae89400, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdc54e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt.anonymous")) returned 1 [0051.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt", lpFilePart=0x0) returned 0x65 [0051.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.730] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.730] GetFileType (hFile=0x274) returned 0x1 [0051.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.730] GetFileType (hFile=0x274) returned 0x1 [0051.730] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.731] ReadFile (in: hFile=0x274, lpBuffer=0x1970008, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1970008*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.732] CloseHandle (hObject=0x274) returned 1 [0051.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt", lpFilePart=0x0) returned 0x65 [0051.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.768] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.769] GetFileType (hFile=0x274) returned 0x1 [0051.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.769] GetFileType (hFile=0x274) returned 0x1 [0051.769] WriteFile (in: hFile=0x274, lpBuffer=0x19df95c*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19df95c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.770] CloseHandle (hObject=0x274) returned 1 [0051.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt", lpFilePart=0x0) returned 0x65 [0051.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.770] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdcc7270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt.anonymous")) returned 1 [0051.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt", lpFilePart=0x0) returned 0x65 [0051.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.771] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.771] GetFileType (hFile=0x274) returned 0x1 [0051.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.771] GetFileType (hFile=0x274) returned 0x1 [0051.771] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.772] ReadFile (in: hFile=0x274, lpBuffer=0x19e6dfc, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e6dfc*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.783] CloseHandle (hObject=0x274) returned 1 [0051.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt", lpFilePart=0x0) returned 0x65 [0051.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.796] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.797] GetFileType (hFile=0x274) returned 0x1 [0051.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.797] GetFileType (hFile=0x274) returned 0x1 [0051.797] WriteFile (in: hFile=0x274, lpBuffer=0x1a565f4*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a565f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.799] CloseHandle (hObject=0x274) returned 1 [0051.799] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt", lpFilePart=0x0) returned 0x65 [0051.799] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.799] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdd13530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt.anonymous")) returned 1 [0051.799] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt", lpFilePart=0x0) returned 0x65 [0051.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.799] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.800] GetFileType (hFile=0x274) returned 0x1 [0051.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.800] GetFileType (hFile=0x274) returned 0x1 [0051.800] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.800] ReadFile (in: hFile=0x274, lpBuffer=0x1a5da94, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a5da94*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.811] CloseHandle (hObject=0x274) returned 1 [0051.823] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt", lpFilePart=0x0) returned 0x65 [0051.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.824] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.825] GetFileType (hFile=0x274) returned 0x1 [0051.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.825] GetFileType (hFile=0x274) returned 0x1 [0051.825] WriteFile (in: hFile=0x274, lpBuffer=0x1acd28c*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1acd28c*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.826] CloseHandle (hObject=0x274) returned 1 [0051.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt", lpFilePart=0x0) returned 0x65 [0051.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.827] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdd39690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt.anonymous")) returned 1 [0051.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt", lpFilePart=0x0) returned 0x65 [0051.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.827] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.828] GetFileType (hFile=0x274) returned 0x1 [0051.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.828] GetFileType (hFile=0x274) returned 0x1 [0051.828] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.828] ReadFile (in: hFile=0x274, lpBuffer=0x1ad472c, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ad472c*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.838] CloseHandle (hObject=0x274) returned 1 [0051.851] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt", lpFilePart=0x0) returned 0x65 [0051.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.851] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.853] GetFileType (hFile=0x274) returned 0x1 [0051.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.853] GetFileType (hFile=0x274) returned 0x1 [0051.853] WriteFile (in: hFile=0x274, lpBuffer=0x1b43f24*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b43f24*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.856] CloseHandle (hObject=0x274) returned 1 [0051.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt", lpFilePart=0x0) returned 0x65 [0051.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.856] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdd85950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt.anonymous")) returned 1 [0051.857] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt", lpFilePart=0x0) returned 0x65 [0051.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.857] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.857] GetFileType (hFile=0x274) returned 0x1 [0051.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.857] GetFileType (hFile=0x274) returned 0x1 [0051.857] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.857] ReadFile (in: hFile=0x274, lpBuffer=0x1b4b3c4, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b4b3c4*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.865] CloseHandle (hObject=0x274) returned 1 [0051.907] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt", lpFilePart=0x0) returned 0x65 [0051.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.907] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.908] GetFileType (hFile=0x274) returned 0x1 [0051.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.908] GetFileType (hFile=0x274) returned 0x1 [0051.909] WriteFile (in: hFile=0x274, lpBuffer=0x19acae8*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19acae8*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.910] CloseHandle (hObject=0x274) returned 1 [0051.910] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt", lpFilePart=0x0) returned 0x65 [0051.910] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.910] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbde1ded0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt.anonymous")) returned 1 [0051.911] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt", lpFilePart=0x0) returned 0x65 [0051.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.911] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.911] GetFileType (hFile=0x274) returned 0x1 [0051.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.911] GetFileType (hFile=0x274) returned 0x1 [0051.911] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.911] ReadFile (in: hFile=0x274, lpBuffer=0x19b3f88, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19b3f88*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.913] CloseHandle (hObject=0x274) returned 1 [0051.925] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt", lpFilePart=0x0) returned 0x65 [0051.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.925] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.927] GetFileType (hFile=0x274) returned 0x1 [0051.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.927] GetFileType (hFile=0x274) returned 0x1 [0051.927] WriteFile (in: hFile=0x274, lpBuffer=0x1a238dc*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a238dc*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.928] CloseHandle (hObject=0x274) returned 1 [0051.931] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt", lpFilePart=0x0) returned 0x65 [0051.931] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.931] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbde44030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt.anonymous")) returned 1 [0051.931] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt", lpFilePart=0x0) returned 0x65 [0051.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.932] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.932] GetFileType (hFile=0x274) returned 0x1 [0051.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.932] GetFileType (hFile=0x274) returned 0x1 [0051.932] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec8 [0051.932] ReadFile (in: hFile=0x274, lpBuffer=0x1a2ad7c, nNumberOfBytesToRead=0x6ec8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2ad7c*, lpNumberOfBytesRead=0x2ae478*=0x6ec8, lpOverlapped=0x0) returned 1 [0051.956] CloseHandle (hObject=0x274) returned 1 [0051.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt", lpFilePart=0x0) returned 0x65 [0051.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0051.969] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.974] GetFileType (hFile=0x274) returned 0x1 [0051.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0051.975] GetFileType (hFile=0x274) returned 0x1 [0051.975] WriteFile (in: hFile=0x274, lpBuffer=0x1a9a574*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a9a574*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0051.976] CloseHandle (hObject=0x274) returned 1 [0051.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt", lpFilePart=0x0) returned 0x65 [0051.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0051.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0051.976] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdeb6450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0051.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0051.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt.anonymous")) returned 1 [0051.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt", lpFilePart=0x0) returned 0x6f [0051.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0051.977] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0051.977] GetFileType (hFile=0x274) returned 0x1 [0051.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0051.977] GetFileType (hFile=0x274) returned 0x1 [0051.977] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ec6 [0051.977] ReadFile (in: hFile=0x274, lpBuffer=0x1aa1a3c, nNumberOfBytesToRead=0x6ec6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aa1a3c*, lpNumberOfBytesRead=0x2ae478*=0x6ec6, lpOverlapped=0x0) returned 1 [0052.009] CloseHandle (hObject=0x274) returned 1 [0052.022] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt", lpFilePart=0x0) returned 0x6f [0052.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.022] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.023] GetFileType (hFile=0x274) returned 0x1 [0052.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.023] GetFileType (hFile=0x274) returned 0x1 [0052.023] WriteFile (in: hFile=0x274, lpBuffer=0x1b11238*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b11238*, lpNumberOfBytesWritten=0x2ae46c*=0x6ed0, lpOverlapped=0x0) returned 1 [0052.025] CloseHandle (hObject=0x274) returned 1 [0052.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt", lpFilePart=0x0) returned 0x6f [0052.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt.anonymous", lpFilePart=0x0) returned 0x79 [0052.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.025] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdaeaf560, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbdf28870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0)) returned 1 [0052.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt.anonymous")) returned 1 [0052.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt", lpFilePart=0x0) returned 0x62 [0052.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.025] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.026] GetFileType (hFile=0x274) returned 0x1 [0052.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.026] GetFileType (hFile=0x274) returned 0x1 [0052.026] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6b5e [0052.026] ReadFile (in: hFile=0x274, lpBuffer=0x1b18730, nNumberOfBytesToRead=0x6b5e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b18730*, lpNumberOfBytesRead=0x2ae478*=0x6b5e, lpOverlapped=0x0) returned 1 [0052.073] CloseHandle (hObject=0x274) returned 1 [0052.109] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt", lpFilePart=0x0) returned 0x62 [0052.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.109] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.111] GetFileType (hFile=0x274) returned 0x1 [0052.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.111] GetFileType (hFile=0x274) returned 0x1 [0052.111] WriteFile (in: hFile=0x274, lpBuffer=0x1986ab4*, nNumberOfBytesToWrite=0x6b60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1986ab4*, lpNumberOfBytesWritten=0x2ae46c*=0x6b60, lpOverlapped=0x0) returned 1 [0052.112] CloseHandle (hObject=0x274) returned 1 [0052.112] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt", lpFilePart=0x0) returned 0x62 [0052.112] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.112] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe00d0b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6b60)) returned 1 [0052.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt.anonymous")) returned 1 [0052.113] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt", lpFilePart=0x0) returned 0x65 [0052.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.113] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.113] GetFileType (hFile=0x274) returned 0x1 [0052.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.113] GetFileType (hFile=0x274) returned 0x1 [0052.113] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6b5e [0052.113] ReadFile (in: hFile=0x274, lpBuffer=0x198dbcc, nNumberOfBytesToRead=0x6b5e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x198dbcc*, lpNumberOfBytesRead=0x2ae478*=0x6b5e, lpOverlapped=0x0) returned 1 [0052.128] CloseHandle (hObject=0x274) returned 1 [0052.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt", lpFilePart=0x0) returned 0x65 [0052.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.142] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.143] GetFileType (hFile=0x274) returned 0x1 [0052.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.144] GetFileType (hFile=0x274) returned 0x1 [0052.144] WriteFile (in: hFile=0x274, lpBuffer=0x19fc3f4*, nNumberOfBytesToWrite=0x6b60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19fc3f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6b60, lpOverlapped=0x0) returned 1 [0052.145] CloseHandle (hObject=0x274) returned 1 [0052.145] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt", lpFilePart=0x0) returned 0x65 [0052.145] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.145] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe059370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6b60)) returned 1 [0052.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt.anonymous")) returned 1 [0052.146] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt", lpFilePart=0x0) returned 0x62 [0052.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.146] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.147] GetFileType (hFile=0x274) returned 0x1 [0052.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.147] GetFileType (hFile=0x274) returned 0x1 [0052.147] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d74 [0052.147] ReadFile (in: hFile=0x274, lpBuffer=0x1a03518, nNumberOfBytesToRead=0x6d74, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a03518*, lpNumberOfBytesRead=0x2ae478*=0x6d74, lpOverlapped=0x0) returned 1 [0052.208] CloseHandle (hObject=0x274) returned 1 [0052.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt", lpFilePart=0x0) returned 0x62 [0052.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.220] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.223] GetFileType (hFile=0x274) returned 0x1 [0052.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.223] GetFileType (hFile=0x274) returned 0x1 [0052.223] WriteFile (in: hFile=0x274, lpBuffer=0x1a72680*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a72680*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0052.225] CloseHandle (hObject=0x274) returned 1 [0052.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt", lpFilePart=0x0) returned 0x62 [0052.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.226] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe117a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0052.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt.anonymous")) returned 1 [0052.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt", lpFilePart=0x0) returned 0x65 [0052.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.226] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.227] GetFileType (hFile=0x274) returned 0x1 [0052.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.227] GetFileType (hFile=0x274) returned 0x1 [0052.227] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d74 [0052.227] ReadFile (in: hFile=0x274, lpBuffer=0x1a799b8, nNumberOfBytesToRead=0x6d74, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a799b8*, lpNumberOfBytesRead=0x2ae478*=0x6d74, lpOverlapped=0x0) returned 1 [0052.240] CloseHandle (hObject=0x274) returned 1 [0052.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt", lpFilePart=0x0) returned 0x65 [0052.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.253] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.254] GetFileType (hFile=0x274) returned 0x1 [0052.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.254] GetFileType (hFile=0x274) returned 0x1 [0052.255] WriteFile (in: hFile=0x274, lpBuffer=0x1ae8b20*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ae8b20*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0052.256] CloseHandle (hObject=0x274) returned 1 [0052.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt", lpFilePart=0x0) returned 0x65 [0052.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.256] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe163d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0052.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt.anonymous")) returned 1 [0052.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.257] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.257] GetFileType (hFile=0x274) returned 0x1 [0052.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.257] GetFileType (hFile=0x274) returned 0x1 [0052.257] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d7a [0052.258] ReadFile (in: hFile=0x274, lpBuffer=0x1aefe90, nNumberOfBytesToRead=0x6d7a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aefe90*, lpNumberOfBytesRead=0x2ae478*=0x6d7a, lpOverlapped=0x0) returned 1 [0052.285] CloseHandle (hObject=0x274) returned 1 [0052.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.300] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.302] GetFileType (hFile=0x274) returned 0x1 [0052.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.302] GetFileType (hFile=0x274) returned 0x1 [0052.302] WriteFile (in: hFile=0x274, lpBuffer=0x196877c*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x196877c*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0052.303] CloseHandle (hObject=0x274) returned 1 [0052.303] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.303] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0052.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.304] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae632a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe1d6130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0052.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt.anonymous")) returned 1 [0052.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt", lpFilePart=0x0) returned 0x65 [0052.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.304] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.304] GetFileType (hFile=0x274) returned 0x1 [0052.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.305] GetFileType (hFile=0x274) returned 0x1 [0052.305] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6f48 [0052.305] ReadFile (in: hFile=0x274, lpBuffer=0x196fb1c, nNumberOfBytesToRead=0x6f48, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x196fb1c*, lpNumberOfBytesRead=0x2ae478*=0x6f48, lpOverlapped=0x0) returned 1 [0052.324] CloseHandle (hObject=0x274) returned 1 [0052.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt", lpFilePart=0x0) returned 0x65 [0052.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.359] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.361] GetFileType (hFile=0x274) returned 0x1 [0052.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.361] GetFileType (hFile=0x274) returned 0x1 [0052.361] WriteFile (in: hFile=0x274, lpBuffer=0x19df6f0*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19df6f0*, lpNumberOfBytesWritten=0x2ae46c*=0x6f50, lpOverlapped=0x0) returned 1 [0052.362] CloseHandle (hObject=0x274) returned 1 [0052.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt", lpFilePart=0x0) returned 0x65 [0052.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.362] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe26e6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f50)) returned 1 [0052.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt.anonymous")) returned 1 [0052.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt", lpFilePart=0x0) returned 0x65 [0052.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.363] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.364] GetFileType (hFile=0x274) returned 0x1 [0052.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.364] GetFileType (hFile=0x274) returned 0x1 [0052.364] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6f48 [0052.364] ReadFile (in: hFile=0x274, lpBuffer=0x19e6c10, nNumberOfBytesToRead=0x6f48, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e6c10*, lpNumberOfBytesRead=0x2ae478*=0x6f48, lpOverlapped=0x0) returned 1 [0052.382] CloseHandle (hObject=0x274) returned 1 [0052.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt", lpFilePart=0x0) returned 0x65 [0052.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.395] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.397] GetFileType (hFile=0x274) returned 0x1 [0052.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.397] GetFileType (hFile=0x274) returned 0x1 [0052.397] WriteFile (in: hFile=0x274, lpBuffer=0x1a56688*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a56688*, lpNumberOfBytesWritten=0x2ae46c*=0x6f50, lpOverlapped=0x0) returned 1 [0052.398] CloseHandle (hObject=0x274) returned 1 [0052.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt", lpFilePart=0x0) returned 0x65 [0052.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.399] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe2ba970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f50)) returned 1 [0052.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt.anonymous")) returned 1 [0052.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.399] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.400] GetFileType (hFile=0x274) returned 0x1 [0052.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.400] GetFileType (hFile=0x274) returned 0x1 [0052.400] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6f44 [0052.400] ReadFile (in: hFile=0x274, lpBuffer=0x1a5dbc8, nNumberOfBytesToRead=0x6f44, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a5dbc8*, lpNumberOfBytesRead=0x2ae478*=0x6f44, lpOverlapped=0x0) returned 1 [0052.401] CloseHandle (hObject=0x274) returned 1 [0052.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.413] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.415] GetFileType (hFile=0x274) returned 0x1 [0052.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.415] GetFileType (hFile=0x274) returned 0x1 [0052.415] WriteFile (in: hFile=0x274, lpBuffer=0x1acd640*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1acd640*, lpNumberOfBytesWritten=0x2ae46c*=0x6f50, lpOverlapped=0x0) returned 1 [0052.417] CloseHandle (hObject=0x274) returned 1 [0052.417] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.417] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0052.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.417] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe2e0ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f50)) returned 1 [0052.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt.anonymous")) returned 1 [0052.418] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt", lpFilePart=0x0) returned 0x62 [0052.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.418] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.418] GetFileType (hFile=0x274) returned 0x1 [0052.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.418] GetFileType (hFile=0x274) returned 0x1 [0052.418] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x67c2 [0052.418] ReadFile (in: hFile=0x274, lpBuffer=0x1ad4ba4, nNumberOfBytesToRead=0x67c2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ad4ba4*, lpNumberOfBytesRead=0x2ae478*=0x67c2, lpOverlapped=0x0) returned 1 [0052.434] CloseHandle (hObject=0x274) returned 1 [0052.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt", lpFilePart=0x0) returned 0x62 [0052.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.447] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.448] GetFileType (hFile=0x274) returned 0x1 [0052.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.448] GetFileType (hFile=0x274) returned 0x1 [0052.448] WriteFile (in: hFile=0x274, lpBuffer=0x1b420a0*, nNumberOfBytesToWrite=0x67d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b420a0*, lpNumberOfBytesWritten=0x2ae46c*=0x67d0, lpOverlapped=0x0) returned 1 [0052.450] CloseHandle (hObject=0x274) returned 1 [0052.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt", lpFilePart=0x0) returned 0x62 [0052.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.450] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe32cd90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x67d0)) returned 1 [0052.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt.anonymous")) returned 1 [0052.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt", lpFilePart=0x0) returned 0x65 [0052.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.451] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.451] GetFileType (hFile=0x274) returned 0x1 [0052.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.451] GetFileType (hFile=0x274) returned 0x1 [0052.451] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x67c2 [0052.451] ReadFile (in: hFile=0x274, lpBuffer=0x1b48e28, nNumberOfBytesToRead=0x67c2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b48e28*, lpNumberOfBytesRead=0x2ae478*=0x67c2, lpOverlapped=0x0) returned 1 [0052.454] CloseHandle (hObject=0x274) returned 1 [0052.469] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt", lpFilePart=0x0) returned 0x65 [0052.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.469] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.471] GetFileType (hFile=0x274) returned 0x1 [0052.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.471] GetFileType (hFile=0x274) returned 0x1 [0052.471] WriteFile (in: hFile=0x274, lpBuffer=0x19a7f2c*, nNumberOfBytesToWrite=0x67d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19a7f2c*, lpNumberOfBytesWritten=0x2ae46c*=0x67d0, lpOverlapped=0x0) returned 1 [0052.472] CloseHandle (hObject=0x274) returned 1 [0052.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt", lpFilePart=0x0) returned 0x65 [0052.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.472] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe379050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x67d0)) returned 1 [0052.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt.anonymous")) returned 1 [0052.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt", lpFilePart=0x0) returned 0x62 [0052.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.473] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.473] GetFileType (hFile=0x274) returned 0x1 [0052.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.473] GetFileType (hFile=0x274) returned 0x1 [0052.473] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e28 [0052.473] ReadFile (in: hFile=0x274, lpBuffer=0x19aecc0, nNumberOfBytesToRead=0x6e28, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19aecc0*, lpNumberOfBytesRead=0x2ae478*=0x6e28, lpOverlapped=0x0) returned 1 [0052.477] CloseHandle (hObject=0x274) returned 1 [0052.511] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt", lpFilePart=0x0) returned 0x62 [0052.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.511] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.514] GetFileType (hFile=0x274) returned 0x1 [0052.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.514] GetFileType (hFile=0x274) returned 0x1 [0052.514] WriteFile (in: hFile=0x274, lpBuffer=0x1a1e2f4*, nNumberOfBytesToWrite=0x6e30, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a1e2f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6e30, lpOverlapped=0x0) returned 1 [0052.517] CloseHandle (hObject=0x274) returned 1 [0052.517] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt", lpFilePart=0x0) returned 0x62 [0052.517] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.517] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe3eb470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e30)) returned 1 [0052.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt.anonymous")) returned 1 [0052.518] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt", lpFilePart=0x0) returned 0x65 [0052.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.518] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.518] GetFileType (hFile=0x274) returned 0x1 [0052.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.518] GetFileType (hFile=0x274) returned 0x1 [0052.518] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e28 [0052.518] ReadFile (in: hFile=0x274, lpBuffer=0x1a256dc, nNumberOfBytesToRead=0x6e28, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a256dc*, lpNumberOfBytesRead=0x2ae478*=0x6e28, lpOverlapped=0x0) returned 1 [0052.520] CloseHandle (hObject=0x274) returned 1 [0052.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt", lpFilePart=0x0) returned 0x65 [0052.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.534] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.535] GetFileType (hFile=0x274) returned 0x1 [0052.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.535] GetFileType (hFile=0x274) returned 0x1 [0052.535] WriteFile (in: hFile=0x274, lpBuffer=0x1a94bb4*, nNumberOfBytesToWrite=0x6e30, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a94bb4*, lpNumberOfBytesWritten=0x2ae46c*=0x6e30, lpOverlapped=0x0) returned 1 [0052.537] CloseHandle (hObject=0x274) returned 1 [0052.537] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt", lpFilePart=0x0) returned 0x65 [0052.537] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.537] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb47cb00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe4115d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e30)) returned 1 [0052.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt.anonymous")) returned 1 [0052.538] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt", lpFilePart=0x0) returned 0x62 [0052.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.538] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.538] GetFileType (hFile=0x274) returned 0x1 [0052.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.538] GetFileType (hFile=0x274) returned 0x1 [0052.538] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dfe [0052.538] ReadFile (in: hFile=0x274, lpBuffer=0x1a9bfa8, nNumberOfBytesToRead=0x6dfe, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a9bfa8*, lpNumberOfBytesRead=0x2ae478*=0x6dfe, lpOverlapped=0x0) returned 1 [0052.553] CloseHandle (hObject=0x274) returned 1 [0052.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt", lpFilePart=0x0) returned 0x62 [0052.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.566] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.568] GetFileType (hFile=0x274) returned 0x1 [0052.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.568] GetFileType (hFile=0x274) returned 0x1 [0052.568] WriteFile (in: hFile=0x274, lpBuffer=0x1b0b394*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b0b394*, lpNumberOfBytesWritten=0x2ae46c*=0x6e00, lpOverlapped=0x0) returned 1 [0052.569] CloseHandle (hObject=0x274) returned 1 [0052.569] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt", lpFilePart=0x0) returned 0x62 [0052.569] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.570] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe45d890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e00)) returned 1 [0052.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt.anonymous")) returned 1 [0052.570] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt", lpFilePart=0x0) returned 0x65 [0052.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.570] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.571] GetFileType (hFile=0x274) returned 0x1 [0052.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.571] GetFileType (hFile=0x274) returned 0x1 [0052.571] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dfe [0052.571] ReadFile (in: hFile=0x274, lpBuffer=0x1b1274c, nNumberOfBytesToRead=0x6dfe, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b1274c*, lpNumberOfBytesRead=0x2ae478*=0x6dfe, lpOverlapped=0x0) returned 1 [0052.592] CloseHandle (hObject=0x274) returned 1 [0052.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt", lpFilePart=0x0) returned 0x65 [0052.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.629] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.630] GetFileType (hFile=0x274) returned 0x1 [0052.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.630] GetFileType (hFile=0x274) returned 0x1 [0052.630] WriteFile (in: hFile=0x274, lpBuffer=0x1982174*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1982174*, lpNumberOfBytesWritten=0x2ae46c*=0x6e00, lpOverlapped=0x0) returned 1 [0052.632] CloseHandle (hObject=0x274) returned 1 [0052.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt", lpFilePart=0x0) returned 0x65 [0052.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe4f5e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e00)) returned 1 [0052.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt.anonymous")) returned 1 [0052.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt", lpFilePart=0x0) returned 0x62 [0052.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.633] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.633] GetFileType (hFile=0x274) returned 0x1 [0052.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.633] GetFileType (hFile=0x274) returned 0x1 [0052.633] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0052.633] ReadFile (in: hFile=0x274, lpBuffer=0x1989538, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1989538*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0052.649] CloseHandle (hObject=0x274) returned 1 [0052.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt", lpFilePart=0x0) returned 0x62 [0052.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.663] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.664] GetFileType (hFile=0x274) returned 0x1 [0052.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.664] GetFileType (hFile=0x274) returned 0x1 [0052.664] WriteFile (in: hFile=0x274, lpBuffer=0x19f8d4c*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19f8d4c*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0052.666] CloseHandle (hObject=0x274) returned 1 [0052.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt", lpFilePart=0x0) returned 0x62 [0052.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.666] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe5420d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0052.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt.anonymous")) returned 1 [0052.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt", lpFilePart=0x0) returned 0x65 [0052.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.667] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.667] GetFileType (hFile=0x274) returned 0x1 [0052.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.668] GetFileType (hFile=0x274) returned 0x1 [0052.668] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e8e [0052.668] ReadFile (in: hFile=0x274, lpBuffer=0x1a00194, nNumberOfBytesToRead=0x6e8e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a00194*, lpNumberOfBytesRead=0x2ae478*=0x6e8e, lpOverlapped=0x0) returned 1 [0052.671] CloseHandle (hObject=0x274) returned 1 [0052.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt", lpFilePart=0x0) returned 0x65 [0052.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.683] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.684] GetFileType (hFile=0x274) returned 0x1 [0052.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.684] GetFileType (hFile=0x274) returned 0x1 [0052.684] WriteFile (in: hFile=0x274, lpBuffer=0x1a6f850*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a6f850*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0052.686] CloseHandle (hObject=0x274) returned 1 [0052.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt", lpFilePart=0x0) returned 0x65 [0052.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe568230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0052.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt.anonymous")) returned 1 [0052.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt", lpFilePart=0x0) returned 0x65 [0052.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.687] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.690] GetFileType (hFile=0x274) returned 0x1 [0052.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.690] GetFileType (hFile=0x274) returned 0x1 [0052.690] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e88 [0052.691] ReadFile (in: hFile=0x274, lpBuffer=0x1a76cb0, nNumberOfBytesToRead=0x6e88, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a76cb0*, lpNumberOfBytesRead=0x2ae478*=0x6e88, lpOverlapped=0x0) returned 1 [0052.712] CloseHandle (hObject=0x274) returned 1 [0052.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt", lpFilePart=0x0) returned 0x65 [0052.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.727] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.728] GetFileType (hFile=0x274) returned 0x1 [0052.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.728] GetFileType (hFile=0x274) returned 0x1 [0052.728] WriteFile (in: hFile=0x274, lpBuffer=0x1ae6368*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ae6368*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0052.730] CloseHandle (hObject=0x274) returned 1 [0052.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt", lpFilePart=0x0) returned 0x65 [0052.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.730] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe5da650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0052.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt.anonymous")) returned 1 [0052.731] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.731] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.731] GetFileType (hFile=0x274) returned 0x1 [0052.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.731] GetFileType (hFile=0x274) returned 0x1 [0052.731] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e8e [0052.731] ReadFile (in: hFile=0x274, lpBuffer=0x1aed7e8, nNumberOfBytesToRead=0x6e8e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aed7e8*, lpNumberOfBytesRead=0x2ae478*=0x6e8e, lpOverlapped=0x0) returned 1 [0052.733] CloseHandle (hObject=0x274) returned 1 [0052.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.748] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.749] GetFileType (hFile=0x274) returned 0x1 [0052.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.749] GetFileType (hFile=0x274) returned 0x1 [0052.749] WriteFile (in: hFile=0x274, lpBuffer=0x1968ab0*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1968ab0*, lpNumberOfBytesWritten=0x2ae46c*=0x6e90, lpOverlapped=0x0) returned 1 [0052.751] CloseHandle (hObject=0x274) returned 1 [0052.751] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0052.751] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0052.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae3d140, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe626910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0052.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt.anonymous")) returned 1 [0052.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt", lpFilePart=0x0) returned 0x62 [0052.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.752] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.752] GetFileType (hFile=0x274) returned 0x1 [0052.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.752] GetFileType (hFile=0x274) returned 0x1 [0052.752] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x656a [0052.752] ReadFile (in: hFile=0x274, lpBuffer=0x196ff54, nNumberOfBytesToRead=0x656a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x196ff54*, lpNumberOfBytesRead=0x2ae478*=0x656a, lpOverlapped=0x0) returned 1 [0052.786] CloseHandle (hObject=0x274) returned 1 [0052.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt", lpFilePart=0x0) returned 0x62 [0052.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.821] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.824] GetFileType (hFile=0x274) returned 0x1 [0052.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.824] GetFileType (hFile=0x274) returned 0x1 [0052.824] WriteFile (in: hFile=0x274, lpBuffer=0x19dc9cc*, nNumberOfBytesToWrite=0x6570, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19dc9cc*, lpNumberOfBytesWritten=0x2ae46c*=0x6570, lpOverlapped=0x0) returned 1 [0052.827] CloseHandle (hObject=0x274) returned 1 [0052.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt", lpFilePart=0x0) returned 0x62 [0052.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.827] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe6bee90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6570)) returned 1 [0052.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt.anonymous")) returned 1 [0052.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt", lpFilePart=0x0) returned 0x65 [0052.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.828] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.829] GetFileType (hFile=0x274) returned 0x1 [0052.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.829] GetFileType (hFile=0x274) returned 0x1 [0052.829] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x656a [0052.829] ReadFile (in: hFile=0x274, lpBuffer=0x19e34f4, nNumberOfBytesToRead=0x656a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e34f4*, lpNumberOfBytesRead=0x2ae478*=0x656a, lpOverlapped=0x0) returned 1 [0052.842] CloseHandle (hObject=0x274) returned 1 [0052.855] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt", lpFilePart=0x0) returned 0x65 [0052.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.856] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.857] GetFileType (hFile=0x274) returned 0x1 [0052.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.857] GetFileType (hFile=0x274) returned 0x1 [0052.857] WriteFile (in: hFile=0x274, lpBuffer=0x1a4fe10*, nNumberOfBytesToWrite=0x6570, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a4fe10*, lpNumberOfBytesWritten=0x2ae46c*=0x6570, lpOverlapped=0x0) returned 1 [0052.859] CloseHandle (hObject=0x274) returned 1 [0052.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt", lpFilePart=0x0) returned 0x65 [0052.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt.anonymous", lpFilePart=0x0) returned 0x6f [0052.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.859] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe7312b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6570)) returned 1 [0052.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt.anonymous")) returned 1 [0052.860] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpFilePart=0x0) returned 0x71 [0052.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.860] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.860] GetFileType (hFile=0x274) returned 0x1 [0052.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.860] GetFileType (hFile=0x274) returned 0x1 [0052.860] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6594 [0052.860] ReadFile (in: hFile=0x274, lpBuffer=0x1a56980, nNumberOfBytesToRead=0x6594, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a56980*, lpNumberOfBytesRead=0x2ae478*=0x6594, lpOverlapped=0x0) returned 1 [0052.908] CloseHandle (hObject=0x274) returned 1 [0052.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpFilePart=0x0) returned 0x71 [0052.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.924] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.926] GetFileType (hFile=0x274) returned 0x1 [0052.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.926] GetFileType (hFile=0x274) returned 0x1 [0052.926] WriteFile (in: hFile=0x274, lpBuffer=0x1ac3388*, nNumberOfBytesToWrite=0x65a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ac3388*, lpNumberOfBytesWritten=0x2ae46c*=0x65a0, lpOverlapped=0x0) returned 1 [0052.927] CloseHandle (hObject=0x274) returned 1 [0052.927] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpFilePart=0x0) returned 0x71 [0052.927] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt.anonymous", lpFilePart=0x0) returned 0x7b [0052.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.927] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe7c9830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x65a0)) returned 1 [0052.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt.anonymous")) returned 1 [0052.928] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt", lpFilePart=0x0) returned 0x62 [0052.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.928] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.928] GetFileType (hFile=0x274) returned 0x1 [0052.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.929] GetFileType (hFile=0x274) returned 0x1 [0052.929] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x626a [0052.929] ReadFile (in: hFile=0x274, lpBuffer=0x1ac9f64, nNumberOfBytesToRead=0x626a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ac9f64*, lpNumberOfBytesRead=0x2ae478*=0x626a, lpOverlapped=0x0) returned 1 [0052.969] CloseHandle (hObject=0x274) returned 1 [0052.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt", lpFilePart=0x0) returned 0x62 [0052.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0052.982] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.983] GetFileType (hFile=0x274) returned 0x1 [0052.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0052.983] GetFileType (hFile=0x274) returned 0x1 [0052.983] WriteFile (in: hFile=0x274, lpBuffer=0x1b35980*, nNumberOfBytesToWrite=0x6270, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b35980*, lpNumberOfBytesWritten=0x2ae46c*=0x6270, lpOverlapped=0x0) returned 1 [0052.985] CloseHandle (hObject=0x274) returned 1 [0052.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt", lpFilePart=0x0) returned 0x62 [0052.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt.anonymous", lpFilePart=0x0) returned 0x6c [0052.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0052.985] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbe861db0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6270)) returned 1 [0052.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0052.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt.anonymous")) returned 1 [0052.986] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt", lpFilePart=0x0) returned 0x65 [0052.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0052.986] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0052.986] GetFileType (hFile=0x274) returned 0x1 [0052.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0052.986] GetFileType (hFile=0x274) returned 0x1 [0052.986] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x626a [0052.986] ReadFile (in: hFile=0x274, lpBuffer=0x1b3c1a8, nNumberOfBytesToRead=0x626a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b3c1a8*, lpNumberOfBytesRead=0x2ae478*=0x626a, lpOverlapped=0x0) returned 1 [0053.175] CloseHandle (hObject=0x274) returned 1 [0053.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt", lpFilePart=0x0) returned 0x65 [0053.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.223] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.225] GetFileType (hFile=0x274) returned 0x1 [0053.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.225] GetFileType (hFile=0x274) returned 0x1 [0053.225] WriteFile (in: hFile=0x274, lpBuffer=0x1998f28*, nNumberOfBytesToWrite=0x6270, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1998f28*, lpNumberOfBytesWritten=0x2ae46c*=0x6270, lpOverlapped=0x0) returned 1 [0053.226] CloseHandle (hObject=0x274) returned 1 [0053.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt", lpFilePart=0x0) returned 0x65 [0053.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.226] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbea9d250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6270)) returned 1 [0053.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt.anonymous")) returned 1 [0053.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt", lpFilePart=0x0) returned 0x62 [0053.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.227] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.228] GetFileType (hFile=0x274) returned 0x1 [0053.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.228] GetFileType (hFile=0x274) returned 0x1 [0053.228] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6bea [0053.228] ReadFile (in: hFile=0x274, lpBuffer=0x199f75c, nNumberOfBytesToRead=0x6bea, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x199f75c*, lpNumberOfBytesRead=0x2ae478*=0x6bea, lpOverlapped=0x0) returned 1 [0053.246] CloseHandle (hObject=0x274) returned 1 [0053.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt", lpFilePart=0x0) returned 0x62 [0053.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.258] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.259] GetFileType (hFile=0x274) returned 0x1 [0053.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.260] GetFileType (hFile=0x274) returned 0x1 [0053.260] WriteFile (in: hFile=0x274, lpBuffer=0x1a0e254*, nNumberOfBytesToWrite=0x6bf0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a0e254*, lpNumberOfBytesWritten=0x2ae46c*=0x6bf0, lpOverlapped=0x0) returned 1 [0053.261] CloseHandle (hObject=0x274) returned 1 [0053.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt", lpFilePart=0x0) returned 0x62 [0053.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.261] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbeae9510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6bf0)) returned 1 [0053.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt.anonymous")) returned 1 [0053.262] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt", lpFilePart=0x0) returned 0x65 [0053.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.262] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.262] GetFileType (hFile=0x274) returned 0x1 [0053.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.262] GetFileType (hFile=0x274) returned 0x1 [0053.262] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6bea [0053.262] ReadFile (in: hFile=0x274, lpBuffer=0x1a153fc, nNumberOfBytesToRead=0x6bea, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a153fc*, lpNumberOfBytesRead=0x2ae478*=0x6bea, lpOverlapped=0x0) returned 1 [0053.274] CloseHandle (hObject=0x274) returned 1 [0053.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt", lpFilePart=0x0) returned 0x65 [0053.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.287] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.288] GetFileType (hFile=0x274) returned 0x1 [0053.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.288] GetFileType (hFile=0x274) returned 0x1 [0053.288] WriteFile (in: hFile=0x274, lpBuffer=0x1a83d98*, nNumberOfBytesToWrite=0x6bf0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a83d98*, lpNumberOfBytesWritten=0x2ae46c*=0x6bf0, lpOverlapped=0x0) returned 1 [0053.293] CloseHandle (hObject=0x274) returned 1 [0053.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt", lpFilePart=0x0) returned 0x65 [0053.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbeb357d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6bf0)) returned 1 [0053.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt.anonymous")) returned 1 [0053.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt", lpFilePart=0x0) returned 0x62 [0053.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.294] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.294] GetFileType (hFile=0x274) returned 0x1 [0053.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.294] GetFileType (hFile=0x274) returned 0x1 [0053.294] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6aae [0053.294] ReadFile (in: hFile=0x274, lpBuffer=0x1a8af4c, nNumberOfBytesToRead=0x6aae, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a8af4c*, lpNumberOfBytesRead=0x2ae478*=0x6aae, lpOverlapped=0x0) returned 1 [0053.296] CloseHandle (hObject=0x274) returned 1 [0053.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt", lpFilePart=0x0) returned 0x62 [0053.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.308] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.310] GetFileType (hFile=0x274) returned 0x1 [0053.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.310] GetFileType (hFile=0x274) returned 0x1 [0053.310] WriteFile (in: hFile=0x274, lpBuffer=0x1af92a8*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1af92a8*, lpNumberOfBytesWritten=0x2ae46c*=0x6ab0, lpOverlapped=0x0) returned 1 [0053.311] CloseHandle (hObject=0x274) returned 1 [0053.311] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt", lpFilePart=0x0) returned 0x62 [0053.311] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.312] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4569a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbeb81a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ab0)) returned 1 [0053.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt.anonymous")) returned 1 [0053.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt", lpFilePart=0x0) returned 0x65 [0053.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.312] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.312] GetFileType (hFile=0x274) returned 0x1 [0053.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.313] GetFileType (hFile=0x274) returned 0x1 [0053.313] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6aae [0053.313] ReadFile (in: hFile=0x274, lpBuffer=0x1b00310, nNumberOfBytesToRead=0x6aae, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b00310*, lpNumberOfBytesRead=0x2ae478*=0x6aae, lpOverlapped=0x0) returned 1 [0053.314] CloseHandle (hObject=0x274) returned 1 [0053.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt", lpFilePart=0x0) returned 0x65 [0053.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.329] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.330] GetFileType (hFile=0x274) returned 0x1 [0053.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.330] GetFileType (hFile=0x274) returned 0x1 [0053.330] WriteFile (in: hFile=0x274, lpBuffer=0x19754cc*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19754cc*, lpNumberOfBytesWritten=0x2ae46c*=0x6ab0, lpOverlapped=0x0) returned 1 [0053.331] CloseHandle (hObject=0x274) returned 1 [0053.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt", lpFilePart=0x0) returned 0x65 [0053.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.332] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbeba7bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ab0)) returned 1 [0053.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt.anonymous")) returned 1 [0053.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt", lpFilePart=0x0) returned 0x62 [0053.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.332] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.332] GetFileType (hFile=0x274) returned 0x1 [0053.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.333] GetFileType (hFile=0x274) returned 0x1 [0053.333] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6df2 [0053.333] ReadFile (in: hFile=0x274, lpBuffer=0x197c540, nNumberOfBytesToRead=0x6df2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197c540*, lpNumberOfBytesRead=0x2ae478*=0x6df2, lpOverlapped=0x0) returned 1 [0053.349] CloseHandle (hObject=0x274) returned 1 [0053.385] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt", lpFilePart=0x0) returned 0x62 [0053.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.385] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.386] GetFileType (hFile=0x274) returned 0x1 [0053.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.386] GetFileType (hFile=0x274) returned 0x1 [0053.386] WriteFile (in: hFile=0x274, lpBuffer=0x19eba88*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19eba88*, lpNumberOfBytesWritten=0x2ae46c*=0x6e00, lpOverlapped=0x0) returned 1 [0053.388] CloseHandle (hObject=0x274) returned 1 [0053.388] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt", lpFilePart=0x0) returned 0x62 [0053.388] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.388] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbec1a010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e00)) returned 1 [0053.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt.anonymous")) returned 1 [0053.389] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt", lpFilePart=0x0) returned 0x65 [0053.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.389] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.389] GetFileType (hFile=0x274) returned 0x1 [0053.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.389] GetFileType (hFile=0x274) returned 0x1 [0053.389] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6df2 [0053.390] ReadFile (in: hFile=0x274, lpBuffer=0x19f2e40, nNumberOfBytesToRead=0x6df2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19f2e40*, lpNumberOfBytesRead=0x2ae478*=0x6df2, lpOverlapped=0x0) returned 1 [0053.391] CloseHandle (hObject=0x274) returned 1 [0053.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt", lpFilePart=0x0) returned 0x65 [0053.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.404] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.405] GetFileType (hFile=0x274) returned 0x1 [0053.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.405] GetFileType (hFile=0x274) returned 0x1 [0053.406] WriteFile (in: hFile=0x274, lpBuffer=0x1a6222c*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a6222c*, lpNumberOfBytesWritten=0x2ae46c*=0x6e00, lpOverlapped=0x0) returned 1 [0053.407] CloseHandle (hObject=0x274) returned 1 [0053.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt", lpFilePart=0x0) returned 0x65 [0053.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbec662d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e00)) returned 1 [0053.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt.anonymous")) returned 1 [0053.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt", lpFilePart=0x0) returned 0x62 [0053.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.408] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.409] GetFileType (hFile=0x274) returned 0x1 [0053.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.409] GetFileType (hFile=0x274) returned 0x1 [0053.409] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dc6 [0053.409] ReadFile (in: hFile=0x274, lpBuffer=0x1a695f0, nNumberOfBytesToRead=0x6dc6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a695f0*, lpNumberOfBytesRead=0x2ae478*=0x6dc6, lpOverlapped=0x0) returned 1 [0053.426] CloseHandle (hObject=0x274) returned 1 [0053.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt", lpFilePart=0x0) returned 0x62 [0053.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.439] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.440] GetFileType (hFile=0x274) returned 0x1 [0053.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.440] GetFileType (hFile=0x274) returned 0x1 [0053.440] WriteFile (in: hFile=0x274, lpBuffer=0x1ad88ec*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ad88ec*, lpNumberOfBytesWritten=0x2ae46c*=0x6dd0, lpOverlapped=0x0) returned 1 [0053.441] CloseHandle (hObject=0x274) returned 1 [0053.442] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt", lpFilePart=0x0) returned 0x62 [0053.442] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.442] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbecb2590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6dd0)) returned 1 [0053.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt.anonymous")) returned 1 [0053.443] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt", lpFilePart=0x0) returned 0x65 [0053.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.443] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.443] GetFileType (hFile=0x274) returned 0x1 [0053.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.443] GetFileType (hFile=0x274) returned 0x1 [0053.443] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dd6 [0053.443] ReadFile (in: hFile=0x274, lpBuffer=0x1adfc74, nNumberOfBytesToRead=0x6dd6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1adfc74*, lpNumberOfBytesRead=0x2ae478*=0x6dd6, lpOverlapped=0x0) returned 1 [0053.466] CloseHandle (hObject=0x274) returned 1 [0053.478] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt", lpFilePart=0x0) returned 0x65 [0053.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.478] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.479] GetFileType (hFile=0x274) returned 0x1 [0053.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.479] GetFileType (hFile=0x274) returned 0x1 [0053.479] WriteFile (in: hFile=0x274, lpBuffer=0x1b4efc0*, nNumberOfBytesToWrite=0x6de0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b4efc0*, lpNumberOfBytesWritten=0x2ae46c*=0x6de0, lpOverlapped=0x0) returned 1 [0053.481] CloseHandle (hObject=0x274) returned 1 [0053.481] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt", lpFilePart=0x0) returned 0x65 [0053.481] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.481] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbecfe850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6de0)) returned 1 [0053.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt.anonymous")) returned 1 [0053.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.482] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.482] GetFileType (hFile=0x274) returned 0x1 [0053.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.482] GetFileType (hFile=0x274) returned 0x1 [0053.482] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dd6 [0053.482] ReadFile (in: hFile=0x274, lpBuffer=0x1b56390, nNumberOfBytesToRead=0x6dd6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b56390*, lpNumberOfBytesRead=0x2ae478*=0x6dd6, lpOverlapped=0x0) returned 1 [0053.497] CloseHandle (hObject=0x274) returned 1 [0053.533] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.533] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.534] GetFileType (hFile=0x274) returned 0x1 [0053.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.534] GetFileType (hFile=0x274) returned 0x1 [0053.535] WriteFile (in: hFile=0x274, lpBuffer=0x19bebb4*, nNumberOfBytesToWrite=0x6de0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19bebb4*, lpNumberOfBytesWritten=0x2ae46c*=0x6de0, lpOverlapped=0x0) returned 1 [0053.536] CloseHandle (hObject=0x274) returned 1 [0053.536] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.536] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0053.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.536] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbed96dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6de0)) returned 1 [0053.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt.anonymous")) returned 1 [0053.537] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt", lpFilePart=0x0) returned 0x65 [0053.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.537] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.537] GetFileType (hFile=0x274) returned 0x1 [0053.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.537] GetFileType (hFile=0x274) returned 0x1 [0053.537] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dc6 [0053.537] ReadFile (in: hFile=0x274, lpBuffer=0x19c5fb4, nNumberOfBytesToRead=0x6dc6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19c5fb4*, lpNumberOfBytesRead=0x2ae478*=0x6dc6, lpOverlapped=0x0) returned 1 [0053.556] CloseHandle (hObject=0x274) returned 1 [0053.569] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt", lpFilePart=0x0) returned 0x65 [0053.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.569] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.571] GetFileType (hFile=0x274) returned 0x1 [0053.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.571] GetFileType (hFile=0x274) returned 0x1 [0053.571] WriteFile (in: hFile=0x274, lpBuffer=0x1a3540c*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3540c*, lpNumberOfBytesWritten=0x2ae46c*=0x6dd0, lpOverlapped=0x0) returned 1 [0053.572] CloseHandle (hObject=0x274) returned 1 [0053.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt", lpFilePart=0x0) returned 0x65 [0053.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.573] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbede3090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6dd0)) returned 1 [0053.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt.anonymous")) returned 1 [0053.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.574] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.574] GetFileType (hFile=0x274) returned 0x1 [0053.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.574] GetFileType (hFile=0x274) returned 0x1 [0053.574] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6dd6 [0053.574] ReadFile (in: hFile=0x274, lpBuffer=0x1a3c7cc, nNumberOfBytesToRead=0x6dd6, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a3c7cc*, lpNumberOfBytesRead=0x2ae478*=0x6dd6, lpOverlapped=0x0) returned 1 [0053.589] CloseHandle (hObject=0x274) returned 1 [0053.601] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.601] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.602] GetFileType (hFile=0x274) returned 0x1 [0053.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.602] GetFileType (hFile=0x274) returned 0x1 [0053.602] WriteFile (in: hFile=0x274, lpBuffer=0x1aabb18*, nNumberOfBytesToWrite=0x6de0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1aabb18*, lpNumberOfBytesWritten=0x2ae46c*=0x6de0, lpOverlapped=0x0) returned 1 [0053.604] CloseHandle (hObject=0x274) returned 1 [0053.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0053.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.604] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdae16fe0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbee2f350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6de0)) returned 1 [0053.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt.anonymous")) returned 1 [0053.605] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt", lpFilePart=0x0) returned 0x65 [0053.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.605] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.605] GetFileType (hFile=0x274) returned 0x1 [0053.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.605] GetFileType (hFile=0x274) returned 0x1 [0053.605] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6df2 [0053.605] ReadFile (in: hFile=0x274, lpBuffer=0x1ab2f18, nNumberOfBytesToRead=0x6df2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ab2f18*, lpNumberOfBytesRead=0x2ae478*=0x6df2, lpOverlapped=0x0) returned 1 [0053.607] CloseHandle (hObject=0x274) returned 1 [0053.619] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt", lpFilePart=0x0) returned 0x65 [0053.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.620] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.621] GetFileType (hFile=0x274) returned 0x1 [0053.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.621] GetFileType (hFile=0x274) returned 0x1 [0053.621] WriteFile (in: hFile=0x274, lpBuffer=0x1b22304*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b22304*, lpNumberOfBytesWritten=0x2ae46c*=0x6e00, lpOverlapped=0x0) returned 1 [0053.622] CloseHandle (hObject=0x274) returned 1 [0053.622] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt", lpFilePart=0x0) returned 0x65 [0053.622] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.623] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4a2c60, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbee554b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e00)) returned 1 [0053.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt.anonymous")) returned 1 [0053.623] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt", lpFilePart=0x0) returned 0x62 [0053.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.623] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.624] GetFileType (hFile=0x274) returned 0x1 [0053.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.624] GetFileType (hFile=0x274) returned 0x1 [0053.624] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e56 [0053.624] ReadFile (in: hFile=0x274, lpBuffer=0x1b296c8, nNumberOfBytesToRead=0x6e56, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b296c8*, lpNumberOfBytesRead=0x2ae478*=0x6e56, lpOverlapped=0x0) returned 1 [0053.626] CloseHandle (hObject=0x274) returned 1 [0053.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt", lpFilePart=0x0) returned 0x62 [0053.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.662] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.664] GetFileType (hFile=0x274) returned 0x1 [0053.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.664] GetFileType (hFile=0x274) returned 0x1 [0053.664] WriteFile (in: hFile=0x274, lpBuffer=0x1998cdc*, nNumberOfBytesToWrite=0x6e60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1998cdc*, lpNumberOfBytesWritten=0x2ae46c*=0x6e60, lpOverlapped=0x0) returned 1 [0053.665] CloseHandle (hObject=0x274) returned 1 [0053.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt", lpFilePart=0x0) returned 0x62 [0053.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.665] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbeec78d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e60)) returned 1 [0053.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt.anonymous")) returned 1 [0053.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt", lpFilePart=0x0) returned 0x65 [0053.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.666] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.666] GetFileType (hFile=0x274) returned 0x1 [0053.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.666] GetFileType (hFile=0x274) returned 0x1 [0053.667] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6e56 [0053.667] ReadFile (in: hFile=0x274, lpBuffer=0x19a00f4, nNumberOfBytesToRead=0x6e56, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19a00f4*, lpNumberOfBytesRead=0x2ae478*=0x6e56, lpOverlapped=0x0) returned 1 [0053.692] CloseHandle (hObject=0x274) returned 1 [0053.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt", lpFilePart=0x0) returned 0x65 [0053.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.705] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.706] GetFileType (hFile=0x274) returned 0x1 [0053.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.706] GetFileType (hFile=0x274) returned 0x1 [0053.706] WriteFile (in: hFile=0x274, lpBuffer=0x1a0f81c*, nNumberOfBytesToWrite=0x6e60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a0f81c*, lpNumberOfBytesWritten=0x2ae46c*=0x6e60, lpOverlapped=0x0) returned 1 [0053.708] CloseHandle (hObject=0x274) returned 1 [0053.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt", lpFilePart=0x0) returned 0x65 [0053.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.708] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbef39cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6e60)) returned 1 [0053.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt.anonymous")) returned 1 [0053.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt", lpFilePart=0x0) returned 0x65 [0053.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.709] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.709] GetFileType (hFile=0x274) returned 0x1 [0053.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.710] GetFileType (hFile=0x274) returned 0x1 [0053.710] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ebc [0053.710] ReadFile (in: hFile=0x274, lpBuffer=0x1a16c4c, nNumberOfBytesToRead=0x6ebc, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a16c4c*, lpNumberOfBytesRead=0x2ae478*=0x6ebc, lpOverlapped=0x0) returned 1 [0053.733] CloseHandle (hObject=0x274) returned 1 [0053.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt", lpFilePart=0x0) returned 0x65 [0053.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.745] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.747] GetFileType (hFile=0x274) returned 0x1 [0053.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.747] GetFileType (hFile=0x274) returned 0x1 [0053.747] WriteFile (in: hFile=0x274, lpBuffer=0x1a863f4*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a863f4*, lpNumberOfBytesWritten=0x2ae46c*=0x6ec0, lpOverlapped=0x0) returned 1 [0053.748] CloseHandle (hObject=0x274) returned 1 [0053.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt", lpFilePart=0x0) returned 0x65 [0053.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.749] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbefac110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0)) returned 1 [0053.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt.anonymous")) returned 1 [0053.749] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", lpFilePart=0x0) returned 0x65 [0053.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.749] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.750] GetFileType (hFile=0x274) returned 0x1 [0053.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.750] GetFileType (hFile=0x274) returned 0x1 [0053.750] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6f46 [0053.750] ReadFile (in: hFile=0x274, lpBuffer=0x1a8d884, nNumberOfBytesToRead=0x6f46, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a8d884*, lpNumberOfBytesRead=0x2ae478*=0x6f46, lpOverlapped=0x0) returned 1 [0053.761] CloseHandle (hObject=0x274) returned 1 [0053.781] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", lpFilePart=0x0) returned 0x65 [0053.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.782] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.783] GetFileType (hFile=0x274) returned 0x1 [0053.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.783] GetFileType (hFile=0x274) returned 0x1 [0053.783] WriteFile (in: hFile=0x274, lpBuffer=0x1afd300*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1afd300*, lpNumberOfBytesWritten=0x2ae46c*=0x6f50, lpOverlapped=0x0) returned 1 [0053.785] CloseHandle (hObject=0x274) returned 1 [0053.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", lpFilePart=0x0) returned 0x65 [0053.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.786] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbeff83d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f50)) returned 1 [0053.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt.anonymous")) returned 1 [0053.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.787] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.787] GetFileType (hFile=0x274) returned 0x1 [0053.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.787] GetFileType (hFile=0x274) returned 0x1 [0053.787] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6f50 [0053.787] ReadFile (in: hFile=0x274, lpBuffer=0x1b04840, nNumberOfBytesToRead=0x6f50, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b04840*, lpNumberOfBytesRead=0x2ae478*=0x6f50, lpOverlapped=0x0) returned 1 [0053.807] CloseHandle (hObject=0x274) returned 1 [0053.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.829] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.831] GetFileType (hFile=0x274) returned 0x1 [0053.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.831] GetFileType (hFile=0x274) returned 0x1 [0053.831] WriteFile (in: hFile=0x274, lpBuffer=0x1976c38*, nNumberOfBytesToWrite=0x6f60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1976c38*, lpNumberOfBytesWritten=0x2ae46c*=0x6f60, lpOverlapped=0x0) returned 1 [0053.833] CloseHandle (hObject=0x274) returned 1 [0053.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", lpFilePart=0x0) returned 0x6d [0053.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt.anonymous", lpFilePart=0x0) returned 0x77 [0053.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.833] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf06a7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f60)) returned 1 [0053.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt.anonymous")) returned 1 [0053.834] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", lpFilePart=0x0) returned 0x62 [0053.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.834] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.835] GetFileType (hFile=0x274) returned 0x1 [0053.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.835] GetFileType (hFile=0x274) returned 0x1 [0053.835] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ba2 [0053.835] ReadFile (in: hFile=0x274, lpBuffer=0x197e1ac, nNumberOfBytesToRead=0x6ba2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197e1ac*, lpNumberOfBytesRead=0x2ae478*=0x6ba2, lpOverlapped=0x0) returned 1 [0053.849] CloseHandle (hObject=0x274) returned 1 [0053.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", lpFilePart=0x0) returned 0x62 [0053.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.901] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.902] GetFileType (hFile=0x274) returned 0x1 [0053.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.902] GetFileType (hFile=0x274) returned 0x1 [0053.902] WriteFile (in: hFile=0x274, lpBuffer=0x19ecb64*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19ecb64*, lpNumberOfBytesWritten=0x2ae46c*=0x6bb0, lpOverlapped=0x0) returned 1 [0053.904] CloseHandle (hObject=0x274) returned 1 [0053.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", lpFilePart=0x0) returned 0x62 [0053.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.905] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf128ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6bb0)) returned 1 [0053.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt.anonymous")) returned 1 [0053.905] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", lpFilePart=0x0) returned 0x65 [0053.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.906] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.906] GetFileType (hFile=0x274) returned 0x1 [0053.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.906] GetFileType (hFile=0x274) returned 0x1 [0053.906] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ba2 [0053.906] ReadFile (in: hFile=0x274, lpBuffer=0x19f3ccc, nNumberOfBytesToRead=0x6ba2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19f3ccc*, lpNumberOfBytesRead=0x2ae478*=0x6ba2, lpOverlapped=0x0) returned 1 [0053.917] CloseHandle (hObject=0x274) returned 1 [0053.937] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", lpFilePart=0x0) returned 0x65 [0053.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.937] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.939] GetFileType (hFile=0x274) returned 0x1 [0053.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.939] GetFileType (hFile=0x274) returned 0x1 [0053.939] WriteFile (in: hFile=0x274, lpBuffer=0x1a62528*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a62528*, lpNumberOfBytesWritten=0x2ae46c*=0x6bb0, lpOverlapped=0x0) returned 1 [0053.941] CloseHandle (hObject=0x274) returned 1 [0053.941] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", lpFilePart=0x0) returned 0x65 [0053.941] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt.anonymous", lpFilePart=0x0) returned 0x6f [0053.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.941] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf175190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6bb0)) returned 1 [0053.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt.anonymous")) returned 1 [0053.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", lpFilePart=0x0) returned 0x62 [0053.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.942] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.943] GetFileType (hFile=0x274) returned 0x1 [0053.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.943] GetFileType (hFile=0x274) returned 0x1 [0053.943] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7498 [0053.943] ReadFile (in: hFile=0x274, lpBuffer=0x1a6969c, nNumberOfBytesToRead=0x7498, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a6969c*, lpNumberOfBytesRead=0x2ae478*=0x7498, lpOverlapped=0x0) returned 1 [0053.952] CloseHandle (hObject=0x274) returned 1 [0053.970] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", lpFilePart=0x0) returned 0x62 [0053.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0053.970] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.972] GetFileType (hFile=0x274) returned 0x1 [0053.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0053.972] GetFileType (hFile=0x274) returned 0x1 [0053.972] WriteFile (in: hFile=0x274, lpBuffer=0x1adaba4*, nNumberOfBytesToWrite=0x74a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1adaba4*, lpNumberOfBytesWritten=0x2ae46c*=0x74a0, lpOverlapped=0x0) returned 1 [0053.974] CloseHandle (hObject=0x274) returned 1 [0053.974] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", lpFilePart=0x0) returned 0x62 [0053.974] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt.anonymous", lpFilePart=0x0) returned 0x6c [0053.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0053.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf1c1450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x74a0)) returned 1 [0053.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0053.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt.anonymous")) returned 1 [0053.975] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", lpFilePart=0x0) returned 0x65 [0053.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0053.975] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0053.976] GetFileType (hFile=0x274) returned 0x1 [0053.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0053.976] GetFileType (hFile=0x274) returned 0x1 [0053.976] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7498 [0053.976] ReadFile (in: hFile=0x274, lpBuffer=0x1ae25fc, nNumberOfBytesToRead=0x7498, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae25fc*, lpNumberOfBytesRead=0x2ae478*=0x7498, lpOverlapped=0x0) returned 1 [0054.006] CloseHandle (hObject=0x274) returned 1 [0054.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", lpFilePart=0x0) returned 0x65 [0054.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.026] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.028] GetFileType (hFile=0x274) returned 0x1 [0054.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.028] GetFileType (hFile=0x274) returned 0x1 [0054.028] WriteFile (in: hFile=0x274, lpBuffer=0x1b53b04*, nNumberOfBytesToWrite=0x74a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b53b04*, lpNumberOfBytesWritten=0x2ae46c*=0x74a0, lpOverlapped=0x0) returned 1 [0054.030] CloseHandle (hObject=0x274) returned 1 [0054.030] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", lpFilePart=0x0) returned 0x65 [0054.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.031] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf2599d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x74a0)) returned 1 [0054.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt.anonymous")) returned 1 [0054.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", lpFilePart=0x0) returned 0x65 [0054.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.032] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.032] GetFileType (hFile=0x274) returned 0x1 [0054.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.032] GetFileType (hFile=0x274) returned 0x1 [0054.032] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7416 [0054.032] ReadFile (in: hFile=0x274, lpBuffer=0x1b5b574, nNumberOfBytesToRead=0x7416, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b5b574*, lpNumberOfBytesRead=0x2ae478*=0x7416, lpOverlapped=0x0) returned 1 [0054.073] CloseHandle (hObject=0x274) returned 1 [0054.126] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", lpFilePart=0x0) returned 0x65 [0054.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.126] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.128] GetFileType (hFile=0x274) returned 0x1 [0054.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.128] GetFileType (hFile=0x274) returned 0x1 [0054.128] WriteFile (in: hFile=0x274, lpBuffer=0x19c43c0*, nNumberOfBytesToWrite=0x7420, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19c43c0*, lpNumberOfBytesWritten=0x2ae46c*=0x7420, lpOverlapped=0x0) returned 1 [0054.130] CloseHandle (hObject=0x274) returned 1 [0054.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", lpFilePart=0x0) returned 0x65 [0054.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.130] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb430840, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf33e210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7420)) returned 1 [0054.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt.anonymous")) returned 1 [0054.131] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", lpFilePart=0x0) returned 0x62 [0054.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.131] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.131] GetFileType (hFile=0x274) returned 0x1 [0054.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.132] GetFileType (hFile=0x274) returned 0x1 [0054.132] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d76 [0054.132] ReadFile (in: hFile=0x274, lpBuffer=0x19cbda4, nNumberOfBytesToRead=0x6d76, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19cbda4*, lpNumberOfBytesRead=0x2ae478*=0x6d76, lpOverlapped=0x0) returned 1 [0054.134] CloseHandle (hObject=0x274) returned 1 [0054.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", lpFilePart=0x0) returned 0x62 [0054.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.154] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.156] GetFileType (hFile=0x274) returned 0x1 [0054.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.156] GetFileType (hFile=0x274) returned 0x1 [0054.156] WriteFile (in: hFile=0x274, lpBuffer=0x1a3b06c*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3b06c*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0054.158] CloseHandle (hObject=0x274) returned 1 [0054.158] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", lpFilePart=0x0) returned 0x62 [0054.158] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt.anonymous", lpFilePart=0x0) returned 0x6c [0054.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.158] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb40a6e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf38a4d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0054.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt.anonymous")) returned 1 [0054.159] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", lpFilePart=0x0) returned 0x65 [0054.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.159] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.159] GetFileType (hFile=0x274) returned 0x1 [0054.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.159] GetFileType (hFile=0x274) returned 0x1 [0054.159] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6d76 [0054.159] ReadFile (in: hFile=0x274, lpBuffer=0x1a423a4, nNumberOfBytesToRead=0x6d76, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a423a4*, lpNumberOfBytesRead=0x2ae478*=0x6d76, lpOverlapped=0x0) returned 1 [0054.162] CloseHandle (hObject=0x274) returned 1 [0054.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", lpFilePart=0x0) returned 0x65 [0054.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.181] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.183] GetFileType (hFile=0x274) returned 0x1 [0054.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.183] GetFileType (hFile=0x274) returned 0x1 [0054.183] WriteFile (in: hFile=0x274, lpBuffer=0x1ab1510*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ab1510*, lpNumberOfBytesWritten=0x2ae46c*=0x6d80, lpOverlapped=0x0) returned 1 [0054.185] CloseHandle (hObject=0x274) returned 1 [0054.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", lpFilePart=0x0) returned 0x65 [0054.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.185] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb40a6e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf3d6790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0054.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt.anonymous")) returned 1 [0054.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", lpFilePart=0x0) returned 0x62 [0054.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.186] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.187] GetFileType (hFile=0x274) returned 0x1 [0054.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.187] GetFileType (hFile=0x274) returned 0x1 [0054.188] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ef0 [0054.188] ReadFile (in: hFile=0x274, lpBuffer=0x1ab8854, nNumberOfBytesToRead=0x6ef0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ab8854*, lpNumberOfBytesRead=0x2ae478*=0x6ef0, lpOverlapped=0x0) returned 1 [0054.190] CloseHandle (hObject=0x274) returned 1 [0054.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", lpFilePart=0x0) returned 0x62 [0054.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.208] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.210] GetFileType (hFile=0x274) returned 0x1 [0054.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.210] GetFileType (hFile=0x274) returned 0x1 [0054.210] WriteFile (in: hFile=0x274, lpBuffer=0x1b2813c*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b2813c*, lpNumberOfBytesWritten=0x2ae46c*=0x6f00, lpOverlapped=0x0) returned 1 [0054.212] CloseHandle (hObject=0x274) returned 1 [0054.212] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", lpFilePart=0x0) returned 0x62 [0054.212] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt.anonymous", lpFilePart=0x0) returned 0x6c [0054.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.212] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb40a6e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf3fc8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f00)) returned 1 [0054.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt.anonymous")) returned 1 [0054.213] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", lpFilePart=0x0) returned 0x65 [0054.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.213] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.214] GetFileType (hFile=0x274) returned 0x1 [0054.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.214] GetFileType (hFile=0x274) returned 0x1 [0054.214] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6ef0 [0054.214] ReadFile (in: hFile=0x274, lpBuffer=0x1b2f5f4, nNumberOfBytesToRead=0x6ef0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2f5f4*, lpNumberOfBytesRead=0x2ae478*=0x6ef0, lpOverlapped=0x0) returned 1 [0054.240] CloseHandle (hObject=0x274) returned 1 [0054.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", lpFilePart=0x0) returned 0x65 [0054.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.292] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.296] GetFileType (hFile=0x274) returned 0x1 [0054.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.296] GetFileType (hFile=0x274) returned 0x1 [0054.296] WriteFile (in: hFile=0x274, lpBuffer=0x199e96c*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x199e96c*, lpNumberOfBytesWritten=0x2ae46c*=0x6f00, lpOverlapped=0x0) returned 1 [0054.301] CloseHandle (hObject=0x274) returned 1 [0054.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", lpFilePart=0x0) returned 0x65 [0054.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb40a6e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf4e1130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f00)) returned 1 [0054.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt.anonymous")) returned 1 [0054.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", lpFilePart=0x0) returned 0x62 [0054.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.302] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.303] GetFileType (hFile=0x274) returned 0x1 [0054.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.304] GetFileType (hFile=0x274) returned 0x1 [0054.304] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x715c [0054.304] ReadFile (in: hFile=0x274, lpBuffer=0x19a5e30, nNumberOfBytesToRead=0x715c, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19a5e30*, lpNumberOfBytesRead=0x2ae478*=0x715c, lpOverlapped=0x0) returned 1 [0054.324] CloseHandle (hObject=0x274) returned 1 [0054.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", lpFilePart=0x0) returned 0x62 [0054.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.352] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.354] GetFileType (hFile=0x274) returned 0x1 [0054.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.354] GetFileType (hFile=0x274) returned 0x1 [0054.354] WriteFile (in: hFile=0x274, lpBuffer=0x1a16454*, nNumberOfBytesToWrite=0x7160, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a16454*, lpNumberOfBytesWritten=0x2ae46c*=0x7160, lpOverlapped=0x0) returned 1 [0054.356] CloseHandle (hObject=0x274) returned 1 [0054.356] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", lpFilePart=0x0) returned 0x62 [0054.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt.anonymous", lpFilePart=0x0) returned 0x6c [0054.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.357] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf553550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7160)) returned 1 [0054.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt.anonymous")) returned 1 [0054.358] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", lpFilePart=0x0) returned 0x65 [0054.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.358] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.358] GetFileType (hFile=0x274) returned 0x1 [0054.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.358] GetFileType (hFile=0x274) returned 0x1 [0054.358] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7144 [0054.358] ReadFile (in: hFile=0x274, lpBuffer=0x1a1db6c, nNumberOfBytesToRead=0x7144, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a1db6c*, lpNumberOfBytesRead=0x2ae478*=0x7144, lpOverlapped=0x0) returned 1 [0054.372] CloseHandle (hObject=0x274) returned 1 [0054.390] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", lpFilePart=0x0) returned 0x65 [0054.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.391] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.392] GetFileType (hFile=0x274) returned 0x1 [0054.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.392] GetFileType (hFile=0x274) returned 0x1 [0054.392] WriteFile (in: hFile=0x274, lpBuffer=0x1a8dfe4*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a8dfe4*, lpNumberOfBytesWritten=0x2ae46c*=0x7150, lpOverlapped=0x0) returned 1 [0054.394] CloseHandle (hObject=0x274) returned 1 [0054.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", lpFilePart=0x0) returned 0x65 [0054.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.395] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf5c5970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7150)) returned 1 [0054.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt.anonymous")) returned 1 [0054.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", lpFilePart=0x0) returned 0x65 [0054.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.396] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.396] GetFileType (hFile=0x274) returned 0x1 [0054.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.396] GetFileType (hFile=0x274) returned 0x1 [0054.396] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x715c [0054.396] ReadFile (in: hFile=0x274, lpBuffer=0x1a95704, nNumberOfBytesToRead=0x715c, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a95704*, lpNumberOfBytesRead=0x2ae478*=0x715c, lpOverlapped=0x0) returned 1 [0054.419] CloseHandle (hObject=0x274) returned 1 [0054.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", lpFilePart=0x0) returned 0x65 [0054.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.432] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.436] GetFileType (hFile=0x274) returned 0x1 [0054.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.436] GetFileType (hFile=0x274) returned 0x1 [0054.436] WriteFile (in: hFile=0x274, lpBuffer=0x1b05bcc*, nNumberOfBytesToWrite=0x7160, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b05bcc*, lpNumberOfBytesWritten=0x2ae46c*=0x7160, lpOverlapped=0x0) returned 1 [0054.438] CloseHandle (hObject=0x274) returned 1 [0054.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", lpFilePart=0x0) returned 0x65 [0054.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.438] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf637d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7160)) returned 1 [0054.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt.anonymous")) returned 1 [0054.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", lpFilePart=0x0) returned 0x62 [0054.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.439] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.440] GetFileType (hFile=0x274) returned 0x1 [0054.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.440] GetFileType (hFile=0x274) returned 0x1 [0054.440] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7288 [0054.440] ReadFile (in: hFile=0x274, lpBuffer=0x1b0d2f0, nNumberOfBytesToRead=0x7288, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b0d2f0*, lpNumberOfBytesRead=0x2ae478*=0x7288, lpOverlapped=0x0) returned 1 [0054.453] CloseHandle (hObject=0x274) returned 1 [0054.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", lpFilePart=0x0) returned 0x62 [0054.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.505] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.507] GetFileType (hFile=0x274) returned 0x1 [0054.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.507] GetFileType (hFile=0x274) returned 0x1 [0054.507] WriteFile (in: hFile=0x274, lpBuffer=0x197e190*, nNumberOfBytesToWrite=0x7290, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x197e190*, lpNumberOfBytesWritten=0x2ae46c*=0x7290, lpOverlapped=0x0) returned 1 [0054.509] CloseHandle (hObject=0x274) returned 1 [0054.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", lpFilePart=0x0) returned 0x62 [0054.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt.anonymous", lpFilePart=0x0) returned 0x6c [0054.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.509] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb40a6e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf6d0310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7290)) returned 1 [0054.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt.anonymous")) returned 1 [0054.523] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", lpFilePart=0x0) returned 0x65 [0054.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.524] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.524] GetFileType (hFile=0x274) returned 0x1 [0054.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.524] GetFileType (hFile=0x274) returned 0x1 [0054.524] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7288 [0054.524] ReadFile (in: hFile=0x274, lpBuffer=0x19859d8, nNumberOfBytesToRead=0x7288, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19859d8*, lpNumberOfBytesRead=0x2ae478*=0x7288, lpOverlapped=0x0) returned 1 [0054.539] CloseHandle (hObject=0x274) returned 1 [0054.554] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", lpFilePart=0x0) returned 0x65 [0054.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.554] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.555] GetFileType (hFile=0x274) returned 0x1 [0054.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.555] GetFileType (hFile=0x274) returned 0x1 [0054.555] WriteFile (in: hFile=0x274, lpBuffer=0x19f65ec*, nNumberOfBytesToWrite=0x7290, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19f65ec*, lpNumberOfBytesWritten=0x2ae46c*=0x7290, lpOverlapped=0x0) returned 1 [0054.557] CloseHandle (hObject=0x274) returned 1 [0054.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", lpFilePart=0x0) returned 0x65 [0054.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.557] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb40a6e0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf742730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7290)) returned 1 [0054.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt.anonymous")) returned 1 [0054.558] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", lpFilePart=0x0) returned 0x62 [0054.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.558] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.558] GetFileType (hFile=0x274) returned 0x1 [0054.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.558] GetFileType (hFile=0x274) returned 0x1 [0054.558] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x724e [0054.558] ReadFile (in: hFile=0x274, lpBuffer=0x19fde40, nNumberOfBytesToRead=0x724e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19fde40*, lpNumberOfBytesRead=0x2ae478*=0x724e, lpOverlapped=0x0) returned 1 [0054.592] CloseHandle (hObject=0x274) returned 1 [0054.605] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", lpFilePart=0x0) returned 0x62 [0054.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.605] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.606] GetFileType (hFile=0x274) returned 0x1 [0054.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.606] GetFileType (hFile=0x274) returned 0x1 [0054.606] WriteFile (in: hFile=0x274, lpBuffer=0x1a6e7bc*, nNumberOfBytesToWrite=0x7250, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a6e7bc*, lpNumberOfBytesWritten=0x2ae46c*=0x7250, lpOverlapped=0x0) returned 1 [0054.608] CloseHandle (hObject=0x274) returned 1 [0054.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", lpFilePart=0x0) returned 0x62 [0054.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt.anonymous", lpFilePart=0x0) returned 0x6c [0054.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.608] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf7dacb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7250)) returned 1 [0054.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt.anonymous")) returned 1 [0054.609] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", lpFilePart=0x0) returned 0x65 [0054.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.609] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.609] GetFileType (hFile=0x274) returned 0x1 [0054.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.609] GetFileType (hFile=0x274) returned 0x1 [0054.609] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x724e [0054.609] ReadFile (in: hFile=0x274, lpBuffer=0x1a75fc4, nNumberOfBytesToRead=0x724e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a75fc4*, lpNumberOfBytesRead=0x2ae478*=0x724e, lpOverlapped=0x0) returned 1 [0054.614] CloseHandle (hObject=0x274) returned 1 [0054.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", lpFilePart=0x0) returned 0x65 [0054.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.628] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.630] GetFileType (hFile=0x274) returned 0x1 [0054.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.630] GetFileType (hFile=0x274) returned 0x1 [0054.630] WriteFile (in: hFile=0x274, lpBuffer=0x1ae6940*, nNumberOfBytesToWrite=0x7250, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ae6940*, lpNumberOfBytesWritten=0x2ae46c*=0x7250, lpOverlapped=0x0) returned 1 [0054.631] CloseHandle (hObject=0x274) returned 1 [0054.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", lpFilePart=0x0) returned 0x65 [0054.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdb4eef20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf800e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7250)) returned 1 [0054.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt.anonymous")) returned 1 [0054.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", lpFilePart=0x0) returned 0x65 [0054.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.632] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.633] GetFileType (hFile=0x274) returned 0x1 [0054.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.633] GetFileType (hFile=0x274) returned 0x1 [0054.633] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x6068 [0054.633] ReadFile (in: hFile=0x274, lpBuffer=0x1aee160, nNumberOfBytesToRead=0x6068, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aee160*, lpNumberOfBytesRead=0x2ae478*=0x6068, lpOverlapped=0x0) returned 1 [0054.665] CloseHandle (hObject=0x274) returned 1 [0054.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", lpFilePart=0x0) returned 0x65 [0054.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.677] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.679] GetFileType (hFile=0x274) returned 0x1 [0054.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.679] GetFileType (hFile=0x274) returned 0x1 [0054.679] WriteFile (in: hFile=0x274, lpBuffer=0x1b59178*, nNumberOfBytesToWrite=0x6070, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b59178*, lpNumberOfBytesWritten=0x2ae46c*=0x6070, lpOverlapped=0x0) returned 1 [0054.680] CloseHandle (hObject=0x274) returned 1 [0054.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", lpFilePart=0x0) returned 0x65 [0054.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf873230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6070)) returned 1 [0054.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt.anonymous")) returned 1 [0054.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", lpFilePart=0x0) returned 0x65 [0054.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.682] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.682] GetFileType (hFile=0x274) returned 0x1 [0054.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.682] GetFileType (hFile=0x274) returned 0x1 [0054.682] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x605a [0054.684] ReadFile (in: hFile=0x274, lpBuffer=0x19539a0, nNumberOfBytesToRead=0x605a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19539a0*, lpNumberOfBytesRead=0x2ae478*=0x605a, lpOverlapped=0x0) returned 1 [0054.696] CloseHandle (hObject=0x274) returned 1 [0054.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", lpFilePart=0x0) returned 0x65 [0054.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.735] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.736] GetFileType (hFile=0x274) returned 0x1 [0054.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.736] GetFileType (hFile=0x274) returned 0x1 [0054.736] WriteFile (in: hFile=0x274, lpBuffer=0x19beac8*, nNumberOfBytesToWrite=0x6060, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19beac8*, lpNumberOfBytesWritten=0x2ae46c*=0x6060, lpOverlapped=0x0) returned 1 [0054.738] CloseHandle (hObject=0x274) returned 1 [0054.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", lpFilePart=0x0) returned 0x65 [0054.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt.anonymous", lpFilePart=0x0) returned 0x6f [0054.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.738] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadcad20, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf90b7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6060)) returned 1 [0054.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt.anonymous")) returned 1 [0054.739] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", lpFilePart=0x0) returned 0x6c [0054.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0054.739] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.739] GetFileType (hFile=0x274) returned 0x1 [0054.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0054.739] GetFileType (hFile=0x274) returned 0x1 [0054.739] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x608c [0054.739] ReadFile (in: hFile=0x274, lpBuffer=0x19c5114, nNumberOfBytesToRead=0x608c, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19c5114*, lpNumberOfBytesRead=0x2ae478*=0x608c, lpOverlapped=0x0) returned 1 [0054.756] CloseHandle (hObject=0x274) returned 1 [0054.769] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", lpFilePart=0x0) returned 0x6c [0054.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0054.769] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.771] GetFileType (hFile=0x274) returned 0x1 [0054.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0054.771] GetFileType (hFile=0x274) returned 0x1 [0054.771] WriteFile (in: hFile=0x274, lpBuffer=0x1a301cc*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a301cc*, lpNumberOfBytesWritten=0x2ae46c*=0x6090, lpOverlapped=0x0) returned 1 [0054.775] CloseHandle (hObject=0x274) returned 1 [0054.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", lpFilePart=0x0) returned 0x6c [0054.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt.anonymous", lpFilePart=0x0) returned 0x76 [0054.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0054.775] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xdadf0e80, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbf957a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6090)) returned 1 [0054.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt.anonymous")) returned 1 [0054.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0054.776] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers", lpFilePart=0x0) returned 0x41 [0054.776] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\", lpFilePart=0x0) returned 0x42 [0054.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0054.776] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0054.776] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0054.776] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0054.777] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0054.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0054.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0054.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers", lpFilePart=0x0) returned 0x41 [0054.777] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\", lpFilePart=0x0) returned 0x42 [0054.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0054.777] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0054.777] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0054.778] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0054.778] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0054.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0054.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0054.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity", lpFilePart=0x0) returned 0x4b [0054.778] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\", lpFilePart=0x0) returned 0x4c [0054.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0054.778] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0054.778] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0054.779] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0054.779] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0054.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0054.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity", lpFilePart=0x0) returned 0x4b [0054.779] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\", lpFilePart=0x0) returned 0x4c [0054.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0054.779] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0054.779] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0054.779] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0054.779] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0054.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0054.780] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00", lpFilePart=0x0) returned 0x51 [0054.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\", lpFilePart=0x0) returned 0x52 [0054.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0054.788] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.794] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.794] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.794] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.794] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.795] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.796] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.797] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.798] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.798] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.798] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.798] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.799] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.800] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.801] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.802] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.802] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.802] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.806] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.807] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0054.807] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0054.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0054.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0054.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00", lpFilePart=0x0) returned 0x51 [0054.808] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\", lpFilePart=0x0) returned 0x52 [0054.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0054.809] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.810] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.811] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.812] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0054.813] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0054.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0054.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0054.814] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep", lpFilePart=0x0) returned 0x34 [0054.814] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\", lpFilePart=0x0) returned 0x35 [0054.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0054.815] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0054.815] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep", lpFilePart=0x0) returned 0x34 [0054.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\", lpFilePart=0x0) returned 0x35 [0054.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0054.815] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0054.815] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport", lpFilePart=0x0) returned 0x37 [0054.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\", lpFilePart=0x0) returned 0x38 [0054.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0054.828] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0054.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport", lpFilePart=0x0) returned 0x37 [0054.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\", lpFilePart=0x0) returned 0x38 [0054.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0054.828] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0054.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode", lpFilePart=0x0) returned 0x3f [0054.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\", lpFilePart=0x0) returned 0x40 [0054.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0054.828] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0054.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0054.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode", lpFilePart=0x0) returned 0x3f [0054.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\", lpFilePart=0x0) returned 0x40 [0054.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0054.829] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0054.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0054.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0054.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU", lpFilePart=0x0) returned 0x43 [0054.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\", lpFilePart=0x0) returned 0x44 [0054.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0054.830] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0054.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU", lpFilePart=0x0) returned 0x43 [0054.830] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\", lpFilePart=0x0) returned 0x44 [0054.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0054.830] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0054.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings", lpFilePart=0x0) returned 0x48 [0054.830] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\", lpFilePart=0x0) returned 0x49 [0054.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0054.830] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0054.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0054.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings", lpFilePart=0x0) returned 0x48 [0054.831] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\", lpFilePart=0x0) returned 0x49 [0054.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0054.831] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0054.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0054.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0054.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe", lpFilePart=0x0) returned 0x4e [0054.831] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\", lpFilePart=0x0) returned 0x4f [0054.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0054.836] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0054.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0054.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0054.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe", lpFilePart=0x0) returned 0x4e [0054.837] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\", lpFilePart=0x0) returned 0x4f [0054.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0054.838] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0054.840] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt", lpFilePart=0x0) returned 0x58 [0054.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0054.840] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.841] GetFileType (hFile=0x274) returned 0x1 [0054.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0054.841] GetFileType (hFile=0x274) returned 0x1 [0054.842] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x5f76c [0054.843] ReadFile (in: hFile=0x274, lpBuffer=0x2ca2620, nNumberOfBytesToRead=0x5f76c, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2ca2620*, lpNumberOfBytesRead=0x2ae390*=0x5f76c, lpOverlapped=0x0) returned 1 [0054.870] CloseHandle (hObject=0x274) returned 1 [0054.994] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt", lpFilePart=0x0) returned 0x58 [0054.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0054.994] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0054.994] GetFileType (hFile=0x274) returned 0x1 [0054.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0054.994] GetFileType (hFile=0x274) returned 0x1 [0054.994] WriteFile (in: hFile=0x274, lpBuffer=0x298d368*, nNumberOfBytesToWrite=0x5f770, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesWritten=0x2ae384*=0x5f770, lpOverlapped=0x0) returned 1 [0055.002] CloseHandle (hObject=0x274) returned 1 [0055.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt", lpFilePart=0x0) returned 0x58 [0055.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt.anonymous", lpFilePart=0x0) returned 0x62 [0055.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0055.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xe1e43ca0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbfb92f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f770)) returned 1 [0055.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0055.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt.anonymous")) returned 1 [0055.003] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt", lpFilePart=0x0) returned 0x5f [0055.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0055.003] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.091] GetFileType (hFile=0x274) returned 0x1 [0055.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0055.091] GetFileType (hFile=0x274) returned 0x1 [0055.091] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3229c [0055.092] ReadFile (in: hFile=0x274, lpBuffer=0x2d01da8, nNumberOfBytesToRead=0x3229c, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2d01da8*, lpNumberOfBytesRead=0x2ae390*=0x3229c, lpOverlapped=0x0) returned 1 [0055.261] CloseHandle (hObject=0x274) returned 1 [0055.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt", lpFilePart=0x0) returned 0x5f [0055.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0055.310] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.312] GetFileType (hFile=0x274) returned 0x1 [0055.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0055.312] GetFileType (hFile=0x274) returned 0x1 [0055.312] WriteFile (in: hFile=0x274, lpBuffer=0x2ba1120*, nNumberOfBytesToWrite=0x322a0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2ba1120*, lpNumberOfBytesWritten=0x2ae384*=0x322a0, lpOverlapped=0x0) returned 1 [0055.316] CloseHandle (hObject=0x274) returned 1 [0055.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt", lpFilePart=0x0) returned 0x5f [0055.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt.anonymous", lpFilePart=0x0) returned 0x69 [0055.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0055.317] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a448000, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xe1be26a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbfe8ca90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x322a0)) returned 1 [0055.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0055.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt.anonymous")) returned 1 [0055.318] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt", lpFilePart=0x0) returned 0x5b [0055.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0055.318] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.318] GetFileType (hFile=0x274) returned 0x1 [0055.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0055.318] GetFileType (hFile=0x274) returned 0x1 [0055.318] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x19ea7 [0055.319] ReadFile (in: hFile=0x274, lpBuffer=0x2d34060, nNumberOfBytesToRead=0x19ea7, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2d34060*, lpNumberOfBytesRead=0x2ae390*=0x19ea7, lpOverlapped=0x0) returned 1 [0055.328] CloseHandle (hObject=0x274) returned 1 [0055.346] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt", lpFilePart=0x0) returned 0x5b [0055.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0055.346] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.348] GetFileType (hFile=0x274) returned 0x1 [0055.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0055.348] GetFileType (hFile=0x274) returned 0x1 [0055.348] WriteFile (in: hFile=0x274, lpBuffer=0x2c3aec0*, nNumberOfBytesToWrite=0x19eb0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2c3aec0*, lpNumberOfBytesWritten=0x2ae384*=0x19eb0, lpOverlapped=0x0) returned 1 [0055.351] CloseHandle (hObject=0x274) returned 1 [0055.351] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt", lpFilePart=0x0) returned 0x5b [0055.351] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt.anonymous", lpFilePart=0x0) returned 0x65 [0055.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0055.351] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xe1e69e00, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbfed8d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19eb0)) returned 1 [0055.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0055.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt.anonymous")) returned 1 [0055.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt", lpFilePart=0x0) returned 0x5b [0055.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0055.352] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.352] GetFileType (hFile=0x274) returned 0x1 [0055.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0055.352] GetFileType (hFile=0x274) returned 0x1 [0055.352] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x29ed0 [0055.353] ReadFile (in: hFile=0x274, lpBuffer=0x2c54d90, nNumberOfBytesToRead=0x29ed0, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x2c54d90*, lpNumberOfBytesRead=0x2ae390*=0x29ed0, lpOverlapped=0x0) returned 1 [0055.372] CloseHandle (hObject=0x274) returned 1 [0055.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt", lpFilePart=0x0) returned 0x5b [0055.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0055.440] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.442] GetFileType (hFile=0x274) returned 0x1 [0055.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0055.442] GetFileType (hFile=0x274) returned 0x1 [0055.442] WriteFile (in: hFile=0x274, lpBuffer=0x2a6d560*, nNumberOfBytesToWrite=0x29ee0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x2a6d560*, lpNumberOfBytesWritten=0x2ae384*=0x29ee0, lpOverlapped=0x0) returned 1 [0055.446] CloseHandle (hObject=0x274) returned 1 [0055.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt", lpFilePart=0x0) returned 0x5b [0055.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt.anonymous", lpFilePart=0x0) returned 0x65 [0055.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0055.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xe1e43ca0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xbffbd590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x29ee0)) returned 1 [0055.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0055.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt.anonymous")) returned 1 [0055.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt", lpFilePart=0x0) returned 0x59 [0055.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0055.447] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.447] GetFileType (hFile=0x274) returned 0x1 [0055.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0055.447] GetFileType (hFile=0x274) returned 0x1 [0055.447] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x288d [0055.447] ReadFile (in: hFile=0x274, lpBuffer=0x1954c20, nNumberOfBytesToRead=0x288d, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1954c20*, lpNumberOfBytesRead=0x2ae390*=0x288d, lpOverlapped=0x0) returned 1 [0055.456] CloseHandle (hObject=0x274) returned 1 [0055.470] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt", lpFilePart=0x0) returned 0x59 [0055.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0055.470] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.471] GetFileType (hFile=0x274) returned 0x1 [0055.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0055.471] GetFileType (hFile=0x274) returned 0x1 [0055.471] WriteFile (in: hFile=0x274, lpBuffer=0x19b0a24*, nNumberOfBytesToWrite=0x2890, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19b0a24*, lpNumberOfBytesWritten=0x2ae384*=0x2890, lpOverlapped=0x0) returned 1 [0055.472] CloseHandle (hObject=0x274) returned 1 [0055.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt", lpFilePart=0x0) returned 0x59 [0055.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.anonymous", lpFilePart=0x0) returned 0x63 [0055.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0055.472] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xe1be26a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xc0009850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2890)) returned 1 [0055.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0055.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt.anonymous")) returned 1 [0055.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt", lpFilePart=0x0) returned 0x5b [0055.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0055.473] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.473] GetFileType (hFile=0x274) returned 0x1 [0055.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0055.473] GetFileType (hFile=0x274) returned 0x1 [0055.473] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2e9c [0055.473] ReadFile (in: hFile=0x274, lpBuffer=0x19b37c4, nNumberOfBytesToRead=0x2e9c, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19b37c4*, lpNumberOfBytesRead=0x2ae390*=0x2e9c, lpOverlapped=0x0) returned 1 [0055.475] CloseHandle (hObject=0x274) returned 1 [0055.488] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt", lpFilePart=0x0) returned 0x5b [0055.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0055.488] CreateFileW (lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.490] GetFileType (hFile=0x274) returned 0x1 [0055.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0055.490] GetFileType (hFile=0x274) returned 0x1 [0055.490] WriteFile (in: hFile=0x274, lpBuffer=0x1a0eecc*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a0eecc*, lpNumberOfBytesWritten=0x2ae384*=0x2ea0, lpOverlapped=0x0) returned 1 [0055.491] CloseHandle (hObject=0x274) returned 1 [0055.491] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt", lpFilePart=0x0) returned 0x5b [0055.491] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.anonymous", lpFilePart=0x0) returned 0x65 [0055.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0055.491] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29135300, ftCreationTime.dwHighDateTime=0x1cb8519, ftLastAccessTime.dwLowDateTime=0xe1be26a0, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xc002f9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0)) returned 1 [0055.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0055.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.anonymous" (normalized: "c:\\program files\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt.anonymous")) returned 1 [0055.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0055.492] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac", lpFilePart=0x0) returned 0x4c [0055.492] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\", lpFilePart=0x0) returned 0x4d [0055.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb18 [0055.499] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.500] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.500] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.500] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.500] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.500] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.501] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.502] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.502] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.502] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.502] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.503] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.503] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.503] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0055.503] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0055.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0055.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0055.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac", lpFilePart=0x0) returned 0x4c [0055.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\", lpFilePart=0x0) returned 0x4d [0055.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb18 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.506] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.507] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.508] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.509] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0055.509] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0055.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0055.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0055.510] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win", lpFilePart=0x0) returned 0x4c [0055.511] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\", lpFilePart=0x0) returned 0x4d [0055.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb18 [0055.513] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.513] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.513] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.514] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.515] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.515] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.515] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.515] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.515] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.515] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0055.515] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0055.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0055.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0055.517] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win", lpFilePart=0x0) returned 0x4c [0055.517] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\", lpFilePart=0x0) returned 0x4d [0055.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb18 [0055.519] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.519] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.519] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.519] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.520] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.520] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.520] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.520] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.520] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.520] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.521] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.521] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.521] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.521] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.521] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0055.522] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0055.522] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0055.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0055.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.523] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Setup Files", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files", lpFilePart=0x0) returned 0x2e [0055.523] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\", lpFilePart=0x0) returned 0x2f [0055.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.535] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.535] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.535] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.535] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Setup Files", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files", lpFilePart=0x0) returned 0x2e [0055.536] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\", lpFilePart=0x0) returned 0x2f [0055.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.536] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.536] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.536] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.536] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.537] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpFilePart=0x0) returned 0x55 [0055.537] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\", lpFilePart=0x0) returned 0x56 [0055.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.567] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.567] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.567] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.567] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.567] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.568] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.569] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.570] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.571] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.571] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.571] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.571] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.571] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.571] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.571] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpFilePart=0x0) returned 0x55 [0055.573] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\", lpFilePart=0x0) returned 0x56 [0055.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.574] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.575] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.576] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.577] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.577] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0055.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files", lpFilePart=0x0) returned 0x1d [0055.579] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\", lpFilePart=0x0) returned 0x1e [0055.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbeb18 [0055.579] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.579] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.579] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.579] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.579] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.579] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0055.580] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0055.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0055.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0055.580] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files", lpFilePart=0x0) returned 0x1d [0055.580] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\", lpFilePart=0x0) returned 0x1e [0055.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbeb18 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.580] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0055.581] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0055.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0055.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0055.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe", lpFilePart=0x0) returned 0x23 [0055.581] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\", lpFilePart=0x0) returned 0x24 [0055.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.581] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0055.581] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0055.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0055.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0055.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe", lpFilePart=0x0) returned 0x23 [0055.582] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\", lpFilePart=0x0) returned 0x24 [0055.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0055.582] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.582] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.582] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.582] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.582] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0055.582] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0055.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0055.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2b [0055.582] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x2c [0055.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.583] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.583] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.583] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.583] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2b [0055.583] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x2c [0055.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.583] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.583] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.584] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.584] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX", lpFilePart=0x0) returned 0x33 [0055.584] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\", lpFilePart=0x0) returned 0x34 [0055.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.585] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.589] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.589] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.589] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.590] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.591] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.592] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.593] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX", lpFilePart=0x0) returned 0x33 [0055.594] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\", lpFilePart=0x0) returned 0x34 [0055.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.595] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.595] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.595] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.595] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.596] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.596] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.596] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.596] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.596] FindNextFileW (in: hFindFile=0xbeb18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.597] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM", lpFilePart=0x0) returned 0x27 [0055.598] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x28 [0055.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.599] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.600] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM", lpFilePart=0x0) returned 0x27 [0055.600] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x28 [0055.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.600] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.601] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\ARM\\1.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0", lpFilePart=0x0) returned 0x2b [0055.601] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\", lpFilePart=0x0) returned 0x2c [0055.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.601] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.601] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\ARM\\1.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0", lpFilePart=0x0) returned 0x2b [0055.601] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\", lpFilePart=0x0) returned 0x2c [0055.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.602] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.602] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg", lpFilePart=0x0) returned 0x2b [0055.602] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\", lpFilePart=0x0) returned 0x2c [0055.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.630] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg", lpFilePart=0x0) returned 0x2b [0055.632] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\", lpFilePart=0x0) returned 0x2c [0055.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.635] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.637] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES", lpFilePart=0x0) returned 0x31 [0055.637] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES\\", lpFilePart=0x0) returned 0x32 [0055.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.639] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.639] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES", lpFilePart=0x0) returned 0x31 [0055.639] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES\\", lpFilePart=0x0) returned 0x32 [0055.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.640] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.640] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ", lpFilePart=0x0) returned 0x31 [0055.640] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\", lpFilePart=0x0) returned 0x32 [0055.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.641] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ", lpFilePart=0x0) returned 0x31 [0055.641] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\", lpFilePart=0x0) returned 0x32 [0055.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.641] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK", lpFilePart=0x0) returned 0x31 [0055.641] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK\\", lpFilePart=0x0) returned 0x32 [0055.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.642] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.642] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK", lpFilePart=0x0) returned 0x31 [0055.643] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK\\", lpFilePart=0x0) returned 0x32 [0055.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\da_DK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.643] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.643] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE", lpFilePart=0x0) returned 0x31 [0055.643] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE\\", lpFilePart=0x0) returned 0x32 [0055.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.644] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.644] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE", lpFilePart=0x0) returned 0x31 [0055.644] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE\\", lpFilePart=0x0) returned 0x32 [0055.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\de_DE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.644] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US", lpFilePart=0x0) returned 0x31 [0055.645] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US\\", lpFilePart=0x0) returned 0x32 [0055.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.645] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US", lpFilePart=0x0) returned 0x31 [0055.645] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US\\", lpFilePart=0x0) returned 0x32 [0055.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.646] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.646] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES", lpFilePart=0x0) returned 0x31 [0055.646] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES\\", lpFilePart=0x0) returned 0x32 [0055.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.647] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES", lpFilePart=0x0) returned 0x31 [0055.647] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES\\", lpFilePart=0x0) returned 0x32 [0055.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\es_ES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.647] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES", lpFilePart=0x0) returned 0x31 [0055.647] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES\\", lpFilePart=0x0) returned 0x32 [0055.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.647] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.648] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES", lpFilePart=0x0) returned 0x31 [0055.648] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES\\", lpFilePart=0x0) returned 0x32 [0055.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.648] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.648] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI", lpFilePart=0x0) returned 0x31 [0055.648] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI\\", lpFilePart=0x0) returned 0x32 [0055.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.649] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.649] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI", lpFilePart=0x0) returned 0x31 [0055.649] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI\\", lpFilePart=0x0) returned 0x32 [0055.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.649] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.649] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR", lpFilePart=0x0) returned 0x31 [0055.649] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR\\", lpFilePart=0x0) returned 0x32 [0055.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.650] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.650] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR", lpFilePart=0x0) returned 0x31 [0055.650] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR\\", lpFilePart=0x0) returned 0x32 [0055.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.650] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.650] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR", lpFilePart=0x0) returned 0x31 [0055.651] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR\\", lpFilePart=0x0) returned 0x32 [0055.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.651] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.651] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR", lpFilePart=0x0) returned 0x31 [0055.651] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR\\", lpFilePart=0x0) returned 0x32 [0055.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.651] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.652] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU", lpFilePart=0x0) returned 0x31 [0055.652] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU\\", lpFilePart=0x0) returned 0x32 [0055.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.653] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.653] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU", lpFilePart=0x0) returned 0x31 [0055.653] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU\\", lpFilePart=0x0) returned 0x32 [0055.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.653] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.653] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT", lpFilePart=0x0) returned 0x31 [0055.653] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT\\", lpFilePart=0x0) returned 0x32 [0055.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.654] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT", lpFilePart=0x0) returned 0x31 [0055.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT\\", lpFilePart=0x0) returned 0x32 [0055.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\it_IT\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.654] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP", lpFilePart=0x0) returned 0x31 [0055.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP\\", lpFilePart=0x0) returned 0x32 [0055.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.655] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.656] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP", lpFilePart=0x0) returned 0x31 [0055.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP\\", lpFilePart=0x0) returned 0x32 [0055.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.656] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.656] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR", lpFilePart=0x0) returned 0x31 [0055.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR\\", lpFilePart=0x0) returned 0x32 [0055.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.656] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR", lpFilePart=0x0) returned 0x31 [0055.657] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR\\", lpFilePart=0x0) returned 0x32 [0055.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.657] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO", lpFilePart=0x0) returned 0x31 [0055.657] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO\\", lpFilePart=0x0) returned 0x32 [0055.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.657] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO", lpFilePart=0x0) returned 0x31 [0055.657] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO\\", lpFilePart=0x0) returned 0x32 [0055.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.658] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL", lpFilePart=0x0) returned 0x31 [0055.658] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL\\", lpFilePart=0x0) returned 0x32 [0055.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.659] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL", lpFilePart=0x0) returned 0x31 [0055.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL\\", lpFilePart=0x0) returned 0x32 [0055.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.659] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL", lpFilePart=0x0) returned 0x31 [0055.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL\\", lpFilePart=0x0) returned 0x32 [0055.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.659] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL", lpFilePart=0x0) returned 0x31 [0055.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL\\", lpFilePart=0x0) returned 0x32 [0055.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.660] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR", lpFilePart=0x0) returned 0x31 [0055.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR\\", lpFilePart=0x0) returned 0x32 [0055.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.660] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR", lpFilePart=0x0) returned 0x31 [0055.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR\\", lpFilePart=0x0) returned 0x32 [0055.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.661] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO", lpFilePart=0x0) returned 0x31 [0055.661] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO\\", lpFilePart=0x0) returned 0x32 [0055.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.662] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO", lpFilePart=0x0) returned 0x31 [0055.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO\\", lpFilePart=0x0) returned 0x32 [0055.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.662] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU", lpFilePart=0x0) returned 0x31 [0055.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU\\", lpFilePart=0x0) returned 0x32 [0055.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.663] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU", lpFilePart=0x0) returned 0x31 [0055.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU\\", lpFilePart=0x0) returned 0x32 [0055.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.663] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK", lpFilePart=0x0) returned 0x31 [0055.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK\\", lpFilePart=0x0) returned 0x32 [0055.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.665] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK", lpFilePart=0x0) returned 0x31 [0055.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK\\", lpFilePart=0x0) returned 0x32 [0055.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.665] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI", lpFilePart=0x0) returned 0x31 [0055.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI\\", lpFilePart=0x0) returned 0x32 [0055.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.666] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI", lpFilePart=0x0) returned 0x31 [0055.666] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI\\", lpFilePart=0x0) returned 0x32 [0055.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.666] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE", lpFilePart=0x0) returned 0x31 [0055.666] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE\\", lpFilePart=0x0) returned 0x32 [0055.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.668] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.668] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE", lpFilePart=0x0) returned 0x31 [0055.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE\\", lpFilePart=0x0) returned 0x32 [0055.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.668] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR", lpFilePart=0x0) returned 0x31 [0055.669] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR\\", lpFilePart=0x0) returned 0x32 [0055.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.670] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR", lpFilePart=0x0) returned 0x31 [0055.671] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR\\", lpFilePart=0x0) returned 0x32 [0055.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.671] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA", lpFilePart=0x0) returned 0x31 [0055.671] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA\\", lpFilePart=0x0) returned 0x32 [0055.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.672] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.672] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA", lpFilePart=0x0) returned 0x31 [0055.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA\\", lpFilePart=0x0) returned 0x32 [0055.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.673] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.673] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN", lpFilePart=0x0) returned 0x31 [0055.673] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN\\", lpFilePart=0x0) returned 0x32 [0055.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.673] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.674] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN", lpFilePart=0x0) returned 0x31 [0055.674] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN\\", lpFilePart=0x0) returned 0x32 [0055.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.674] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.674] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW", lpFilePart=0x0) returned 0x31 [0055.674] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW\\", lpFilePart=0x0) returned 0x32 [0055.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.675] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.675] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW", lpFilePart=0x0) returned 0x31 [0055.675] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW\\", lpFilePart=0x0) returned 0x32 [0055.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb18 [0055.675] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0055.676] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\DESIGNER", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER", lpFilePart=0x0) returned 0x26 [0055.676] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER\\", lpFilePart=0x0) returned 0x27 [0055.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0055.677] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0055.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0055.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0055.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\DESIGNER", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER", lpFilePart=0x0) returned 0x26 [0055.677] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER\\", lpFilePart=0x0) returned 0x27 [0055.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0055.677] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0055.678] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java", lpFilePart=0x0) returned 0x22 [0055.678] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\", lpFilePart=0x0) returned 0x23 [0055.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0055.678] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.678] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java", lpFilePart=0x0) returned 0x22 [0055.678] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\", lpFilePart=0x0) returned 0x23 [0055.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb18 [0055.678] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update", lpFilePart=0x0) returned 0x2e [0055.679] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\", lpFilePart=0x0) returned 0x2f [0055.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.679] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update", lpFilePart=0x0) returned 0x2e [0055.679] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\", lpFilePart=0x0) returned 0x2f [0055.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb18 [0055.679] FindClose (in: hFindFile=0xbeb18 | out: hFindFile=0xbeb18) returned 1 [0055.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml", lpFilePart=0x0) returned 0x37 [0055.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.680] GetFileType (hFile=0x274) returned 0x1 [0055.680] GetFileType (hFile=0x274) returned 0x1 [0055.680] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x583 [0055.698] CloseHandle (hObject=0x274) returned 1 [0055.740] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml", lpFilePart=0x0) returned 0x37 [0055.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.743] GetFileType (hFile=0x274) returned 0x1 [0055.743] GetFileType (hFile=0x274) returned 0x1 [0055.743] WriteFile (in: hFile=0x274, lpBuffer=0x1ab8180*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ab8180*, lpNumberOfBytesWritten=0x2ae528*=0x590, lpOverlapped=0x0) returned 1 [0055.744] CloseHandle (hObject=0x274) returned 1 [0055.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml", lpFilePart=0x0) returned 0x37 [0055.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml.anonymous", lpFilePart=0x0) returned 0x41 [0055.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93eb1a00, ftCreationTime.dwHighDateTime=0x1ce7715, ftLastAccessTime.dwLowDateTime=0x70253c60, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc0290fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0055.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task.xml.anonymous" (normalized: "c:\\program files\\common files\\java\\java update\\task.xml.anonymous")) returned 1 [0055.746] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task64.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml", lpFilePart=0x0) returned 0x39 [0055.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task64.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.746] GetFileType (hFile=0x274) returned 0x1 [0055.746] GetFileType (hFile=0x274) returned 0x1 [0055.747] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x588 [0055.762] CloseHandle (hObject=0x274) returned 1 [0055.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task64.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml", lpFilePart=0x0) returned 0x39 [0055.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task64.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.775] GetFileType (hFile=0x274) returned 0x1 [0055.775] GetFileType (hFile=0x274) returned 0x1 [0055.777] WriteFile (in: hFile=0x274, lpBuffer=0x1931dd0*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1931dd0*, lpNumberOfBytesWritten=0x2ae528*=0x590, lpOverlapped=0x0) returned 1 [0055.778] CloseHandle (hObject=0x274) returned 1 [0055.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task64.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml", lpFilePart=0x0) returned 0x39 [0055.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\Java\\Java Update\\task64.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml.anonymous", lpFilePart=0x0) returned 0x43 [0055.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0055.779] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task64.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93eb1a00, ftCreationTime.dwHighDateTime=0x1ce7715, ftLastAccessTime.dwLowDateTime=0x70253c60, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc03033d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0055.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files\\common files\\java\\java update\\task64.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Java\\Java Update\\task64.xml.anonymous" (normalized: "c:\\program files\\common files\\java\\java update\\task64.xml.anonymous")) returned 1 [0055.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0055.780] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared", lpFilePart=0x0) returned 0x2e [0055.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\", lpFilePart=0x0) returned 0x2f [0055.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0055.780] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.780] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.780] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.781] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.781] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.781] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.781] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.781] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.781] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.782] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.783] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.784] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0055.784] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0055.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0055.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0055.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared", lpFilePart=0x0) returned 0x2e [0055.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\", lpFilePart=0x0) returned 0x2f [0055.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0055.785] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.785] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.785] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.785] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.785] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.785] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.786] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.787] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.788] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.788] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.788] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0055.788] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0055.788] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0055.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0055.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\DAO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DAO", lpFilePart=0x0) returned 0x32 [0055.788] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DAO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DAO\\", lpFilePart=0x0) returned 0x33 [0055.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DAO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.789] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\DAO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DAO", lpFilePart=0x0) returned 0x32 [0055.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DAO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DAO\\", lpFilePart=0x0) returned 0x33 [0055.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DAO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.790] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.790] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\DW", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DW", lpFilePart=0x0) returned 0x31 [0055.790] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DW\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DW\\", lpFilePart=0x0) returned 0x32 [0055.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DW\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.791] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.791] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.791] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.791] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\DW", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DW", lpFilePart=0x0) returned 0x31 [0055.791] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DW\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\DW\\", lpFilePart=0x0) returned 0x32 [0055.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\DW\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.791] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.791] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.797] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.797] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.797] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.798] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.798] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\EQUATION", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION", lpFilePart=0x0) returned 0x37 [0055.798] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\", lpFilePart=0x0) returned 0x38 [0055.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.799] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.800] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.800] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.801] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\EQUATION", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION", lpFilePart=0x0) returned 0x37 [0055.801] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\", lpFilePart=0x0) returned 0x38 [0055.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.802] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.803] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.803] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.804] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033", lpFilePart=0x0) returned 0x3c [0055.804] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033\\", lpFilePart=0x0) returned 0x3d [0055.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0055.805] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.805] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.805] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.805] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033", lpFilePart=0x0) returned 0x3c [0055.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033\\", lpFilePart=0x0) returned 0x3d [0055.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EQUATION\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0055.806] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.806] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.806] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.806] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\EURO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EURO", lpFilePart=0x0) returned 0x33 [0055.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EURO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EURO\\", lpFilePart=0x0) returned 0x34 [0055.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EURO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.807] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.808] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.808] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.808] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\EURO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EURO", lpFilePart=0x0) returned 0x33 [0055.808] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EURO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\EURO\\", lpFilePart=0x0) returned 0x34 [0055.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\EURO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.808] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.808] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.808] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.808] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.809] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Filters", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Filters", lpFilePart=0x0) returned 0x36 [0055.809] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpFilePart=0x0) returned 0x37 [0055.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.809] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.810] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.810] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Filters", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Filters", lpFilePart=0x0) returned 0x36 [0055.810] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\", lpFilePart=0x0) returned 0x37 [0055.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Filters\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.810] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.811] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.811] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.811] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.811] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.811] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.811] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\GRPHFLT", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT", lpFilePart=0x0) returned 0x36 [0055.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\", lpFilePart=0x0) returned 0x37 [0055.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.833] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.834] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.834] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.834] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.834] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.834] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.834] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.835] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\GRPHFLT", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT", lpFilePart=0x0) returned 0x36 [0055.835] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\", lpFilePart=0x0) returned 0x37 [0055.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0055.836] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.836] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.836] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.837] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.838] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.838] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.838] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.838] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0055.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.839] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG", lpFilePart=0x0) returned 0x3d [0055.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0055.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.850] GetFileType (hFile=0x274) returned 0x1 [0055.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0055.850] GetFileType (hFile=0x274) returned 0x1 [0055.851] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x425 [0055.851] ReadFile (in: hFile=0x274, lpBuffer=0x19475b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19475b4*, lpNumberOfBytesRead=0x2ae560*=0x425, lpOverlapped=0x0) returned 1 [0055.855] CloseHandle (hObject=0x274) returned 1 [0055.897] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG", lpFilePart=0x0) returned 0x3d [0055.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0055.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.899] GetFileType (hFile=0x274) returned 0x1 [0055.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0055.899] GetFileType (hFile=0x274) returned 0x1 [0055.899] WriteFile (in: hFile=0x274, lpBuffer=0x1996b00*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1996b00*, lpNumberOfBytesWritten=0x2ae528*=0x430, lpOverlapped=0x0) returned 1 [0055.900] CloseHandle (hObject=0x274) returned 1 [0055.900] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG", lpFilePart=0x0) returned 0x3d [0055.900] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG.anonymous", lpFilePart=0x0) returned 0x47 [0055.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0055.900] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a1d600, ftCreationTime.dwHighDateTime=0x1bcac51, ftLastAccessTime.dwLowDateTime=0x353d5070, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xc040dd70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x430)) returned 1 [0055.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\GRPHFLT\\MS.JPG.anonymous" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.anonymous")) returned 1 [0055.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help", lpFilePart=0x0) returned 0x33 [0055.901] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\", lpFilePart=0x0) returned 0x34 [0055.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.907] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.908] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.908] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.909] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help", lpFilePart=0x0) returned 0x33 [0055.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\", lpFilePart=0x0) returned 0x34 [0055.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.910] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0055.911] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0055.911] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.912] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1028", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028", lpFilePart=0x0) returned 0x38 [0055.912] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028\\", lpFilePart=0x0) returned 0x39 [0055.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.913] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.913] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.913] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.913] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.914] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1028", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028", lpFilePart=0x0) returned 0x38 [0055.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028\\", lpFilePart=0x0) returned 0x39 [0055.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1028\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.914] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.914] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.914] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.914] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.914] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1031", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031", lpFilePart=0x0) returned 0x38 [0055.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031\\", lpFilePart=0x0) returned 0x39 [0055.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.914] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.914] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.915] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.915] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.915] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1031", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031", lpFilePart=0x0) returned 0x38 [0055.915] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031\\", lpFilePart=0x0) returned 0x39 [0055.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1031\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.915] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.915] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.915] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.915] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.915] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033", lpFilePart=0x0) returned 0x38 [0055.915] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033\\", lpFilePart=0x0) returned 0x39 [0055.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.916] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.916] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.916] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.916] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033", lpFilePart=0x0) returned 0x38 [0055.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033\\", lpFilePart=0x0) returned 0x39 [0055.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.917] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.917] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.917] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.917] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.917] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1036", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036", lpFilePart=0x0) returned 0x38 [0055.917] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036\\", lpFilePart=0x0) returned 0x39 [0055.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.918] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.918] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.918] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.918] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1036", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036", lpFilePart=0x0) returned 0x38 [0055.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036\\", lpFilePart=0x0) returned 0x39 [0055.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1036\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.918] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.919] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.919] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.919] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1040", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040", lpFilePart=0x0) returned 0x38 [0055.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040\\", lpFilePart=0x0) returned 0x39 [0055.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.919] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.919] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.919] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.919] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1040", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040", lpFilePart=0x0) returned 0x38 [0055.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040\\", lpFilePart=0x0) returned 0x39 [0055.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1040\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.920] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.920] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.920] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.920] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1041", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041", lpFilePart=0x0) returned 0x38 [0055.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041\\", lpFilePart=0x0) returned 0x39 [0055.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.920] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.921] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.921] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.921] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1041", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041", lpFilePart=0x0) returned 0x38 [0055.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041\\", lpFilePart=0x0) returned 0x39 [0055.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1041\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.921] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.921] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.921] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.921] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Help\\1042", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1042", lpFilePart=0x0) returned 0x38 [0055.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1042\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1042\\", lpFilePart=0x0) returned 0x39 [0055.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1042\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.922] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.922] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.922] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.922] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1042\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.922] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.922] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.922] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.922] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1046\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.923] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.923] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.923] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.923] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1046\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.923] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.923] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.923] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.923] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1049\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.924] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.924] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.924] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0055.924] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\1049\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.924] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.924] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0055.925] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\2052\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.926] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\2052\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.926] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\3082\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.926] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0055.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Help\\3082\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0055.927] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0055.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0055.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0055.927] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0055.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0055.928] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0055.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0055.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0055.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0055.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0055.929] GetFileType (hFile=0x274) returned 0x1 [0055.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0055.929] GetFileType (hFile=0x274) returned 0x1 [0055.929] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc1486 [0055.954] CloseHandle (hObject=0x274) returned 1 [0056.006] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml", lpFilePart=0x0) returned 0x3f [0056.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0056.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0056.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0056.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr", lpFilePart=0x0) returned 0x3e [0056.031] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr\\", lpFilePart=0x0) returned 0x3f [0056.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.032] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.032] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.032] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.032] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr", lpFilePart=0x0) returned 0x3e [0056.032] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr\\", lpFilePart=0x0) returned 0x3f [0056.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSClientDataMgr\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.032] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.032] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.033] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.033] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.033] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSEnv", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv", lpFilePart=0x0) returned 0x34 [0056.033] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\", lpFilePart=0x0) returned 0x35 [0056.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.034] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.034] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.035] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.035] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.035] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSEnv", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv", lpFilePart=0x0) returned 0x34 [0056.035] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\", lpFilePart=0x0) returned 0x35 [0056.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.035] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.036] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.036] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.036] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.036] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies", lpFilePart=0x0) returned 0x45 [0056.036] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\", lpFilePart=0x0) returned 0x46 [0056.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.037] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.037] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.037] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.037] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.037] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies", lpFilePart=0x0) returned 0x45 [0056.037] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\", lpFilePart=0x0) returned 0x46 [0056.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.038] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.038] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.038] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.038] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.038] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0056.038] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", lpFilePart=0x0) returned 0x36 [0056.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.039] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.040] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.040] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.040] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.040] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0056.040] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\", lpFilePart=0x0) returned 0x36 [0056.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.041] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.041] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.041] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.041] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.041] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.042] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0056.042] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", lpFilePart=0x0) returned 0x3c [0056.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.042] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.042] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.042] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.042] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.043] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0056.043] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\", lpFilePart=0x0) returned 0x3c [0056.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.043] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.043] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.043] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.043] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.044] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14", lpFilePart=0x0) returned 0x37 [0056.044] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\", lpFilePart=0x0) returned 0x38 [0056.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.061] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.062] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.063] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.064] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.065] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.066] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.067] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.067] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.067] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.067] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.067] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.067] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14", lpFilePart=0x0) returned 0x37 [0056.067] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\", lpFilePart=0x0) returned 0x38 [0056.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.067] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.068] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.069] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.070] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.071] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.072] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.073] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.074] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.074] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.074] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.074] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.074] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.074] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.074] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033", lpFilePart=0x0) returned 0x3c [0056.075] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpFilePart=0x0) returned 0x3d [0056.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.077] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.078] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.079] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.079] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.080] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033", lpFilePart=0x0) returned 0x3c [0056.080] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpFilePart=0x0) returned 0x3d [0056.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.081] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.081] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.081] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.081] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.081] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.081] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.082] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.082] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures", lpFilePart=0x0) returned 0x40 [0056.083] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\", lpFilePart=0x0) returned 0x41 [0056.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.084] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.084] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.084] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.084] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.084] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures", lpFilePart=0x0) returned 0x40 [0056.084] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\", lpFilePart=0x0) returned 0x41 [0056.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.085] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.085] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.085] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.085] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller", lpFilePart=0x0) returned 0x4f [0056.085] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\", lpFilePart=0x0) returned 0x50 [0056.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.086] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.088] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.088] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.088] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.088] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.089] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.090] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.091] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.091] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.092] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller", lpFilePart=0x0) returned 0x4f [0056.092] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\", lpFilePart=0x0) returned 0x50 [0056.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.093] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.094] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.094] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.094] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.094] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.094] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.094] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.095] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpFilePart=0x0) returned 0x5c [0056.095] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpFilePart=0x0) returned 0x5d [0056.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.103] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.103] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.103] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.103] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.103] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.103] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpFilePart=0x0) returned 0x5c [0056.104] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpFilePart=0x0) returned 0x5d [0056.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.105] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.105] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.105] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.105] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.105] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.105] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpFilePart=0x0) returned 0x5b [0056.106] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpFilePart=0x0) returned 0x5c [0056.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.108] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.108] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.108] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.108] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpFilePart=0x0) returned 0x5b [0056.108] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpFilePart=0x0) returned 0x5c [0056.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.109] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.109] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpFilePart=0x0) returned 0x5c [0056.109] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpFilePart=0x0) returned 0x5d [0056.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.118] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpFilePart=0x0) returned 0x5c [0056.118] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpFilePart=0x0) returned 0x5d [0056.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.119] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpFilePart=0x0) returned 0x5e [0056.119] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpFilePart=0x0) returned 0x5f [0056.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.120] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpFilePart=0x0) returned 0x5e [0056.120] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpFilePart=0x0) returned 0x5f [0056.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.120] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpFilePart=0x0) returned 0x5c [0056.121] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpFilePart=0x0) returned 0x5d [0056.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.123] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.124] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpFilePart=0x0) returned 0x5c [0056.124] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpFilePart=0x0) returned 0x5d [0056.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.125] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.126] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpFilePart=0x0) returned 0x5d [0056.126] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpFilePart=0x0) returned 0x5e [0056.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.127] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.127] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpFilePart=0x0) returned 0x5d [0056.127] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpFilePart=0x0) returned 0x5e [0056.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.127] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.127] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpFilePart=0x0) returned 0x5d [0056.127] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpFilePart=0x0) returned 0x5e [0056.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.128] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.128] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpFilePart=0x0) returned 0x5d [0056.128] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpFilePart=0x0) returned 0x5e [0056.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.128] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.129] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpFilePart=0x0) returned 0x60 [0056.129] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpFilePart=0x0) returned 0x61 [0056.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.130] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpFilePart=0x0) returned 0x60 [0056.130] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpFilePart=0x0) returned 0x61 [0056.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.130] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpFilePart=0x0) returned 0x57 [0056.130] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpFilePart=0x0) returned 0x58 [0056.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.131] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.131] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpFilePart=0x0) returned 0x57 [0056.131] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpFilePart=0x0) returned 0x58 [0056.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.131] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.131] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpFilePart=0x0) returned 0x5d [0056.131] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpFilePart=0x0) returned 0x5e [0056.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.132] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpFilePart=0x0) returned 0x5d [0056.132] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpFilePart=0x0) returned 0x5e [0056.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.132] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpFilePart=0x0) returned 0x58 [0056.132] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpFilePart=0x0) returned 0x59 [0056.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.133] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpFilePart=0x0) returned 0x58 [0056.133] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpFilePart=0x0) returned 0x59 [0056.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.133] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpFilePart=0x0) returned 0x58 [0056.133] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpFilePart=0x0) returned 0x59 [0056.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.134] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpFilePart=0x0) returned 0x58 [0056.134] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpFilePart=0x0) returned 0x59 [0056.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.134] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpFilePart=0x0) returned 0x58 [0056.135] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpFilePart=0x0) returned 0x59 [0056.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.135] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpFilePart=0x0) returned 0x58 [0056.135] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpFilePart=0x0) returned 0x59 [0056.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.136] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpFilePart=0x0) returned 0x5e [0056.136] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpFilePart=0x0) returned 0x5f [0056.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.137] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpFilePart=0x0) returned 0x5e [0056.137] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpFilePart=0x0) returned 0x5f [0056.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.137] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpFilePart=0x0) returned 0x58 [0056.137] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpFilePart=0x0) returned 0x59 [0056.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.140] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.140] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpFilePart=0x0) returned 0x58 [0056.140] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpFilePart=0x0) returned 0x59 [0056.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.140] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpFilePart=0x0) returned 0x5f [0056.141] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpFilePart=0x0) returned 0x60 [0056.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.141] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpFilePart=0x0) returned 0x5f [0056.142] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpFilePart=0x0) returned 0x60 [0056.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.142] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpFilePart=0x0) returned 0x5b [0056.142] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpFilePart=0x0) returned 0x5c [0056.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.149] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.150] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpFilePart=0x0) returned 0x5b [0056.150] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpFilePart=0x0) returned 0x5c [0056.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.150] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.150] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpFilePart=0x0) returned 0x56 [0056.150] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpFilePart=0x0) returned 0x57 [0056.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.151] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpFilePart=0x0) returned 0x56 [0056.151] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpFilePart=0x0) returned 0x57 [0056.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.151] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpFilePart=0x0) returned 0x5a [0056.151] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpFilePart=0x0) returned 0x5b [0056.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.152] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.152] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpFilePart=0x0) returned 0x5a [0056.152] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpFilePart=0x0) returned 0x5b [0056.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.152] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.152] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x4f [0056.152] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x50 [0056.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.159] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.160] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x4f [0056.160] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x50 [0056.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.161] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Portal", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal", lpFilePart=0x0) returned 0x35 [0056.162] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\", lpFilePart=0x0) returned 0x36 [0056.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.169] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Portal", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal", lpFilePart=0x0) returned 0x35 [0056.169] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\", lpFilePart=0x0) returned 0x36 [0056.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.170] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Portal\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033", lpFilePart=0x0) returned 0x3a [0056.170] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033\\", lpFilePart=0x0) returned 0x3b [0056.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.170] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Portal\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033", lpFilePart=0x0) returned 0x3a [0056.170] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033\\", lpFilePart=0x0) returned 0x3b [0056.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Portal\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.170] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.171] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\PROOF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\PROOF", lpFilePart=0x0) returned 0x34 [0056.171] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\PROOF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\PROOF\\", lpFilePart=0x0) returned 0x35 [0056.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\PROOF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.172] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\PROOF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\PROOF", lpFilePart=0x0) returned 0x34 [0056.172] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\PROOF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\PROOF\\", lpFilePart=0x0) returned 0x35 [0056.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\PROOF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.172] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag", lpFilePart=0x0) returned 0x38 [0056.172] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\", lpFilePart=0x0) returned 0x39 [0056.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.178] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag", lpFilePart=0x0) returned 0x38 [0056.179] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\", lpFilePart=0x0) returned 0x39 [0056.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.180] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033", lpFilePart=0x0) returned 0x3d [0056.181] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033\\", lpFilePart=0x0) returned 0x3e [0056.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.183] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033", lpFilePart=0x0) returned 0x3d [0056.183] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033\\", lpFilePart=0x0) returned 0x3e [0056.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.183] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS", lpFilePart=0x0) returned 0x3e [0056.183] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\", lpFilePart=0x0) returned 0x3f [0056.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.183] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.184] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS", lpFilePart=0x0) returned 0x3e [0056.184] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\", lpFilePart=0x0) returned 0x3f [0056.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0056.184] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.184] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033", lpFilePart=0x0) returned 0x43 [0056.184] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033\\", lpFilePart=0x0) returned 0x44 [0056.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.184] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.184] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033", lpFilePart=0x0) returned 0x43 [0056.184] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033\\", lpFilePart=0x0) returned 0x44 [0056.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0056.184] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Source Engine", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine", lpFilePart=0x0) returned 0x3c [0056.185] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\", lpFilePart=0x0) returned 0x3d [0056.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.185] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Source Engine", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine", lpFilePart=0x0) returned 0x3c [0056.186] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\", lpFilePart=0x0) returned 0x3d [0056.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.186] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Stationery", lpFilePart=0x0) returned 0x39 [0056.186] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\", lpFilePart=0x0) returned 0x3a [0056.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.188] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.190] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Stationery", lpFilePart=0x0) returned 0x39 [0056.190] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\", lpFilePart=0x0) returned 0x3a [0056.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0056.191] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0056.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x43 [0056.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0056.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0056.193] GetFileType (hFile=0x274) returned 0x1 [0056.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0056.193] GetFileType (hFile=0x274) returned 0x1 [0056.193] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x432 [0056.205] CloseHandle (hObject=0x274) returned 1 [0056.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x43 [0056.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0056.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0056.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0056.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.232] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\TextConv", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv", lpFilePart=0x0) returned 0x37 [0056.232] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\", lpFilePart=0x0) returned 0x38 [0056.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.234] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.234] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.234] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.234] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.235] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.235] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.235] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.235] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.235] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.235] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.235] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.236] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\TextConv", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv", lpFilePart=0x0) returned 0x37 [0056.236] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\", lpFilePart=0x0) returned 0x38 [0056.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.238] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.239] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.239] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.239] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.239] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US", lpFilePart=0x0) returned 0x3d [0056.240] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\", lpFilePart=0x0) returned 0x3e [0056.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.241] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.241] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.241] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.242] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US", lpFilePart=0x0) returned 0x3d [0056.242] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\", lpFilePart=0x0) returned 0x3e [0056.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.242] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.242] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.242] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.242] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv", lpFilePart=0x0) returned 0x3f [0056.242] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv\\", lpFilePart=0x0) returned 0x40 [0056.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.253] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.253] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.253] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.253] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv", lpFilePart=0x0) returned 0x3f [0056.253] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv\\", lpFilePart=0x0) returned 0x40 [0056.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\WksConv\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.254] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.254] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.254] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.254] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14", lpFilePart=0x0) returned 0x37 [0056.254] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\", lpFilePart=0x0) returned 0x38 [0056.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.256] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.257] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.257] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.257] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.257] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.257] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.258] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.259] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.260] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.261] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.262] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.262] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14", lpFilePart=0x0) returned 0x37 [0056.264] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\", lpFilePart=0x0) returned 0x38 [0056.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.265] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.266] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.267] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.268] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.269] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.269] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.271] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON", lpFilePart=0x0) returned 0x40 [0056.271] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON\\", lpFilePart=0x0) returned 0x41 [0056.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.273] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.273] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON", lpFilePart=0x0) returned 0x40 [0056.273] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON\\", lpFilePart=0x0) returned 0x41 [0056.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.273] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.274] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.274] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.274] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.274] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.274] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.274] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC", lpFilePart=0x0) returned 0x3e [0056.274] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC\\", lpFilePart=0x0) returned 0x3f [0056.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.275] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.275] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.275] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.276] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.276] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC", lpFilePart=0x0) returned 0x3e [0056.276] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC\\", lpFilePart=0x0) returned 0x3f [0056.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.276] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.277] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.277] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.277] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS", lpFilePart=0x0) returned 0x3c [0056.277] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS\\", lpFilePart=0x0) returned 0x3d [0056.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.278] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.278] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.278] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.278] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.278] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.278] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.278] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS", lpFilePart=0x0) returned 0x3c [0056.278] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS\\", lpFilePart=0x0) returned 0x3d [0056.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.279] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.279] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.279] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.279] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.279] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.279] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.279] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.279] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS", lpFilePart=0x0) returned 0x3e [0056.279] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS\\", lpFilePart=0x0) returned 0x3f [0056.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.280] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.280] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.280] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.280] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.280] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.280] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.280] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.280] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS", lpFilePart=0x0) returned 0x3e [0056.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS\\", lpFilePart=0x0) returned 0x3f [0056.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.281] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.281] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.281] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.281] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.281] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.281] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.281] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM", lpFilePart=0x0) returned 0x40 [0056.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM\\", lpFilePart=0x0) returned 0x41 [0056.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.282] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM", lpFilePart=0x0) returned 0x40 [0056.282] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM\\", lpFilePart=0x0) returned 0x41 [0056.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.282] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.283] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.283] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.283] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.283] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.283] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT", lpFilePart=0x0) returned 0x40 [0056.283] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT\\", lpFilePart=0x0) returned 0x41 [0056.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.284] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.284] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT", lpFilePart=0x0) returned 0x40 [0056.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT\\", lpFilePart=0x0) returned 0x41 [0056.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.284] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.285] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI", lpFilePart=0x0) returned 0x40 [0056.285] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\", lpFilePart=0x0) returned 0x41 [0056.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.285] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.286] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI", lpFilePart=0x0) returned 0x40 [0056.286] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\", lpFilePart=0x0) returned 0x41 [0056.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.286] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.287] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE", lpFilePart=0x0) returned 0x3e [0056.287] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE\\", lpFilePart=0x0) returned 0x3f [0056.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.287] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.287] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.287] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.288] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE", lpFilePart=0x0) returned 0x3e [0056.288] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE\\", lpFilePart=0x0) returned 0x3f [0056.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.288] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.288] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON", lpFilePart=0x0) returned 0x3e [0056.289] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON\\", lpFilePart=0x0) returned 0x3f [0056.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.289] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.289] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.289] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.289] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.289] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.289] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.289] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON", lpFilePart=0x0) returned 0x3e [0056.290] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON\\", lpFilePart=0x0) returned 0x3f [0056.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.290] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.290] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.290] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.290] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.290] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.290] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.290] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES", lpFilePart=0x0) returned 0x40 [0056.290] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES\\", lpFilePart=0x0) returned 0x41 [0056.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.291] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.291] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.291] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.291] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.291] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.291] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.291] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.291] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES", lpFilePart=0x0) returned 0x40 [0056.291] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES\\", lpFilePart=0x0) returned 0x41 [0056.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.292] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE", lpFilePart=0x0) returned 0x3f [0056.292] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE\\", lpFilePart=0x0) returned 0x40 [0056.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.292] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.293] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE", lpFilePart=0x0) returned 0x3f [0056.293] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE\\", lpFilePart=0x0) returned 0x40 [0056.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.294] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS", lpFilePart=0x0) returned 0x3f [0056.294] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS\\", lpFilePart=0x0) returned 0x40 [0056.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.295] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.295] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS", lpFilePart=0x0) returned 0x3f [0056.295] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS\\", lpFilePart=0x0) returned 0x40 [0056.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.295] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.295] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE", lpFilePart=0x0) returned 0x40 [0056.296] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE\\", lpFilePart=0x0) returned 0x41 [0056.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.296] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.297] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE", lpFilePart=0x0) returned 0x40 [0056.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE\\", lpFilePart=0x0) returned 0x41 [0056.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.297] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.297] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE", lpFilePart=0x0) returned 0x40 [0056.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE\\", lpFilePart=0x0) returned 0x41 [0056.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.298] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE", lpFilePart=0x0) returned 0x40 [0056.298] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE\\", lpFilePart=0x0) returned 0x41 [0056.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.298] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO", lpFilePart=0x0) returned 0x3c [0056.298] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO\\", lpFilePart=0x0) returned 0x3d [0056.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.298] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO", lpFilePart=0x0) returned 0x3c [0056.298] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO\\", lpFilePart=0x0) returned 0x3d [0056.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.298] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE", lpFilePart=0x0) returned 0x3f [0056.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE\\", lpFilePart=0x0) returned 0x40 [0056.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.299] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.299] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE", lpFilePart=0x0) returned 0x3f [0056.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE\\", lpFilePart=0x0) returned 0x40 [0056.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.299] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE", lpFilePart=0x0) returned 0x3c [0056.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE\\", lpFilePart=0x0) returned 0x3d [0056.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.300] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE", lpFilePart=0x0) returned 0x3c [0056.300] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE\\", lpFilePart=0x0) returned 0x3d [0056.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.301] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN", lpFilePart=0x0) returned 0x40 [0056.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN\\", lpFilePart=0x0) returned 0x41 [0056.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.301] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN", lpFilePart=0x0) returned 0x40 [0056.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN\\", lpFilePart=0x0) returned 0x41 [0056.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.301] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN", lpFilePart=0x0) returned 0x40 [0056.301] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN\\", lpFilePart=0x0) returned 0x41 [0056.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.302] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN", lpFilePart=0x0) returned 0x40 [0056.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN\\", lpFilePart=0x0) returned 0x41 [0056.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.302] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ICE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ICE", lpFilePart=0x0) returned 0x3b [0056.302] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ICE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ICE\\", lpFilePart=0x0) returned 0x3c [0056.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ICE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.303] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\ICE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.303] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.304] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.304] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.304] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.305] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.305] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.305] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.305] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.306] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.307] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.307] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.307] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.308] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.308] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.309] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.309] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.309] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.310] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.310] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.311] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.311] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.311] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.311] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.312] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.312] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.313] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.313] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.314] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.314] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.314] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.315] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.315] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.316] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SKY\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.316] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SKY\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.317] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.324] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.325] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.358] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.359] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.359] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.359] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.525] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.526] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.526] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.527] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.527] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.527] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\WATER\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.528] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\WATER\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.528] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.529] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.529] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.556] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.558] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.561] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.561] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.562] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.563] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.563] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.563] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.567] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.568] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.569] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.569] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.570] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.570] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.570] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.570] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.571] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.571] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.572] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.572] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA6\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.573] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA6\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.573] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.574] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.574] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.588] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.591] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.593] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.593] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.594] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.594] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Visio Shared\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.594] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Visio Shared\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.594] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.601] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.604] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.606] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.606] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\8.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.615] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\8.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.618] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.628] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.630] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.631] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.632] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.632] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.633] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.633] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.633] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.634] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.636] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.638] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.640] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.642] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.644] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.646] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.648] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.658] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.660] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.664] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.666] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.668] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.668] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Folders\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.669] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Folders\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.670] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Folders\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.670] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Folders\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.670] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.671] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0056.671] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.671] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0056.672] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.672] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee98 [0056.672] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0056.673] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0056.673] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee98 [0056.673] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee98 [0056.674] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0056.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0056.674] GetFileType (hFile=0x274) returned 0x1 [0056.674] GetFileType (hFile=0x274) returned 0x1 [0056.674] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xa8e [0056.684] CloseHandle (hObject=0x274) returned 1 [0056.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0056.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad3a8) returned 1 [0056.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.710] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines", lpFilePart=0x0) returned 0x2b [0056.710] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\", lpFilePart=0x0) returned 0x2c [0056.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.710] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.710] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.711] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0056.711] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.711] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines", lpFilePart=0x0) returned 0x2b [0056.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\", lpFilePart=0x0) returned 0x2c [0056.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.711] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.711] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.711] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0056.711] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.712] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", lpFilePart=0x0) returned 0x35 [0056.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0056.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.712] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.712] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.712] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.713] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.713] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft", lpFilePart=0x0) returned 0x35 [0056.713] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0056.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.713] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.713] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.713] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.713] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.713] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", lpFilePart=0x0) returned 0x3b [0056.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpFilePart=0x0) returned 0x3c [0056.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.714] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.714] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.714] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.714] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.714] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.715] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.715] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.715] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.715] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20", lpFilePart=0x0) returned 0x3b [0056.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpFilePart=0x0) returned 0x3c [0056.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.715] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.715] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.715] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.716] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.716] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.716] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.716] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.716] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.716] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", lpFilePart=0x0) returned 0x41 [0056.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpFilePart=0x0) returned 0x42 [0056.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0056.717] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.717] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.717] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.717] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.717] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.717] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US", lpFilePart=0x0) returned 0x41 [0056.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpFilePart=0x0) returned 0x42 [0056.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec18 [0056.718] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.718] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.718] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.718] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.718] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.718] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0056.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", lpFilePart=0x0) returned 0x49 [0056.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpFilePart=0x0) returned 0x4a [0056.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec18 [0056.723] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.723] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.724] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0056.724] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0056.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0056.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0056.726] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk", lpFilePart=0x0) returned 0x49 [0056.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", lpFilePart=0x0) returned 0x4a [0056.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec18 [0056.727] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.727] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.727] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.728] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.728] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.728] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.728] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.728] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.728] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.729] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0056.729] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0056.729] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0056.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0056.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System", lpFilePart=0x0) returned 0x24 [0056.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\", lpFilePart=0x0) returned 0x25 [0056.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.730] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.730] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.730] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.731] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0056.731] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.732] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System", lpFilePart=0x0) returned 0x24 [0056.732] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\", lpFilePart=0x0) returned 0x25 [0056.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.732] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.733] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.733] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.733] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0056.733] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.733] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\ado", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado", lpFilePart=0x0) returned 0x28 [0056.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado\\", lpFilePart=0x0) returned 0x29 [0056.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.735] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.735] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.736] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.737] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.737] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\ado", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado", lpFilePart=0x0) returned 0x28 [0056.738] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado\\", lpFilePart=0x0) returned 0x29 [0056.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.739] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.742] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.742] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.742] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.743] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\ado\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado\\en-US", lpFilePart=0x0) returned 0x2e [0056.743] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpFilePart=0x0) returned 0x2f [0056.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.744] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.744] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\ado\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado\\en-US", lpFilePart=0x0) returned 0x2e [0056.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpFilePart=0x0) returned 0x2f [0056.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.745] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.745] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.745] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.745] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.745] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\en-US", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\en-US", lpFilePart=0x0) returned 0x2a [0056.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\en-US\\", lpFilePart=0x0) returned 0x2b [0056.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.746] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.746] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.746] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.746] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.746] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\en-US", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\en-US", lpFilePart=0x0) returned 0x2a [0056.746] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\en-US\\", lpFilePart=0x0) returned 0x2b [0056.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.747] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.747] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.747] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.747] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.747] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\msadc", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc", lpFilePart=0x0) returned 0x2a [0056.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc\\", lpFilePart=0x0) returned 0x2b [0056.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.749] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.749] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.749] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.749] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.750] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.751] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.751] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.751] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\msadc", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc", lpFilePart=0x0) returned 0x2a [0056.752] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc\\", lpFilePart=0x0) returned 0x2b [0056.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.755] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.755] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.755] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.755] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.755] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.756] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\msadc\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc\\en-US", lpFilePart=0x0) returned 0x30 [0056.756] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpFilePart=0x0) returned 0x31 [0056.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.759] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\msadc\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc\\en-US", lpFilePart=0x0) returned 0x30 [0056.760] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpFilePart=0x0) returned 0x31 [0056.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.761] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.761] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.761] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.762] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.762] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.762] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.762] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.762] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.762] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.763] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\MSMAPI", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI", lpFilePart=0x0) returned 0x2b [0056.763] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI\\", lpFilePart=0x0) returned 0x2c [0056.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.768] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.769] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\MSMAPI", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI", lpFilePart=0x0) returned 0x2b [0056.769] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI\\", lpFilePart=0x0) returned 0x2c [0056.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.769] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.769] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\MSMAPI\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", lpFilePart=0x0) returned 0x30 [0056.769] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpFilePart=0x0) returned 0x31 [0056.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.770] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.770] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.770] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.770] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\MSMAPI\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033", lpFilePart=0x0) returned 0x30 [0056.770] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpFilePart=0x0) returned 0x31 [0056.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.770] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.770] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.770] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.770] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\Ole DB", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB", lpFilePart=0x0) returned 0x2b [0056.771] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpFilePart=0x0) returned 0x2c [0056.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.773] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\Ole DB", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB", lpFilePart=0x0) returned 0x2b [0056.775] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpFilePart=0x0) returned 0x2c [0056.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.776] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.777] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\Ole DB\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", lpFilePart=0x0) returned 0x31 [0056.778] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpFilePart=0x0) returned 0x32 [0056.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.779] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.780] GetFullPathNameW (in: lpFileName="\\Program Files\\Common Files\\System\\Ole DB\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US", lpFilePart=0x0) returned 0x31 [0056.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpFilePart=0x0) returned 0x32 [0056.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0056.780] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0056.780] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker", lpFilePart=0x0) returned 0x1a [0056.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\DVD Maker\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\", lpFilePart=0x0) returned 0x1b [0056.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0056.780] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0056.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0056.780] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker", lpFilePart=0x0) returned 0x1a [0056.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\DVD Maker\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\", lpFilePart=0x0) returned 0x1b [0056.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0056.781] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0056.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0056.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.781] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\en-US", lpFilePart=0x0) returned 0x20 [0056.781] GetFullPathNameW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\en-US\\", lpFilePart=0x0) returned 0x21 [0056.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.781] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.781] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\en-US", lpFilePart=0x0) returned 0x20 [0056.781] GetFullPathNameW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\en-US\\", lpFilePart=0x0) returned 0x21 [0056.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.782] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.782] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker\\Shared", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\Shared", lpFilePart=0x0) returned 0x21 [0056.782] GetFullPathNameW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\Shared\\", lpFilePart=0x0) returned 0x22 [0056.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.783] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.784] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker\\Shared", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\Shared", lpFilePart=0x0) returned 0x21 [0056.784] GetFullPathNameW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\Shared\\", lpFilePart=0x0) returned 0x22 [0056.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0056.786] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0056.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.787] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpFilePart=0x0) returned 0x35 [0056.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0056.787] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0056.788] GetFileType (hFile=0x274) returned 0x1 [0056.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0056.788] GetFileType (hFile=0x274) returned 0x1 [0056.788] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x6d1f [0056.801] CloseHandle (hObject=0x274) returned 1 [0056.828] GetFullPathNameW (in: lpFileName="\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpFilePart=0x0) returned 0x35 [0056.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0056.828] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0056.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad3a8) returned 1 [0056.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0056.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Google", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google", lpFilePart=0x0) returned 0x17 [0056.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\", lpFilePart=0x0) returned 0x18 [0056.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf018 [0056.830] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0056.830] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0056.830] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0056.830] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0056.830] FindClose (in: hFindFile=0xbf018 | out: hFindFile=0xbf018) returned 1 [0056.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0056.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0056.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0056.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Google", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google", lpFilePart=0x0) returned 0x17 [0056.830] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\", lpFilePart=0x0) returned 0x18 [0056.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf018 [0056.831] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0056.831] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0056.831] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0056.831] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0056.831] FindClose (in: hFindFile=0xbf018 | out: hFindFile=0xbf018) returned 1 [0056.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0056.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0056.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome", lpFilePart=0x0) returned 0x1e [0056.831] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\", lpFilePart=0x0) returned 0x1f [0056.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf018 [0056.832] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.832] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.832] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0056.832] FindClose (in: hFindFile=0xbf018 | out: hFindFile=0xbf018) returned 1 [0056.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0056.855] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome", lpFilePart=0x0) returned 0x1e [0056.855] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\", lpFilePart=0x0) returned 0x1f [0056.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf018 [0056.855] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.855] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0056.855] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0056.856] FindClose (in: hFindFile=0xbf018 | out: hFindFile=0xbf018) returned 1 [0056.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0056.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0056.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application", lpFilePart=0x0) returned 0x2a [0056.856] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\", lpFilePart=0x0) returned 0x2b [0056.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf018 [0056.856] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.856] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.856] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.856] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.857] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.857] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.857] FindClose (in: hFindFile=0xbf018 | out: hFindFile=0xbf018) returned 1 [0056.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0056.857] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application", lpFilePart=0x0) returned 0x2a [0056.857] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\", lpFilePart=0x0) returned 0x2b [0056.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf018 [0056.857] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.857] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.857] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.858] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.858] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0056.858] FindNextFileW (in: hFindFile=0xbf018, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0056.858] FindClose (in: hFindFile=0xbf018 | out: hFindFile=0xbf018) returned 1 [0056.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0056.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0056.858] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", lpFilePart=0x0) returned 0x4c [0056.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0056.858] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files\\google\\chrome\\application\\chrome.visualelementsmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0056.858] GetFileType (hFile=0x274) returned 0x1 [0056.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0056.858] GetFileType (hFile=0x274) returned 0x1 [0056.859] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x19a [0056.859] ReadFile (in: hFile=0x274, lpBuffer=0x19a1e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19a1e28*, lpNumberOfBytesRead=0x2ae560*=0x19a, lpOverlapped=0x0) returned 1 [0056.860] CloseHandle (hObject=0x274) returned 1 [0056.893] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", lpFilePart=0x0) returned 0x4c [0056.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0056.894] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files\\google\\chrome\\application\\chrome.visualelementsmanifest.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0056.895] GetFileType (hFile=0x274) returned 0x1 [0056.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0056.895] GetFileType (hFile=0x274) returned 0x1 [0056.895] WriteFile (in: hFile=0x274, lpBuffer=0x19f06f4*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19f06f4*, lpNumberOfBytesWritten=0x2ae528*=0x1a0, lpOverlapped=0x0) returned 1 [0056.896] CloseHandle (hObject=0x274) returned 1 [0056.896] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", lpFilePart=0x0) returned 0x4c [0056.896] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.anonymous", lpFilePart=0x0) returned 0x56 [0056.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0056.896] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files\\google\\chrome\\application\\chrome.visualelementsmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe211b870, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe211b870, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xc0d93570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0056.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files\\google\\chrome\\application\\chrome.visualelementsmanifest.xml"), lpNewFileName="C:\\Program Files\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.anonymous" (normalized: "c:\\program files\\google\\chrome\\application\\chrome.visualelementsmanifest.xml.anonymous")) returned 1 [0056.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.897] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110", lpFilePart=0x0) returned 0x38 [0056.897] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\", lpFilePart=0x0) returned 0x39 [0056.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0056.897] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.915] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.915] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.915] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.915] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.915] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.915] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.916] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.917] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.918] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.918] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.918] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.918] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.918] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.918] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0056.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0056.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110", lpFilePart=0x0) returned 0x38 [0056.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\", lpFilePart=0x0) returned 0x39 [0056.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0056.919] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.919] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.919] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.919] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.919] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.920] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.937] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.937] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.937] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.937] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.937] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.937] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.938] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0056.939] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0056.940] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0056.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0056.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0056.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.940] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps", lpFilePart=0x0) returned 0x45 [0056.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\", lpFilePart=0x0) returned 0x46 [0056.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0056.958] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.958] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.959] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0056.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.961] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps", lpFilePart=0x0) returned 0x45 [0056.961] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\", lpFilePart=0x0) returned 0x46 [0056.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0056.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.966] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.966] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.994] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.995] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.995] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.995] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0056.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.996] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions", lpFilePart=0x0) returned 0x43 [0056.997] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\", lpFilePart=0x0) returned 0x44 [0056.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0056.998] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.998] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.998] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0056.998] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0056.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0056.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0056.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0056.999] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions", lpFilePart=0x0) returned 0x43 [0056.999] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\", lpFilePart=0x0) returned 0x44 [0056.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0056.999] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0056.999] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.000] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.000] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.000] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer", lpFilePart=0x0) returned 0x42 [0057.000] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\", lpFilePart=0x0) returned 0x43 [0057.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0057.001] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.001] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.001] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.001] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.001] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.002] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer", lpFilePart=0x0) returned 0x42 [0057.002] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\", lpFilePart=0x0) returned 0x43 [0057.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0057.002] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.002] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.003] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.003] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.003] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.003] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.003] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales", lpFilePart=0x0) returned 0x40 [0057.003] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\", lpFilePart=0x0) returned 0x41 [0057.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0057.019] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.020] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.021] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.022] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.023] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.023] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.023] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.023] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.024] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales", lpFilePart=0x0) returned 0x40 [0057.024] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\", lpFilePart=0x0) returned 0x41 [0057.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.026] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.027] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.028] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.028] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.029] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements", lpFilePart=0x0) returned 0x47 [0057.029] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\", lpFilePart=0x0) returned 0x48 [0057.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0057.055] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.055] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.055] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.055] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.055] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.055] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.056] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.057] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements", lpFilePart=0x0) returned 0x47 [0057.057] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\", lpFilePart=0x0) returned 0x48 [0057.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0057.058] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.058] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.058] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.058] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.058] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.058] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.058] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0057.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.059] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png", lpFilePart=0x0) returned 0x50 [0057.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0057.059] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.061] GetFileType (hFile=0x274) returned 0x1 [0057.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0057.061] GetFileType (hFile=0x274) returned 0x1 [0057.061] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x442a [0057.061] ReadFile (in: hFile=0x274, lpBuffer=0x1a0d288, nNumberOfBytesToRead=0x442a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a0d288*, lpNumberOfBytesRead=0x2ae478*=0x442a, lpOverlapped=0x0) returned 1 [0057.107] CloseHandle (hObject=0x274) returned 1 [0057.123] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png", lpFilePart=0x0) returned 0x50 [0057.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0057.123] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.124] GetFileType (hFile=0x274) returned 0x1 [0057.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0057.125] GetFileType (hFile=0x274) returned 0x1 [0057.125] WriteFile (in: hFile=0x274, lpBuffer=0x1a6f564*, nNumberOfBytesToWrite=0x4430, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a6f564*, lpNumberOfBytesWritten=0x2ae46c*=0x4430, lpOverlapped=0x0) returned 1 [0057.126] CloseHandle (hObject=0x274) returned 1 [0057.126] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png", lpFilePart=0x0) returned 0x50 [0057.126] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png.anonymous", lpFilePart=0x0) returned 0x5a [0057.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0057.126] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b62fb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe0b62fb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xc0fcea10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4430)) returned 1 [0057.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0057.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png.anonymous" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png.anonymous")) returned 1 [0057.127] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png", lpFilePart=0x0) returned 0x56 [0057.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0057.127] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.127] GetFileType (hFile=0x274) returned 0x1 [0057.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0057.128] GetFileType (hFile=0x274) returned 0x1 [0057.128] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5741 [0057.128] ReadFile (in: hFile=0x274, lpBuffer=0x1a73e5c, nNumberOfBytesToRead=0x5741, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a73e5c*, lpNumberOfBytesRead=0x2ae478*=0x5741, lpOverlapped=0x0) returned 1 [0057.134] CloseHandle (hObject=0x274) returned 1 [0057.152] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png", lpFilePart=0x0) returned 0x56 [0057.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0057.152] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.153] GetFileType (hFile=0x274) returned 0x1 [0057.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0057.153] GetFileType (hFile=0x274) returned 0x1 [0057.154] WriteFile (in: hFile=0x274, lpBuffer=0x1adc0d8*, nNumberOfBytesToWrite=0x5750, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1adc0d8*, lpNumberOfBytesWritten=0x2ae46c*=0x5750, lpOverlapped=0x0) returned 1 [0057.155] CloseHandle (hObject=0x274) returned 1 [0057.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png", lpFilePart=0x0) returned 0x56 [0057.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png.anonymous", lpFilePart=0x0) returned 0x60 [0057.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0057.155] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b62fb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe0b62fb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xc101acd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5750)) returned 1 [0057.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0057.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png.anonymous" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png.anonymous")) returned 1 [0057.156] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png", lpFilePart=0x0) returned 0x55 [0057.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0057.156] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.156] GetFileType (hFile=0x274) returned 0x1 [0057.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0057.156] GetFileType (hFile=0x274) returned 0x1 [0057.156] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1ef3 [0057.156] ReadFile (in: hFile=0x274, lpBuffer=0x1ae1d24, nNumberOfBytesToRead=0x1ef3, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae1d24*, lpNumberOfBytesRead=0x2ae478*=0x1ef3, lpOverlapped=0x0) returned 1 [0057.158] CloseHandle (hObject=0x274) returned 1 [0057.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png", lpFilePart=0x0) returned 0x55 [0057.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0057.172] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.173] GetFileType (hFile=0x274) returned 0x1 [0057.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0057.173] GetFileType (hFile=0x274) returned 0x1 [0057.173] WriteFile (in: hFile=0x274, lpBuffer=0x194e648*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x194e648*, lpNumberOfBytesWritten=0x2ae46c*=0x1f00, lpOverlapped=0x0) returned 1 [0057.174] CloseHandle (hObject=0x274) returned 1 [0057.174] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png", lpFilePart=0x0) returned 0x55 [0057.174] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png.anonymous", lpFilePart=0x0) returned 0x5f [0057.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0057.175] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b62fb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe0b62fb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xc1040e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f00)) returned 1 [0057.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0057.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png.anonymous" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png.anonymous")) returned 1 [0057.175] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png", lpFilePart=0x0) returned 0x5b [0057.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0057.175] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.175] GetFileType (hFile=0x274) returned 0x1 [0057.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0057.175] GetFileType (hFile=0x274) returned 0x1 [0057.175] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1ea2 [0057.175] ReadFile (in: hFile=0x274, lpBuffer=0x1950a48, nNumberOfBytesToRead=0x1ea2, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1950a48*, lpNumberOfBytesRead=0x2ae478*=0x1ea2, lpOverlapped=0x0) returned 1 [0057.183] CloseHandle (hObject=0x274) returned 1 [0057.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png", lpFilePart=0x0) returned 0x5b [0057.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0057.220] CreateFileW (lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.221] GetFileType (hFile=0x274) returned 0x1 [0057.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0057.221] GetFileType (hFile=0x274) returned 0x1 [0057.221] WriteFile (in: hFile=0x274, lpBuffer=0x19a7300*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19a7300*, lpNumberOfBytesWritten=0x2ae46c*=0x1eb0, lpOverlapped=0x0) returned 1 [0057.222] CloseHandle (hObject=0x274) returned 1 [0057.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png", lpFilePart=0x0) returned 0x5b [0057.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png.anonymous", lpFilePart=0x0) returned 0x65 [0057.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0057.223] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b62fb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe0b62fb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xc10b3250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1eb0)) returned 1 [0057.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0057.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png.anonymous" (normalized: "c:\\program files\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png.anonymous")) returned 1 [0057.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm", lpFilePart=0x0) returned 0x44 [0057.224] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\", lpFilePart=0x0) returned 0x45 [0057.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbead8 [0057.224] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.224] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.224] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.224] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.224] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0057.225] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm", lpFilePart=0x0) returned 0x44 [0057.225] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\", lpFilePart=0x0) returned 0x45 [0057.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbead8 [0057.225] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.225] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.225] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0057.225] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0057.225] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0057.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0057.225] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific", lpFilePart=0x0) returned 0x57 [0057.225] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\", lpFilePart=0x0) returned 0x58 [0057.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbead8 [0057.226] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0057.226] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0057.226] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0057.226] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0057.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0057.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0057.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific", lpFilePart=0x0) returned 0x57 [0057.226] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\", lpFilePart=0x0) returned 0x58 [0057.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbead8 [0057.227] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0057.227] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0057.227] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0057.227] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0057.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0057.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0057.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86", lpFilePart=0x0) returned 0x5f [0057.227] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86\\", lpFilePart=0x0) returned 0x60 [0057.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbead8 [0057.237] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.237] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.237] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.237] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.237] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.238] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0057.238] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0057.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0057.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0057.239] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86", lpFilePart=0x0) returned 0x5f [0057.239] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86\\", lpFilePart=0x0) returned 0x60 [0057.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x86\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbead8 [0057.240] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.240] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.240] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.240] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.240] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0057.240] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0057.241] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0057.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0057.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.242] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\SetupMetrics", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics", lpFilePart=0x0) returned 0x37 [0057.242] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\", lpFilePart=0x0) returned 0x38 [0057.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbead8 [0057.242] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.242] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.242] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.243] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\Chrome\\Application\\SetupMetrics", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics", lpFilePart=0x0) returned 0x37 [0057.243] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\", lpFilePart=0x0) returned 0x38 [0057.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbead8 [0057.243] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.243] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.243] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.243] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0057.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\CrashReports", lpFilePart=0x0) returned 0x24 [0057.244] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x25 [0057.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\CrashReports\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.244] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.244] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.244] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0057.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0057.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0057.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\CrashReports", lpFilePart=0x0) returned 0x24 [0057.244] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x25 [0057.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Google\\CrashReports\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.245] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.245] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.245] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0057.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0057.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0057.245] GetFullPathNameW (in: lpFileName="\\Program Files\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer", lpFilePart=0x0) returned 0x22 [0057.245] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\", lpFilePart=0x0) returned 0x23 [0057.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbead8 [0057.245] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.245] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.246] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.247] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0057.247] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0057.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0057.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0057.248] GetFullPathNameW (in: lpFileName="\\Program Files\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer", lpFilePart=0x0) returned 0x22 [0057.248] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\", lpFilePart=0x0) returned 0x23 [0057.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbead8 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.248] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.249] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0057.250] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0057.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0057.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0057.250] GetFullPathNameW (in: lpFileName="\\Program Files\\Internet Explorer\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\en-US", lpFilePart=0x0) returned 0x28 [0057.250] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\en-US\\", lpFilePart=0x0) returned 0x29 [0057.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.250] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.251] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.251] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0057.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0057.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0057.251] GetFullPathNameW (in: lpFileName="\\Program Files\\Internet Explorer\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\en-US", lpFilePart=0x0) returned 0x28 [0057.251] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\en-US\\", lpFilePart=0x0) returned 0x29 [0057.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.252] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.253] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0057.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0057.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0057.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Internet Explorer\\SIGNUP", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\SIGNUP", lpFilePart=0x0) returned 0x29 [0057.253] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\SIGNUP\\", lpFilePart=0x0) returned 0x2a [0057.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.253] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.253] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.253] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.253] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0057.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0057.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0057.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Internet Explorer\\SIGNUP", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\SIGNUP", lpFilePart=0x0) returned 0x29 [0057.254] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\SIGNUP\\", lpFilePart=0x0) returned 0x2a [0057.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.254] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0057.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0057.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0057.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Java", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java", lpFilePart=0x0) returned 0x15 [0057.254] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\", lpFilePart=0x0) returned 0x16 [0057.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbead8 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.254] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0057.255] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0057.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0057.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0057.255] GetFullPathNameW (in: lpFileName="\\Program Files\\Java", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java", lpFilePart=0x0) returned 0x15 [0057.255] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\", lpFilePart=0x0) returned 0x16 [0057.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbead8 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0057.255] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.255] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7", lpFilePart=0x0) returned 0x1a [0057.255] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\", lpFilePart=0x0) returned 0x1b [0057.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.255] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.256] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7", lpFilePart=0x0) returned 0x1a [0057.256] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\", lpFilePart=0x0) returned 0x1b [0057.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbead8 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0057.256] FindNextFileW (in: hFindFile=0xbead8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0057.256] FindClose (in: hFindFile=0xbead8 | out: hFindFile=0xbead8) returned 1 [0057.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\README.txt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\README.txt", lpFilePart=0x0) returned 0x25 [0057.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\README.txt" (normalized: "c:\\program files\\java\\jre7\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.257] GetFileType (hFile=0x274) returned 0x1 [0057.257] GetFileType (hFile=0x274) returned 0x1 [0057.257] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x2f [0057.257] ReadFile (in: hFile=0x274, lpBuffer=0x19bdf90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19bdf90*, lpNumberOfBytesRead=0x2ae5d4*=0x2f, lpOverlapped=0x0) returned 1 [0057.259] CloseHandle (hObject=0x274) returned 1 [0057.271] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\README.txt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\README.txt", lpFilePart=0x0) returned 0x25 [0057.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\README.txt" (normalized: "c:\\program files\\java\\jre7\\readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.273] GetFileType (hFile=0x274) returned 0x1 [0057.273] GetFileType (hFile=0x274) returned 0x1 [0057.275] CloseHandle (hObject=0x274) returned 1 [0057.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\README.txt", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\README.txt", lpFilePart=0x0) returned 0x25 [0057.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\README.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\README.txt.anonymous", lpFilePart=0x0) returned 0x2f [0057.275] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\README.txt" (normalized: "c:\\program files\\java\\jre7\\readme.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67654e80, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67654e80, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc114b7d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30)) returned 1 [0057.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\README.txt" (normalized: "c:\\program files\\java\\jre7\\readme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre7\\README.txt.anonymous" (normalized: "c:\\program files\\java\\jre7\\readme.txt.anonymous")) returned 1 [0057.276] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", lpFilePart=0x0) returned 0x3d [0057.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.276] GetFileType (hFile=0x274) returned 0x1 [0057.276] GetFileType (hFile=0x274) returned 0x1 [0057.276] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1e8b1 [0057.277] ReadFile (in: hFile=0x274, lpBuffer=0x2c19db8, nNumberOfBytesToRead=0x1e8b1, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2c19db8*, lpNumberOfBytesRead=0x2ae5d4*=0x1e8b1, lpOverlapped=0x0) returned 1 [0057.292] CloseHandle (hObject=0x274) returned 1 [0057.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", lpFilePart=0x0) returned 0x3d [0057.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.318] GetFileType (hFile=0x274) returned 0x1 [0057.318] GetFileType (hFile=0x274) returned 0x1 [0057.318] WriteFile (in: hFile=0x274, lpBuffer=0x29ca4e8*, nNumberOfBytesToWrite=0x1e8c0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x29ca4e8*, lpNumberOfBytesWritten=0x2ae5c8*=0x1e8c0, lpOverlapped=0x0) returned 1 [0057.322] CloseHandle (hObject=0x274) returned 1 [0057.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", lpFilePart=0x0) returned 0x3d [0057.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.anonymous", lpFilePart=0x0) returned 0x47 [0057.322] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67654e80, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67654e80, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc11bdbf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e8c0)) returned 1 [0057.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.anonymous" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme-javafx.txt.anonymous")) returned 1 [0057.323] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", lpFilePart=0x0) returned 0x36 [0057.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.324] GetFileType (hFile=0x274) returned 0x1 [0057.324] GetFileType (hFile=0x274) returned 0x1 [0057.324] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x2b350 [0057.324] ReadFile (in: hFile=0x274, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0x2b350, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae5d4*=0x2b350, lpOverlapped=0x0) returned 1 [0057.335] CloseHandle (hObject=0x274) returned 1 [0057.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", lpFilePart=0x0) returned 0x36 [0057.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0057.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.443] GetFileType (hFile=0x274) returned 0x1 [0057.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0057.443] GetFileType (hFile=0x274) returned 0x1 [0057.443] WriteFile (in: hFile=0x274, lpBuffer=0x2a9b1d0*, nNumberOfBytesToWrite=0x2b360, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x2a9b1d0*, lpNumberOfBytesWritten=0x2ae5c8*=0x2b360, lpOverlapped=0x0) returned 1 [0057.448] CloseHandle (hObject=0x274) returned 1 [0057.448] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", lpFilePart=0x0) returned 0x36 [0057.448] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.anonymous", lpFilePart=0x0) returned 0x40 [0057.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0057.448] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6767afe0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6767afe0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc12ee6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2b360)) returned 1 [0057.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0057.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.anonymous" (normalized: "c:\\program files\\java\\jre7\\thirdpartylicensereadme.txt.anonymous")) returned 1 [0057.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\Welcome.html", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\Welcome.html", lpFilePart=0x0) returned 0x27 [0057.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0057.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files\\java\\jre7\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.449] GetFileType (hFile=0x274) returned 0x1 [0057.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0057.450] GetFileType (hFile=0x274) returned 0x1 [0057.450] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x3d7 [0057.450] ReadFile (in: hFile=0x274, lpBuffer=0x194ee10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x194ee10*, lpNumberOfBytesRead=0x2ae5d4*=0x3d7, lpOverlapped=0x0) returned 1 [0057.456] CloseHandle (hObject=0x274) returned 1 [0057.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\Welcome.html", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\Welcome.html", lpFilePart=0x0) returned 0x27 [0057.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0057.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files\\java\\jre7\\welcome.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.507] GetFileType (hFile=0x274) returned 0x1 [0057.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0057.507] GetFileType (hFile=0x274) returned 0x1 [0057.507] WriteFile (in: hFile=0x274, lpBuffer=0x199f3ac*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x199f3ac*, lpNumberOfBytesWritten=0x2ae59c*=0x3e0, lpOverlapped=0x0) returned 1 [0057.508] CloseHandle (hObject=0x274) returned 1 [0057.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\Welcome.html", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\Welcome.html", lpFilePart=0x0) returned 0x27 [0057.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\Welcome.html.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\Welcome.html.anonymous", lpFilePart=0x0) returned 0x31 [0057.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0057.509] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files\\java\\jre7\\welcome.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6767afe0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6767afe0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc1360b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0057.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0057.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files\\java\\jre7\\welcome.html"), lpNewFileName="C:\\Program Files\\Java\\jre7\\Welcome.html.anonymous" (normalized: "c:\\program files\\java\\jre7\\welcome.html.anonymous")) returned 1 [0057.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0057.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin", lpFilePart=0x0) returned 0x1e [0057.512] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\", lpFilePart=0x0) returned 0x1f [0057.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0057.519] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.520] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.520] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.520] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.520] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.520] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.521] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.521] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.521] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.521] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.521] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.521] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.525] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.534] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.534] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.534] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.534] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.534] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0057.534] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0057.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0057.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0057.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0057.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin", lpFilePart=0x0) returned 0x1e [0057.534] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\", lpFilePart=0x0) returned 0x1f [0057.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0057.535] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.535] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.535] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.535] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.535] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.536] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.536] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.536] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.536] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.536] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.536] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.537] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.537] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.537] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.537] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.537] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.538] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.538] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.538] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.538] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.538] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.538] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.539] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.539] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.539] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.539] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.539] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.539] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.540] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.541] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.542] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.543] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.544] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.544] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.544] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.544] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.544] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0057.544] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0057.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0057.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0057.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\client", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client", lpFilePart=0x0) returned 0x25 [0057.544] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client\\", lpFilePart=0x0) returned 0x26 [0057.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0057.545] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.545] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.545] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.546] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.546] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.546] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0057.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.546] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\client", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client", lpFilePart=0x0) returned 0x25 [0057.546] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client\\", lpFilePart=0x0) returned 0x26 [0057.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0057.546] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.546] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.546] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.546] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.547] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.547] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0057.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt", lpFilePart=0x0) returned 0x30 [0057.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0057.547] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files\\java\\jre7\\bin\\client\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.547] GetFileType (hFile=0x274) returned 0x1 [0057.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0057.547] GetFileType (hFile=0x274) returned 0x1 [0057.547] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5a7 [0057.547] ReadFile (in: hFile=0x274, lpBuffer=0x19b0fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19b0fbc*, lpNumberOfBytesRead=0x2ae4ec*=0x5a7, lpOverlapped=0x0) returned 1 [0057.565] CloseHandle (hObject=0x274) returned 1 [0057.607] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt", lpFilePart=0x0) returned 0x30 [0057.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0057.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files\\java\\jre7\\bin\\client\\xusage.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.608] GetFileType (hFile=0x274) returned 0x1 [0057.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0057.609] GetFileType (hFile=0x274) returned 0x1 [0057.609] WriteFile (in: hFile=0x274, lpBuffer=0x193a460*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x193a460*, lpNumberOfBytesWritten=0x2ae4b4*=0x5b0, lpOverlapped=0x0) returned 1 [0057.610] CloseHandle (hObject=0x274) returned 1 [0057.610] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt", lpFilePart=0x0) returned 0x30 [0057.610] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt.anonymous", lpFilePart=0x0) returned 0x3a [0057.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0057.610] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files\\java\\jre7\\bin\\client\\xusage.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676a1140, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x676a1140, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc146b4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0057.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0057.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files\\java\\jre7\\bin\\client\\xusage.txt"), lpNewFileName="C:\\Program Files\\Java\\jre7\\bin\\client\\Xusage.txt.anonymous" (normalized: "c:\\program files\\java\\jre7\\bin\\client\\xusage.txt.anonymous")) returned 1 [0057.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.611] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\dtplugin", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\dtplugin", lpFilePart=0x0) returned 0x27 [0057.611] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\", lpFilePart=0x0) returned 0x28 [0057.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbecd8 [0057.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.612] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.612] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0057.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.612] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\dtplugin", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\dtplugin", lpFilePart=0x0) returned 0x27 [0057.612] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\", lpFilePart=0x0) returned 0x28 [0057.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbecd8 [0057.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.613] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.613] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0057.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.613] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\plugin2", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\plugin2", lpFilePart=0x0) returned 0x26 [0057.613] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\plugin2\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\plugin2\\", lpFilePart=0x0) returned 0x27 [0057.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbecd8 [0057.614] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.614] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.615] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.615] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.615] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0057.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0057.615] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\bin\\plugin2", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\plugin2", lpFilePart=0x0) returned 0x26 [0057.615] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\plugin2\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\bin\\plugin2\\", lpFilePart=0x0) returned 0x27 [0057.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbecd8 [0057.615] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.615] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.615] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0057.616] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0057.616] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0057.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0057.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0057.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib", lpFilePart=0x0) returned 0x1e [0057.616] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\", lpFilePart=0x0) returned 0x1f [0057.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbecd8 [0057.632] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.633] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.633] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.633] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.634] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.634] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.634] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.634] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.634] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.634] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.635] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.636] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.637] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.638] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0057.638] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0057.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0057.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0057.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0057.640] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib", lpFilePart=0x0) returned 0x1e [0057.640] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\", lpFilePart=0x0) returned 0x1f [0057.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbecd8 [0057.641] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.641] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.641] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.641] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.641] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.641] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.642] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.643] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.644] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0057.645] FindNextFileW (in: hFindFile=0xbecd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0057.645] FindClose (in: hFindFile=0xbecd8 | out: hFindFile=0xbecd8) returned 1 [0057.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0057.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0057.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\alt-rt.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar", lpFilePart=0x0) returned 0x29 [0057.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0057.647] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\alt-rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.648] GetFileType (hFile=0x274) returned 0x1 [0057.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0057.648] GetFileType (hFile=0x274) returned 0x1 [0057.648] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2a2dd [0057.649] ReadFile (in: hFile=0x274, lpBuffer=0x2ac6550, nNumberOfBytesToRead=0x2a2dd, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2ac6550*, lpNumberOfBytesRead=0x2ae560*=0x2a2dd, lpOverlapped=0x0) returned 1 [0057.671] CloseHandle (hObject=0x274) returned 1 [0057.694] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\alt-rt.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar", lpFilePart=0x0) returned 0x29 [0057.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0057.694] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\alt-rt.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.696] GetFileType (hFile=0x274) returned 0x1 [0057.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0057.696] GetFileType (hFile=0x274) returned 0x1 [0057.696] WriteFile (in: hFile=0x274, lpBuffer=0x2b993f0*, nNumberOfBytesToWrite=0x2a2e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2b993f0*, lpNumberOfBytesWritten=0x2ae554*=0x2a2e0, lpOverlapped=0x0) returned 1 [0057.700] CloseHandle (hObject=0x274) returned 1 [0057.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\alt-rt.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar", lpFilePart=0x0) returned 0x29 [0057.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\alt-rt.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar.anonymous", lpFilePart=0x0) returned 0x33 [0057.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0057.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\alt-rt.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x677d1c40, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x677d1c40, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc154fcf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2a2e0)) returned 1 [0057.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0057.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\alt-rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\alt-rt.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\alt-rt.jar.anonymous")) returned 1 [0057.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\charsets.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar", lpFilePart=0x0) returned 0x2b [0057.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0057.701] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0057.702] GetFileType (hFile=0x274) returned 0x1 [0057.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0057.702] GetFileType (hFile=0x274) returned 0x1 [0057.702] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x364427 [0057.715] ReadFile (in: hFile=0x274, lpBuffer=0x2bc36f0, nNumberOfBytesToRead=0x364427, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2bc36f0*, lpNumberOfBytesRead=0x2ae560*=0x364427, lpOverlapped=0x0) returned 1 [0057.968] CloseHandle (hObject=0x274) returned 1 [0058.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\charsets.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar", lpFilePart=0x0) returned 0x2b [0058.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0058.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\charsets.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0058.272] GetFileType (hFile=0x274) returned 0x1 [0058.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0058.272] GetFileType (hFile=0x274) returned 0x1 [0058.272] WriteFile (in: hFile=0x274, lpBuffer=0x6319878*, nNumberOfBytesToWrite=0x364430, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x6319878*, lpNumberOfBytesWritten=0x2ae554*=0x364430, lpOverlapped=0x0) returned 1 [0058.352] CloseHandle (hObject=0x274) returned 1 [0058.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\charsets.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar", lpFilePart=0x0) returned 0x2b [0058.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\charsets.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar.anonymous", lpFilePart=0x0) returned 0x35 [0058.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0058.352] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\charsets.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6970fd00, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6970fd00, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc1b8f6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x364430)) returned 1 [0058.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0058.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\charsets.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\charsets.jar.anonymous")) returned 1 [0058.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar", lpFilePart=0x0) returned 0x29 [0058.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0058.353] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0058.354] GetFileType (hFile=0x274) returned 0x1 [0058.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0058.354] GetFileType (hFile=0x274) returned 0x1 [0058.354] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x449777 [0058.369] ReadFile (in: hFile=0x274, lpBuffer=0x667dcc8, nNumberOfBytesToRead=0x449777, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x667dcc8*, lpNumberOfBytesRead=0x2ae560*=0x449777, lpOverlapped=0x0) returned 1 [0058.555] CloseHandle (hObject=0x274) returned 1 [0059.044] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar", lpFilePart=0x0) returned 0x29 [0059.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0059.044] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x274 [0059.045] GetFileType (hFile=0x274) returned 0x1 [0059.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0059.045] GetFileType (hFile=0x274) returned 0x1 [0059.045] WriteFile (in: hFile=0x274, lpBuffer=0x32ac6a0*, nNumberOfBytesToWrite=0x449780, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x32ac6a0*, lpNumberOfBytesWritten=0x2ae554*=0x449780, lpOverlapped=0x0) returned 1 [0059.148] CloseHandle (hObject=0x274) returned 1 [0059.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar", lpFilePart=0x0) returned 0x29 [0059.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar.anonymous", lpFilePart=0x0) returned 0x33 [0059.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0059.148] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x697a8280, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x697a8280, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc2325cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x449780)) returned 1 [0059.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0059.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy.jar.anonymous")) returned 1 [0059.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\javaws.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar", lpFilePart=0x0) returned 0x29 [0059.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0059.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.151] GetFileType (hFile=0x154) returned 0x1 [0059.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0059.151] GetFileType (hFile=0x154) returned 0x1 [0059.151] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd9d17 [0059.155] ReadFile (in: hFile=0x154, lpBuffer=0x64e3f38, nNumberOfBytesToRead=0xd9d17, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x64e3f38*, lpNumberOfBytesRead=0x2ae560*=0xd9d17, lpOverlapped=0x0) returned 1 [0059.172] CloseHandle (hObject=0x154) returned 1 [0059.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\javaws.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar", lpFilePart=0x0) returned 0x29 [0059.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0059.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\javaws.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.514] GetFileType (hFile=0x154) returned 0x1 [0059.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0059.514] GetFileType (hFile=0x154) returned 0x1 [0059.514] WriteFile (in: hFile=0x154, lpBuffer=0x5fb84b8*, nNumberOfBytesToWrite=0xd9d20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x5fb84b8*, lpNumberOfBytesWritten=0x2ae554*=0xd9d20, lpOverlapped=0x0) returned 1 [0059.531] CloseHandle (hObject=0x154) returned 1 [0059.531] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\javaws.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar", lpFilePart=0x0) returned 0x29 [0059.531] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\javaws.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar.anonymous", lpFilePart=0x0) returned 0x33 [0059.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0059.531] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\javaws.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6988cac0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6988cac0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc26b7dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd9d20)) returned 1 [0059.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0059.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\javaws.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\javaws.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\javaws.jar.anonymous")) returned 1 [0059.532] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jce.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jce.jar", lpFilePart=0x0) returned 0x26 [0059.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0059.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.532] GetFileType (hFile=0x154) returned 0x1 [0059.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0059.532] GetFileType (hFile=0x154) returned 0x1 [0059.532] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1aa8c [0059.533] ReadFile (in: hFile=0x154, lpBuffer=0x298d368, nNumberOfBytesToRead=0x1aa8c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x298d368*, lpNumberOfBytesRead=0x2ae560*=0x1aa8c, lpOverlapped=0x0) returned 1 [0059.547] CloseHandle (hObject=0x154) returned 1 [0059.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jce.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jce.jar", lpFilePart=0x0) returned 0x26 [0059.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0059.604] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jce.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.606] GetFileType (hFile=0x154) returned 0x1 [0059.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0059.606] GetFileType (hFile=0x154) returned 0x1 [0059.606] WriteFile (in: hFile=0x154, lpBuffer=0x29dd350*, nNumberOfBytesToWrite=0x1aa90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x29dd350*, lpNumberOfBytesWritten=0x2ae554*=0x1aa90, lpOverlapped=0x0) returned 1 [0059.609] CloseHandle (hObject=0x154) returned 1 [0059.609] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jce.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jce.jar", lpFilePart=0x0) returned 0x26 [0059.609] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jce.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jce.jar.anonymous", lpFilePart=0x0) returned 0x30 [0059.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0059.609] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jce.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6799acc0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6799acc0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc27764b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1aa90)) returned 1 [0059.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0059.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jce.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\jce.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\jce.jar.anonymous")) returned 1 [0059.610] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfr.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar", lpFilePart=0x0) returned 0x26 [0059.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0059.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.611] GetFileType (hFile=0x154) returned 0x1 [0059.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0059.611] GetFileType (hFile=0x154) returned 0x1 [0059.611] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8204f [0059.613] ReadFile (in: hFile=0x154, lpBuffer=0x5c86538, nNumberOfBytesToRead=0x8204f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x5c86538*, lpNumberOfBytesRead=0x2ae560*=0x8204f, lpOverlapped=0x0) returned 1 [0059.645] CloseHandle (hObject=0x154) returned 1 [0059.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfr.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar", lpFilePart=0x0) returned 0x26 [0059.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0059.744] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfr.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.753] GetFileType (hFile=0x154) returned 0x1 [0059.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0059.753] GetFileType (hFile=0x154) returned 0x1 [0059.753] WriteFile (in: hFile=0x154, lpBuffer=0x5d085a8*, nNumberOfBytesToWrite=0x82050, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x5d085a8*, lpNumberOfBytesWritten=0x2ae554*=0x82050, lpOverlapped=0x0) returned 1 [0059.767] CloseHandle (hObject=0x154) returned 1 [0059.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfr.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar", lpFilePart=0x0) returned 0x26 [0059.768] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfr.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar.anonymous", lpFilePart=0x0) returned 0x30 [0059.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0059.768] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfr.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679c0e20, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x679c0e20, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc28f3270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x82050)) returned 1 [0059.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0059.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfr.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\jfr.jar.anonymous")) returned 1 [0059.769] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfxrt.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar", lpFilePart=0x0) returned 0x28 [0059.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0059.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0059.770] GetFileType (hFile=0x154) returned 0x1 [0059.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0059.770] GetFileType (hFile=0x154) returned 0x1 [0059.770] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xce642c [0059.817] ReadFile (in: hFile=0x154, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0xce642c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae560*=0xce642c, lpOverlapped=0x0) returned 1 [0060.409] CloseHandle (hObject=0x154) returned 1 [0061.511] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfxrt.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar", lpFilePart=0x0) returned 0x28 [0061.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0061.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfxrt.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0061.512] GetFileType (hFile=0x154) returned 0x1 [0061.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0061.513] GetFileType (hFile=0x154) returned 0x1 [0061.513] WriteFile (in: hFile=0x154, lpBuffer=0xb0d1018*, nNumberOfBytesToWrite=0xce6430, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0xb0d1018*, lpNumberOfBytesWritten=0x2ae554*=0xce6430, lpOverlapped=0x0) returned 1 [0061.836] CloseHandle (hObject=0x154) returned 1 [0061.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfxrt.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar", lpFilePart=0x0) returned 0x28 [0061.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfxrt.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar.anonymous", lpFilePart=0x0) returned 0x32 [0061.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0061.836] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfxrt.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69997460, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69997460, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc3cbc950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xce6430)) returned 1 [0061.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0061.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\jfxrt.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\jfxrt.jar.anonymous")) returned 1 [0061.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jsse.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar", lpFilePart=0x0) returned 0x27 [0061.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0061.837] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0061.838] GetFileType (hFile=0x154) returned 0x1 [0061.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0061.838] GetFileType (hFile=0x154) returned 0x1 [0061.838] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x809cb [0061.839] ReadFile (in: hFile=0x154, lpBuffer=0x36ffbe8, nNumberOfBytesToRead=0x809cb, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x36ffbe8*, lpNumberOfBytesRead=0x2ae560*=0x809cb, lpOverlapped=0x0) returned 1 [0061.862] CloseHandle (hObject=0x154) returned 1 [0061.945] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jsse.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar", lpFilePart=0x0) returned 0x27 [0061.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0061.946] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jsse.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0061.952] GetFileType (hFile=0x154) returned 0x1 [0061.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0061.952] GetFileType (hFile=0x154) returned 0x1 [0061.952] WriteFile (in: hFile=0x154, lpBuffer=0x3881990*, nNumberOfBytesToWrite=0x809d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x3881990*, lpNumberOfBytesWritten=0x2ae554*=0x809d0, lpOverlapped=0x0) returned 1 [0061.962] CloseHandle (hObject=0x154) returned 1 [0061.962] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jsse.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar", lpFilePart=0x0) returned 0x27 [0061.962] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jsse.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar.anonymous", lpFilePart=0x0) returned 0x31 [0061.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0061.962] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jsse.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69925040, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69925040, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc3ded450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x809d0)) returned 1 [0061.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0061.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\jsse.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\jsse.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\jsse.jar.anonymous")) returned 1 [0061.963] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt", lpFilePart=0x0) returned 0x2c [0061.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0061.963] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre7\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0061.964] GetFileType (hFile=0x154) returned 0x1 [0061.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0061.964] GetFileType (hFile=0x154) returned 0x1 [0061.964] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1082 [0061.964] ReadFile (in: hFile=0x154, lpBuffer=0x197e210, nNumberOfBytesToRead=0x1082, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x197e210*, lpNumberOfBytesRead=0x2ae560*=0x1082, lpOverlapped=0x0) returned 1 [0061.971] CloseHandle (hObject=0x154) returned 1 [0061.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt", lpFilePart=0x0) returned 0x2c [0061.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0061.982] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre7\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0061.984] GetFileType (hFile=0x154) returned 0x1 [0061.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0061.984] GetFileType (hFile=0x154) returned 0x1 [0061.984] WriteFile (in: hFile=0x154, lpBuffer=0x19d02cc*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19d02cc*, lpNumberOfBytesWritten=0x2ae554*=0x1090, lpOverlapped=0x0) returned 1 [0061.985] CloseHandle (hObject=0x154) returned 1 [0061.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt", lpFilePart=0x0) returned 0x2c [0061.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt.anonymous", lpFilePart=0x0) returned 0x36 [0061.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0061.985] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre7\\lib\\jvm.hprof.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f8e3c0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67f8e3c0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc3e39710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1090)) returned 1 [0061.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0061.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre7\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\jvm.hprof.txt.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\jvm.hprof.txt.anonymous")) returned 1 [0061.986] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\management-agent.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar", lpFilePart=0x0) returned 0x33 [0061.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0061.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0061.987] GetFileType (hFile=0x154) returned 0x1 [0061.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0061.987] GetFileType (hFile=0x154) returned 0x1 [0061.987] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x181 [0061.987] ReadFile (in: hFile=0x154, lpBuffer=0x19d1884, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19d1884*, lpNumberOfBytesRead=0x2ae560*=0x181, lpOverlapped=0x0) returned 1 [0061.988] CloseHandle (hObject=0x154) returned 1 [0062.000] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\management-agent.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar", lpFilePart=0x0) returned 0x33 [0062.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0062.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\management-agent.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0062.001] GetFileType (hFile=0x154) returned 0x1 [0062.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0062.001] GetFileType (hFile=0x154) returned 0x1 [0062.001] WriteFile (in: hFile=0x154, lpBuffer=0x1a1ff60*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a1ff60*, lpNumberOfBytesWritten=0x2ae528*=0x190, lpOverlapped=0x0) returned 1 [0062.002] CloseHandle (hObject=0x154) returned 1 [0062.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\management-agent.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar", lpFilePart=0x0) returned 0x33 [0062.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\management-agent.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar.anonymous", lpFilePart=0x0) returned 0x3d [0062.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0062.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\management-agent.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68026940, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x68026940, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc3e5f870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x190)) returned 1 [0062.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0062.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\management-agent.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\management-agent.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\management-agent.jar.anonymous")) returned 1 [0062.003] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\plugin.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar", lpFilePart=0x0) returned 0x29 [0062.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0062.003] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0062.003] GetFileType (hFile=0x154) returned 0x1 [0062.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0062.003] GetFileType (hFile=0x154) returned 0x1 [0062.003] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1d5e98 [0062.009] ReadFile (in: hFile=0x154, lpBuffer=0x7bc87f8, nNumberOfBytesToRead=0x1d5e98, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x7bc87f8*, lpNumberOfBytesRead=0x2ae560*=0x1d5e98, lpOverlapped=0x0) returned 1 [0062.336] CloseHandle (hObject=0x154) returned 1 [0062.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\plugin.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar", lpFilePart=0x0) returned 0x29 [0062.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0062.497] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\plugin.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0062.510] GetFileType (hFile=0x154) returned 0x1 [0062.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0062.510] GetFileType (hFile=0x154) returned 0x1 [0062.510] WriteFile (in: hFile=0x154, lpBuffer=0xbdb7468*, nNumberOfBytesToWrite=0x1d5ea0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0xbdb7468*, lpNumberOfBytesWritten=0x2ae554*=0x1d5ea0, lpOverlapped=0x0) returned 1 [0062.547] CloseHandle (hObject=0x154) returned 1 [0062.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\plugin.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar", lpFilePart=0x0) returned 0x29 [0062.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\plugin.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar.anonymous", lpFilePart=0x0) returned 0x33 [0062.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0062.547] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\plugin.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698d8d80, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x698d8d80, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc4394890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d5ea0)) returned 1 [0062.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0062.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\plugin.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\plugin.jar.anonymous")) returned 1 [0062.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\resources.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\resources.jar", lpFilePart=0x0) returned 0x2c [0062.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0062.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0062.548] GetFileType (hFile=0x154) returned 0x1 [0062.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0062.548] GetFileType (hFile=0x154) returned 0x1 [0062.548] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2562c0 [0062.556] ReadFile (in: hFile=0x154, lpBuffer=0xc6b1018, nNumberOfBytesToRead=0x2562c0, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0xc6b1018*, lpNumberOfBytesRead=0x2ae560*=0x2562c0, lpOverlapped=0x0) returned 1 [0062.677] CloseHandle (hObject=0x154) returned 1 [0062.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\resources.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\resources.jar", lpFilePart=0x0) returned 0x2c [0062.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0062.837] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\resources.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0062.841] GetFileType (hFile=0x154) returned 0x1 [0062.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0062.841] GetFileType (hFile=0x154) returned 0x1 [0062.841] WriteFile (in: hFile=0x154, lpBuffer=0xd25fe58*, nNumberOfBytesToWrite=0x2562d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0xd25fe58*, lpNumberOfBytesWritten=0x2ae554*=0x2562d0, lpOverlapped=0x0) returned 1 [0062.943] CloseHandle (hObject=0x154) returned 1 [0062.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\resources.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\resources.jar", lpFilePart=0x0) returned 0x2c [0062.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\resources.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\resources.jar.anonymous", lpFilePart=0x0) returned 0x36 [0062.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0062.944] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\resources.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68072c00, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x68072c00, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xc474caf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2562d0)) returned 1 [0062.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0062.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\resources.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\resources.jar.anonymous")) returned 1 [0062.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\rt.jar", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\rt.jar", lpFilePart=0x0) returned 0x25 [0062.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0062.945] GetFileType (hFile=0x154) returned 0x1 [0062.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0062.945] GetFileType (hFile=0x154) returned 0x1 [0062.945] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3124c2e [0063.187] ReadFile (in: hFile=0x154, lpBuffer=0xd6b1018, nNumberOfBytesToRead=0x3124c2e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0xd6b1018*, lpNumberOfBytesRead=0x2ae560*=0x3124c2e, lpOverlapped=0x0) returned 1 [0066.391] CloseHandle (hObject=0x154) returned 1 [0071.409] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\rt.jar", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\rt.jar", lpFilePart=0x0) returned 0x25 [0071.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0071.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\rt.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0071.412] GetFileType (hFile=0x154) returned 0x1 [0071.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0071.412] GetFileType (hFile=0x154) returned 0x1 [0071.412] WriteFile (in: hFile=0x154, lpBuffer=0x1c6b1018*, nNumberOfBytesToWrite=0x3124c30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1c6b1018*, lpNumberOfBytesWritten=0x2ae554*=0x3124c30, lpOverlapped=0x0) returned 1 [0073.353] CloseHandle (hObject=0x154) returned 1 [0073.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\rt.jar", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\rt.jar", lpFilePart=0x0) returned 0x25 [0073.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\rt.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\rt.jar.anonymous", lpFilePart=0x0) returned 0x2f [0073.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0073.354] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\rt.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683928e0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x683928e0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcaa88010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3124c30)) returned 1 [0073.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\rt.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\rt.jar.anonymous")) returned 1 [0073.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\applet", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\applet", lpFilePart=0x0) returned 0x25 [0073.354] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\applet\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\applet\\", lpFilePart=0x0) returned 0x26 [0073.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0073.355] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.355] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.355] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0073.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.355] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\applet", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\applet", lpFilePart=0x0) returned 0x25 [0073.355] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\applet\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\applet\\", lpFilePart=0x0) returned 0x26 [0073.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0073.355] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.355] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.356] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0073.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.356] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\cmm", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\cmm", lpFilePart=0x0) returned 0x22 [0073.356] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\cmm\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\cmm\\", lpFilePart=0x0) returned 0x23 [0073.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0073.356] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.356] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.356] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.356] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.357] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.357] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.357] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.357] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0073.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\cmm", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\cmm", lpFilePart=0x0) returned 0x22 [0073.358] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\cmm\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\cmm\\", lpFilePart=0x0) returned 0x23 [0073.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0073.358] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.358] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.358] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.358] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.359] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.359] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.359] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.359] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0073.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy", lpFilePart=0x0) returned 0x25 [0073.359] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\", lpFilePart=0x0) returned 0x26 [0073.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0073.374] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.375] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.376] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.377] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.377] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0073.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.378] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy", lpFilePart=0x0) returned 0x25 [0073.378] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\", lpFilePart=0x0) returned 0x26 [0073.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0073.379] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.379] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.379] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.379] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.379] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.380] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.381] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.381] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.381] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.381] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.381] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.381] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0073.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.382] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip", lpFilePart=0x0) returned 0x31 [0073.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.384] GetFileType (hFile=0x154) returned 0x1 [0073.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.384] GetFileType (hFile=0x154) returned 0x1 [0073.384] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x48cc [0073.384] ReadFile (in: hFile=0x154, lpBuffer=0x1935974, nNumberOfBytesToRead=0x48cc, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1935974*, lpNumberOfBytesRead=0x2ae4ec*=0x48cc, lpOverlapped=0x0) returned 1 [0073.391] CloseHandle (hObject=0x154) returned 1 [0073.426] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip", lpFilePart=0x0) returned 0x31 [0073.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.428] GetFileType (hFile=0x154) returned 0x1 [0073.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.428] GetFileType (hFile=0x154) returned 0x1 [0073.428] WriteFile (in: hFile=0x154, lpBuffer=0x199a2b0*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x199a2b0*, lpNumberOfBytesWritten=0x2ae4e0*=0x48d0, lpOverlapped=0x0) returned 1 [0073.429] CloseHandle (hObject=0x154) returned 1 [0073.429] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip", lpFilePart=0x0) returned 0x31 [0073.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip.anonymous", lpFilePart=0x0) returned 0x3b [0073.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.430] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\ffjcext.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67844060, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67844060, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcab466f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x48d0)) returned 1 [0073.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\ffjcext.zip.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\ffjcext.zip.anonymous")) returned 1 [0073.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif", lpFilePart=0x0) returned 0x30 [0073.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.431] GetFileType (hFile=0x154) returned 0x1 [0073.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.431] GetFileType (hFile=0x154) returned 0x1 [0073.431] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3687 [0073.431] ReadFile (in: hFile=0x154, lpBuffer=0x199f0a8, nNumberOfBytesToRead=0x3687, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x199f0a8*, lpNumberOfBytesRead=0x2ae4ec*=0x3687, lpOverlapped=0x0) returned 1 [0073.446] CloseHandle (hObject=0x154) returned 1 [0073.458] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif", lpFilePart=0x0) returned 0x30 [0073.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.460] GetFileType (hFile=0x154) returned 0x1 [0073.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.460] GetFileType (hFile=0x154) returned 0x1 [0073.460] WriteFile (in: hFile=0x154, lpBuffer=0x19fcf64*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19fcf64*, lpNumberOfBytesWritten=0x2ae4e0*=0x3690, lpOverlapped=0x0) returned 1 [0073.461] CloseHandle (hObject=0x154) returned 1 [0073.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif", lpFilePart=0x0) returned 0x30 [0073.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif.anonymous", lpFilePart=0x0) returned 0x3a [0073.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.461] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\splash.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x678dc5e0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x678dc5e0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcab929b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3690)) returned 1 [0073.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\splash.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\deploy\\splash.gif.anonymous")) returned 1 [0073.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0073.462] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\jqs", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs", lpFilePart=0x0) returned 0x29 [0073.462] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs\\", lpFilePart=0x0) returned 0x2a [0073.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0073.463] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0073.463] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0073.463] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0073.463] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0073.463] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0073.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0073.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0073.463] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\deploy\\jqs", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs", lpFilePart=0x0) returned 0x29 [0073.463] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs\\", lpFilePart=0x0) returned 0x2a [0073.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\deploy\\jqs\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0073.463] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0073.464] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0073.464] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0073.464] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0073.464] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0073.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0073.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.464] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext", lpFilePart=0x0) returned 0x22 [0073.464] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\", lpFilePart=0x0) returned 0x23 [0073.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0073.480] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.480] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.481] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.482] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0073.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0073.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext", lpFilePart=0x0) returned 0x22 [0073.483] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\", lpFilePart=0x0) returned 0x23 [0073.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0073.484] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.484] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.484] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.484] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.484] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.485] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.485] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.485] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.485] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.485] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.485] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0073.486] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0073.486] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0073.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0073.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0073.487] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar", lpFilePart=0x0) returned 0x34 [0073.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\access-bridge.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.488] GetFileType (hFile=0x154) returned 0x1 [0073.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.488] GetFileType (hFile=0x154) returned 0x1 [0073.488] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x148e9 [0073.488] ReadFile (in: hFile=0x154, lpBuffer=0x1a04910, nNumberOfBytesToRead=0x148e9, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a04910*, lpNumberOfBytesRead=0x2ae4ec*=0x148e9, lpOverlapped=0x0) returned 1 [0073.497] CloseHandle (hObject=0x154) returned 1 [0073.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar", lpFilePart=0x0) returned 0x34 [0073.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.512] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\access-bridge.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.514] GetFileType (hFile=0x154) returned 0x1 [0073.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.514] GetFileType (hFile=0x154) returned 0x1 [0073.514] WriteFile (in: hFile=0x154, lpBuffer=0x1a8f1e0*, nNumberOfBytesToWrite=0x148f0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a8f1e0*, lpNumberOfBytesWritten=0x2ae4e0*=0x148f0, lpOverlapped=0x0) returned 1 [0073.517] CloseHandle (hObject=0x154) returned 1 [0073.517] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar", lpFilePart=0x0) returned 0x34 [0073.517] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar.anonymous", lpFilePart=0x0) returned 0x3e [0073.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.517] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\access-bridge.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x678dc5e0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x678dc5e0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcac2af30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x148f0)) returned 1 [0073.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\access-bridge.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\access-bridge.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\access-bridge.jar.anonymous")) returned 1 [0073.518] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar", lpFilePart=0x0) returned 0x2c [0073.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.518] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.518] GetFileType (hFile=0x154) returned 0x1 [0073.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.518] GetFileType (hFile=0x154) returned 0x1 [0073.518] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x22e6 [0073.518] ReadFile (in: hFile=0x154, lpBuffer=0x1aa3e68, nNumberOfBytesToRead=0x22e6, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aa3e68*, lpNumberOfBytesRead=0x2ae4ec*=0x22e6, lpOverlapped=0x0) returned 1 [0073.559] CloseHandle (hObject=0x154) returned 1 [0073.571] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar", lpFilePart=0x0) returned 0x2c [0073.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.573] GetFileType (hFile=0x154) returned 0x1 [0073.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.573] GetFileType (hFile=0x154) returned 0x1 [0073.573] WriteFile (in: hFile=0x154, lpBuffer=0x1afbb04*, nNumberOfBytesToWrite=0x22f0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1afbb04*, lpNumberOfBytesWritten=0x2ae4e0*=0x22f0, lpOverlapped=0x0) returned 1 [0073.574] CloseHandle (hObject=0x154) returned 1 [0073.574] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar", lpFilePart=0x0) returned 0x2c [0073.574] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar.anonymous", lpFilePart=0x0) returned 0x36 [0073.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.574] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\dnsns.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679288a0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x679288a0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcac9d350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x22f0)) returned 1 [0073.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\dnsns.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\dnsns.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\dnsns.jar.anonymous")) returned 1 [0073.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar", lpFilePart=0x0) returned 0x2e [0073.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.575] GetFileType (hFile=0x154) returned 0x1 [0073.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.575] GetFileType (hFile=0x154) returned 0x1 [0073.575] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xaa4a [0073.575] ReadFile (in: hFile=0x154, lpBuffer=0x1afe144, nNumberOfBytesToRead=0xaa4a, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1afe144*, lpNumberOfBytesRead=0x2ae4ec*=0xaa4a, lpOverlapped=0x0) returned 1 [0073.619] CloseHandle (hObject=0x154) returned 1 [0073.689] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar", lpFilePart=0x0) returned 0x2e [0073.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.689] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.691] GetFileType (hFile=0x154) returned 0x1 [0073.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.691] GetFileType (hFile=0x154) returned 0x1 [0073.691] WriteFile (in: hFile=0x154, lpBuffer=0x1988e34*, nNumberOfBytesToWrite=0xaa50, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1988e34*, lpNumberOfBytesWritten=0x2ae4e0*=0xaa50, lpOverlapped=0x0) returned 1 [0073.694] CloseHandle (hObject=0x154) returned 1 [0073.694] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar", lpFilePart=0x0) returned 0x2e [0073.694] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar.anonymous", lpFilePart=0x0) returned 0x38 [0073.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\jaccess.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679288a0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x679288a0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcadcde50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaa50)) returned 1 [0073.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\jaccess.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\jaccess.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\jaccess.jar.anonymous")) returned 1 [0073.695] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar", lpFilePart=0x0) returned 0x31 [0073.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.695] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.695] GetFileType (hFile=0x154) returned 0x1 [0073.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.695] GetFileType (hFile=0x154) returned 0x1 [0073.695] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf790d [0073.700] ReadFile (in: hFile=0x154, lpBuffer=0x2a197a0, nNumberOfBytesToRead=0xf790d, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x2a197a0*, lpNumberOfBytesRead=0x2ae4ec*=0xf790d, lpOverlapped=0x0) returned 1 [0073.769] CloseHandle (hObject=0x154) returned 1 [0073.847] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar", lpFilePart=0x0) returned 0x31 [0073.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.847] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.857] GetFileType (hFile=0x154) returned 0x1 [0073.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.858] GetFileType (hFile=0x154) returned 0x1 [0073.858] WriteFile (in: hFile=0x154, lpBuffer=0x2eef530*, nNumberOfBytesToWrite=0xf7910, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x2eef530*, lpNumberOfBytesWritten=0x2ae4e0*=0xf7910, lpOverlapped=0x0) returned 1 [0073.887] CloseHandle (hObject=0x154) returned 1 [0073.887] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar", lpFilePart=0x0) returned 0x31 [0073.887] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar.anonymous", lpFilePart=0x0) returned 0x3b [0073.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.887] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\localedata.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6994b1a0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6994b1a0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcaf96ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf7910)) returned 1 [0073.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\localedata.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\localedata.jar.anonymous")) returned 1 [0073.888] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar", lpFilePart=0x0) returned 0x2c [0073.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.889] GetFileType (hFile=0x154) returned 0x1 [0073.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.889] GetFileType (hFile=0x154) returned 0x1 [0073.889] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3e45 [0073.889] ReadFile (in: hFile=0x154, lpBuffer=0x19e0eb4, nNumberOfBytesToRead=0x3e45, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19e0eb4*, lpNumberOfBytesRead=0x2ae4ec*=0x3e45, lpOverlapped=0x0) returned 1 [0073.896] CloseHandle (hObject=0x154) returned 1 [0073.908] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar", lpFilePart=0x0) returned 0x2c [0073.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.910] GetFileType (hFile=0x154) returned 0x1 [0073.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.910] GetFileType (hFile=0x154) returned 0x1 [0073.910] WriteFile (in: hFile=0x154, lpBuffer=0x1a41430*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a41430*, lpNumberOfBytesWritten=0x2ae4e0*=0x3e50, lpOverlapped=0x0) returned 1 [0073.911] CloseHandle (hObject=0x154) returned 1 [0073.911] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar", lpFilePart=0x0) returned 0x2c [0073.911] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar.anonymous", lpFilePart=0x0) returned 0x36 [0073.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.911] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunec.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679288a0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x679288a0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcafe3190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e50)) returned 1 [0073.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunec.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunec.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunec.jar.anonymous")) returned 1 [0073.914] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", lpFilePart=0x0) returned 0x36 [0073.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.915] GetFileType (hFile=0x154) returned 0x1 [0073.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.915] GetFileType (hFile=0x154) returned 0x1 [0073.915] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3057d [0073.916] ReadFile (in: hFile=0x154, lpBuffer=0x29cb9e8, nNumberOfBytesToRead=0x3057d, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x29cb9e8*, lpNumberOfBytesRead=0x2ae4ec*=0x3057d, lpOverlapped=0x0) returned 1 [0073.919] CloseHandle (hObject=0x154) returned 1 [0073.945] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", lpFilePart=0x0) returned 0x36 [0073.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.945] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.947] GetFileType (hFile=0x154) returned 0x1 [0073.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.947] GetFileType (hFile=0x154) returned 0x1 [0073.947] WriteFile (in: hFile=0x154, lpBuffer=0x30a8480*, nNumberOfBytesToWrite=0x30580, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x30a8480*, lpNumberOfBytesWritten=0x2ae4e0*=0x30580, lpOverlapped=0x0) returned 1 [0073.952] CloseHandle (hObject=0x154) returned 1 [0073.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar", lpFilePart=0x0) returned 0x36 [0073.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar.anonymous", lpFilePart=0x0) returned 0x40 [0073.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.952] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679288a0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x679288a0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb0555b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30580)) returned 1 [0073.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunjce_provider.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunjce_provider.jar.anonymous")) returned 1 [0073.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar", lpFilePart=0x0) returned 0x30 [0073.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.953] GetFileType (hFile=0x154) returned 0x1 [0073.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.953] GetFileType (hFile=0x154) returned 0x1 [0073.953] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x77e7 [0073.953] ReadFile (in: hFile=0x154, lpBuffer=0x1a9279c, nNumberOfBytesToRead=0x77e7, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a9279c*, lpNumberOfBytesRead=0x2ae4ec*=0x77e7, lpOverlapped=0x0) returned 1 [0073.962] CloseHandle (hObject=0x154) returned 1 [0073.976] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar", lpFilePart=0x0) returned 0x30 [0073.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0073.976] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.977] GetFileType (hFile=0x154) returned 0x1 [0073.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0073.977] GetFileType (hFile=0x154) returned 0x1 [0073.977] WriteFile (in: hFile=0x154, lpBuffer=0x1b04d38*, nNumberOfBytesToWrite=0x77f0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b04d38*, lpNumberOfBytesWritten=0x2ae4e0*=0x77f0, lpOverlapped=0x0) returned 1 [0073.979] CloseHandle (hObject=0x154) returned 1 [0073.979] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar", lpFilePart=0x0) returned 0x30 [0073.979] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar.anonymous", lpFilePart=0x0) returned 0x3a [0073.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0073.979] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunmscapi.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679288a0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x679288a0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb07b710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x77f0)) returned 1 [0073.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0073.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunmscapi.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunmscapi.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunmscapi.jar.anonymous")) returned 1 [0073.980] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", lpFilePart=0x0) returned 0x30 [0073.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0073.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0073.980] GetFileType (hFile=0x154) returned 0x1 [0073.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0073.980] GetFileType (hFile=0x154) returned 0x1 [0073.980] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x39fd6 [0073.981] ReadFile (in: hFile=0x154, lpBuffer=0x30d8a20, nNumberOfBytesToRead=0x39fd6, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x30d8a20*, lpNumberOfBytesRead=0x2ae4ec*=0x39fd6, lpOverlapped=0x0) returned 1 [0074.005] CloseHandle (hObject=0x154) returned 1 [0074.066] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", lpFilePart=0x0) returned 0x30 [0074.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0074.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.069] GetFileType (hFile=0x154) returned 0x1 [0074.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0074.069] GetFileType (hFile=0x154) returned 0x1 [0074.069] WriteFile (in: hFile=0x154, lpBuffer=0x31fa9b8*, nNumberOfBytesToWrite=0x39fe0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x31fa9b8*, lpNumberOfBytesWritten=0x2ae4e0*=0x39fe0, lpOverlapped=0x0) returned 1 [0074.073] CloseHandle (hObject=0x154) returned 1 [0074.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar", lpFilePart=0x0) returned 0x30 [0074.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar.anonymous", lpFilePart=0x0) returned 0x3a [0074.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0074.073] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6794ea00, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6794ea00, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb15ff50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x39fe0)) returned 1 [0074.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\sunpkcs11.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\sunpkcs11.jar.anonymous")) returned 1 [0074.074] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar", lpFilePart=0x0) returned 0x2c [0074.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0074.074] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.074] GetFileType (hFile=0x154) returned 0x1 [0074.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0074.075] GetFileType (hFile=0x154) returned 0x1 [0074.075] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x10c9a [0074.075] ReadFile (in: hFile=0x154, lpBuffer=0x19599fc, nNumberOfBytesToRead=0x10c9a, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19599fc*, lpNumberOfBytesRead=0x2ae4ec*=0x10c9a, lpOverlapped=0x0) returned 1 [0074.102] CloseHandle (hObject=0x154) returned 1 [0074.125] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar", lpFilePart=0x0) returned 0x2c [0074.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0074.125] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.127] GetFileType (hFile=0x154) returned 0x1 [0074.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0074.127] GetFileType (hFile=0x154) returned 0x1 [0074.127] WriteFile (in: hFile=0x154, lpBuffer=0x19d8f38*, nNumberOfBytesToWrite=0x10ca0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19d8f38*, lpNumberOfBytesWritten=0x2ae4e0*=0x10ca0, lpOverlapped=0x0) returned 1 [0074.130] CloseHandle (hObject=0x154) returned 1 [0074.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar", lpFilePart=0x0) returned 0x2c [0074.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar.anonymous", lpFilePart=0x0) returned 0x36 [0074.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0074.131] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\zipfs.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6794ea00, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6794ea00, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb1f84d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10ca0)) returned 1 [0074.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\zipfs.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\ext\\zipfs.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\ext\\zipfs.jar.anonymous")) returned 1 [0074.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\fonts", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\fonts", lpFilePart=0x0) returned 0x24 [0074.132] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\fonts\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\fonts\\", lpFilePart=0x0) returned 0x25 [0074.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\fonts\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.141] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.142] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.142] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.142] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.142] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.143] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\fonts", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\fonts", lpFilePart=0x0) returned 0x24 [0074.143] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\fonts\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\fonts\\", lpFilePart=0x0) returned 0x25 [0074.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\fonts\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.144] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.144] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.144] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.145] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.145] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.146] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\i386", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\i386", lpFilePart=0x0) returned 0x23 [0074.147] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\i386\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\i386\\", lpFilePart=0x0) returned 0x24 [0074.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\i386\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.147] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.148] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.148] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.148] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\i386", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\i386", lpFilePart=0x0) returned 0x23 [0074.148] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\i386\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\i386\\", lpFilePart=0x0) returned 0x24 [0074.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\i386\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.148] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.148] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.148] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.149] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images", lpFilePart=0x0) returned 0x25 [0074.149] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\", lpFilePart=0x0) returned 0x26 [0074.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.150] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.150] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.150] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.150] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.150] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images", lpFilePart=0x0) returned 0x25 [0074.150] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\", lpFilePart=0x0) returned 0x26 [0074.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.150] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.150] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.151] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.151] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors", lpFilePart=0x0) returned 0x2d [0074.151] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\", lpFilePart=0x0) returned 0x2e [0074.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.153] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.153] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.153] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.153] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.153] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.154] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.154] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.154] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.154] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.154] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0074.154] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.156] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors", lpFilePart=0x0) returned 0x2d [0074.156] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\", lpFilePart=0x0) returned 0x2e [0074.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.157] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.157] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.157] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.157] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.157] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.158] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.158] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.158] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.158] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.158] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0074.158] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.159] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", lpFilePart=0x0) returned 0x3e [0074.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.159] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.160] GetFileType (hFile=0x154) returned 0x1 [0074.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.160] GetFileType (hFile=0x154) returned 0x1 [0074.161] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x99 [0074.161] ReadFile (in: hFile=0x154, lpBuffer=0x19f1a7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19f1a7c*, lpNumberOfBytesRead=0x2ae478*=0x99, lpOverlapped=0x0) returned 1 [0074.162] CloseHandle (hObject=0x154) returned 1 [0074.173] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", lpFilePart=0x0) returned 0x3e [0074.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.175] GetFileType (hFile=0x154) returned 0x1 [0074.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.175] GetFileType (hFile=0x154) returned 0x1 [0074.175] WriteFile (in: hFile=0x154, lpBuffer=0x1a3fbf4*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a3fbf4*, lpNumberOfBytesWritten=0x2ae440*=0xa0, lpOverlapped=0x0) returned 1 [0074.176] CloseHandle (hObject=0x154) returned 1 [0074.176] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif", lpFilePart=0x0) returned 0x3e [0074.176] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.anonymous", lpFilePart=0x0) returned 0x48 [0074.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.176] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67974b60, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67974b60, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb26a8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1 [0074.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.anonymous")) returned 1 [0074.177] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.177] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.178] GetFileType (hFile=0x154) returned 0x1 [0074.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.178] GetFileType (hFile=0x154) returned 0x1 [0074.178] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa5 [0074.178] ReadFile (in: hFile=0x154, lpBuffer=0x1a40fc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a40fc4*, lpNumberOfBytesRead=0x2ae478*=0xa5, lpOverlapped=0x0) returned 1 [0074.179] CloseHandle (hObject=0x154) returned 1 [0074.191] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.191] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.192] GetFileType (hFile=0x154) returned 0x1 [0074.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.192] GetFileType (hFile=0x154) returned 0x1 [0074.192] WriteFile (in: hFile=0x154, lpBuffer=0x1a8f178*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a8f178*, lpNumberOfBytesWritten=0x2ae440*=0xb0, lpOverlapped=0x0) returned 1 [0074.193] CloseHandle (hObject=0x154) returned 1 [0074.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.anonymous", lpFilePart=0x0) returned 0x4f [0074.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.193] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67974b60, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67974b60, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb290a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0074.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif.anonymous")) returned 1 [0074.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.194] GetFileType (hFile=0x154) returned 0x1 [0074.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.194] GetFileType (hFile=0x154) returned 0x1 [0074.194] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x99 [0074.194] ReadFile (in: hFile=0x154, lpBuffer=0x1a90568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a90568*, lpNumberOfBytesRead=0x2ae478*=0x99, lpOverlapped=0x0) returned 1 [0074.196] CloseHandle (hObject=0x154) returned 1 [0074.209] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.209] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.210] GetFileType (hFile=0x154) returned 0x1 [0074.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.210] GetFileType (hFile=0x154) returned 0x1 [0074.210] WriteFile (in: hFile=0x154, lpBuffer=0x1ade700*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ade700*, lpNumberOfBytesWritten=0x2ae440*=0xa0, lpOverlapped=0x0) returned 1 [0074.211] CloseHandle (hObject=0x154) returned 1 [0074.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.anonymous", lpFilePart=0x0) returned 0x51 [0074.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.211] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67974b60, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67974b60, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb2b6bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1 [0074.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif.anonymous")) returned 1 [0074.212] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.212] GetFileType (hFile=0x154) returned 0x1 [0074.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.212] GetFileType (hFile=0x154) returned 0x1 [0074.212] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa8 [0074.212] ReadFile (in: hFile=0x154, lpBuffer=0x1adfb00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1adfb00*, lpNumberOfBytesRead=0x2ae478*=0xa8, lpOverlapped=0x0) returned 1 [0074.214] CloseHandle (hObject=0x154) returned 1 [0074.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.229] GetFileType (hFile=0x154) returned 0x1 [0074.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.229] GetFileType (hFile=0x154) returned 0x1 [0074.229] WriteFile (in: hFile=0x154, lpBuffer=0x1b2dcb0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b2dcb0*, lpNumberOfBytesWritten=0x2ae440*=0xb0, lpOverlapped=0x0) returned 1 [0074.230] CloseHandle (hObject=0x154) returned 1 [0074.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.anonymous", lpFilePart=0x0) returned 0x4f [0074.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.230] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67974b60, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x67974b60, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb2dcd10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0074.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif.anonymous")) returned 1 [0074.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.232] GetFileType (hFile=0x154) returned 0x1 [0074.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.232] GetFileType (hFile=0x154) returned 0x1 [0074.232] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x99 [0074.232] ReadFile (in: hFile=0x154, lpBuffer=0x1b2f0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2f0a0*, lpNumberOfBytesRead=0x2ae478*=0x99, lpOverlapped=0x0) returned 1 [0074.233] CloseHandle (hObject=0x154) returned 1 [0074.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.271] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.272] GetFileType (hFile=0x154) returned 0x1 [0074.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.272] GetFileType (hFile=0x154) returned 0x1 [0074.274] CloseHandle (hObject=0x154) returned 1 [0074.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.anonymous", lpFilePart=0x0) returned 0x51 [0074.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.274] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6799acc0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6799acc0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb34f130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1 [0074.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif.anonymous")) returned 1 [0074.275] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.275] GetFileType (hFile=0x154) returned 0x1 [0074.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.275] GetFileType (hFile=0x154) returned 0x1 [0074.275] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x93 [0074.275] ReadFile (in: hFile=0x154, lpBuffer=0x197e62c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x197e62c*, lpNumberOfBytesRead=0x2ae478*=0x93, lpOverlapped=0x0) returned 1 [0074.277] CloseHandle (hObject=0x154) returned 1 [0074.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.291] GetFileType (hFile=0x154) returned 0x1 [0074.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.291] GetFileType (hFile=0x154) returned 0x1 [0074.291] WriteFile (in: hFile=0x154, lpBuffer=0x19cc920*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19cc920*, lpNumberOfBytesWritten=0x2ae440*=0xa0, lpOverlapped=0x0) returned 1 [0074.293] CloseHandle (hObject=0x154) returned 1 [0074.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif", lpFilePart=0x0) returned 0x45 [0074.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.anonymous", lpFilePart=0x0) returned 0x4f [0074.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6799acc0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6799acc0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb375290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1 [0074.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif.anonymous")) returned 1 [0074.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0074.294] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.294] GetFileType (hFile=0x154) returned 0x1 [0074.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0074.294] GetFileType (hFile=0x154) returned 0x1 [0074.294] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x99 [0074.294] ReadFile (in: hFile=0x154, lpBuffer=0x19cdd10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19cdd10*, lpNumberOfBytesRead=0x2ae478*=0x99, lpOverlapped=0x0) returned 1 [0074.295] CloseHandle (hObject=0x154) returned 1 [0074.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0074.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.311] GetFileType (hFile=0x154) returned 0x1 [0074.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0074.311] GetFileType (hFile=0x154) returned 0x1 [0074.311] WriteFile (in: hFile=0x154, lpBuffer=0x1a1bea8*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a1bea8*, lpNumberOfBytesWritten=0x2ae440*=0xa0, lpOverlapped=0x0) returned 1 [0074.312] CloseHandle (hObject=0x154) returned 1 [0074.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif", lpFilePart=0x0) returned 0x47 [0074.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.anonymous", lpFilePart=0x0) returned 0x51 [0074.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0074.312] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6799acc0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x6799acc0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb3c1550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1 [0074.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif.anonymous")) returned 1 [0074.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.313] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfr", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr", lpFilePart=0x0) returned 0x22 [0074.313] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr\\", lpFilePart=0x0) returned 0x23 [0074.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0074.313] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.313] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.313] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.313] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.314] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0074.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.314] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\jfr", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr", lpFilePart=0x0) returned 0x22 [0074.314] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\jfr\\", lpFilePart=0x0) returned 0x23 [0074.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\jfr\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0074.314] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.314] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.314] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.314] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.315] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0074.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.315] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\management", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management", lpFilePart=0x0) returned 0x29 [0074.315] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management\\", lpFilePart=0x0) returned 0x2a [0074.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0074.329] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.330] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.330] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.330] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.330] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.330] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.330] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0074.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.331] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\management", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management", lpFilePart=0x0) returned 0x29 [0074.331] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\management\\", lpFilePart=0x0) returned 0x2a [0074.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\management\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0074.332] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.332] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.333] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.333] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.333] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.333] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.333] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0074.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security", lpFilePart=0x0) returned 0x27 [0074.334] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\", lpFilePart=0x0) returned 0x28 [0074.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0074.342] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.342] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.342] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.342] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.343] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.343] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0074.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security", lpFilePart=0x0) returned 0x27 [0074.344] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\", lpFilePart=0x0) returned 0x28 [0074.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0074.345] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.346] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.347] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.347] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.347] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.347] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0074.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar", lpFilePart=0x0) returned 0x38 [0074.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0074.348] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.350] GetFileType (hFile=0x154) returned 0x1 [0074.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0074.350] GetFileType (hFile=0x154) returned 0x1 [0074.350] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xb9b [0074.350] ReadFile (in: hFile=0x154, lpBuffer=0x1a2393c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a2393c*, lpNumberOfBytesRead=0x2ae4ec*=0xb9b, lpOverlapped=0x0) returned 1 [0074.364] CloseHandle (hObject=0x154) returned 1 [0074.376] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar", lpFilePart=0x0) returned 0x38 [0074.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0074.376] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.378] GetFileType (hFile=0x154) returned 0x1 [0074.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0074.378] GetFileType (hFile=0x154) returned 0x1 [0074.378] WriteFile (in: hFile=0x154, lpBuffer=0x1a75264*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a75264*, lpNumberOfBytesWritten=0x2ae4b4*=0xba0, lpOverlapped=0x0) returned 1 [0074.379] CloseHandle (hObject=0x154) returned 1 [0074.379] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar", lpFilePart=0x0) returned 0x38 [0074.379] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar.anonymous", lpFilePart=0x0) returned 0x42 [0074.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0074.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\local_policy.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68157440, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x68157440, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb459ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xba0)) returned 1 [0074.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\local_policy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\local_policy.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\local_policy.jar.anonymous")) returned 1 [0074.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar", lpFilePart=0x0) returned 0x3c [0074.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0074.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.381] GetFileType (hFile=0x154) returned 0x1 [0074.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0074.381] GetFileType (hFile=0x154) returned 0x1 [0074.381] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x9b7 [0074.382] ReadFile (in: hFile=0x154, lpBuffer=0x1a76f30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a76f30*, lpNumberOfBytesRead=0x2ae4ec*=0x9b7, lpOverlapped=0x0) returned 1 [0074.387] CloseHandle (hObject=0x154) returned 1 [0074.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar", lpFilePart=0x0) returned 0x3c [0074.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0074.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.402] GetFileType (hFile=0x154) returned 0x1 [0074.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0074.402] GetFileType (hFile=0x154) returned 0x1 [0074.402] WriteFile (in: hFile=0x154, lpBuffer=0x1ac7f0c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1ac7f0c*, lpNumberOfBytesWritten=0x2ae4b4*=0x9c0, lpOverlapped=0x0) returned 1 [0074.403] CloseHandle (hObject=0x154) returned 1 [0074.403] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar", lpFilePart=0x0) returned 0x3c [0074.403] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar.anonymous", lpFilePart=0x0) returned 0x46 [0074.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0074.403] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\us_export_policy.jar"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68157440, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x68157440, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xcb4a5d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0074.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\us_export_policy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre7\\lib\\security\\US_export_policy.jar.anonymous" (normalized: "c:\\program files\\java\\jre7\\lib\\security\\us_export_policy.jar.anonymous")) returned 1 [0074.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi", lpFilePart=0x0) returned 0x21 [0074.404] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\", lpFilePart=0x0) returned 0x22 [0074.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.437] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.437] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.437] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.437] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.437] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.437] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.438] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.439] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.440] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.440] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi", lpFilePart=0x0) returned 0x21 [0074.441] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\", lpFilePart=0x0) returned 0x22 [0074.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.442] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.442] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.442] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.442] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.442] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.442] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.443] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.444] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.445] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0074.445] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0074.445] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Africa", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa", lpFilePart=0x0) returned 0x28 [0074.446] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa\\", lpFilePart=0x0) returned 0x29 [0074.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.454] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.455] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.456] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.457] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.458] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.459] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.459] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.459] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.459] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0074.459] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.460] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Africa", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa", lpFilePart=0x0) returned 0x28 [0074.460] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa\\", lpFilePart=0x0) returned 0x29 [0074.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Africa\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.461] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.462] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.463] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0074.463] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.464] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America", lpFilePart=0x0) returned 0x29 [0074.464] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\", lpFilePart=0x0) returned 0x2a [0074.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.490] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.491] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.491] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.491] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.491] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.491] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.492] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.493] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.494] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.494] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.494] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0074.499] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America", lpFilePart=0x0) returned 0x29 [0074.501] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\", lpFilePart=0x0) returned 0x2a [0074.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.502] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina", lpFilePart=0x0) returned 0x33 [0074.503] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina\\", lpFilePart=0x0) returned 0x34 [0074.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.526] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.527] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina", lpFilePart=0x0) returned 0x33 [0074.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina\\", lpFilePart=0x0) returned 0x34 [0074.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Argentina\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.528] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.529] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana", lpFilePart=0x0) returned 0x31 [0074.529] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana\\", lpFilePart=0x0) returned 0x32 [0074.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.538] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.539] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana", lpFilePart=0x0) returned 0x31 [0074.539] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana\\", lpFilePart=0x0) returned 0x32 [0074.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Indiana\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.540] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.541] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky", lpFilePart=0x0) returned 0x32 [0074.541] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky\\", lpFilePart=0x0) returned 0x33 [0074.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.541] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.541] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky", lpFilePart=0x0) returned 0x32 [0074.542] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky\\", lpFilePart=0x0) returned 0x33 [0074.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.542] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota", lpFilePart=0x0) returned 0x36 [0074.542] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\", lpFilePart=0x0) returned 0x37 [0074.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.543] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0074.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota", lpFilePart=0x0) returned 0x36 [0074.543] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\", lpFilePart=0x0) returned 0x37 [0074.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed18 [0074.543] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0074.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0074.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica", lpFilePart=0x0) returned 0x2c [0074.543] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica\\", lpFilePart=0x0) returned 0x2d [0074.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.548] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica", lpFilePart=0x0) returned 0x2c [0074.550] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica\\", lpFilePart=0x0) returned 0x2d [0074.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Antarctica\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.551] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Asia", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia", lpFilePart=0x0) returned 0x26 [0074.552] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia\\", lpFilePart=0x0) returned 0x27 [0074.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.576] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Asia", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia", lpFilePart=0x0) returned 0x26 [0074.577] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia\\", lpFilePart=0x0) returned 0x27 [0074.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Asia\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.579] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic", lpFilePart=0x0) returned 0x2a [0074.581] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic\\", lpFilePart=0x0) returned 0x2b [0074.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.588] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.589] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic", lpFilePart=0x0) returned 0x2a [0074.590] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic\\", lpFilePart=0x0) returned 0x2b [0074.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Atlantic\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.591] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.592] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Australia", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia", lpFilePart=0x0) returned 0x2b [0074.592] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia\\", lpFilePart=0x0) returned 0x2c [0074.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.603] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Australia", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia", lpFilePart=0x0) returned 0x2b [0074.604] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia\\", lpFilePart=0x0) returned 0x2c [0074.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Australia\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.605] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.607] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Etc", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc", lpFilePart=0x0) returned 0x25 [0074.607] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc\\", lpFilePart=0x0) returned 0x26 [0074.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.619] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.620] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Etc", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc", lpFilePart=0x0) returned 0x25 [0074.620] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc\\", lpFilePart=0x0) returned 0x26 [0074.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Etc\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.621] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.622] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Europe", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe", lpFilePart=0x0) returned 0x28 [0074.622] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe\\", lpFilePart=0x0) returned 0x29 [0074.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.625] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.626] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Europe", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe", lpFilePart=0x0) returned 0x28 [0074.626] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe\\", lpFilePart=0x0) returned 0x29 [0074.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Europe\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.627] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Indian", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian", lpFilePart=0x0) returned 0x28 [0074.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian\\", lpFilePart=0x0) returned 0x29 [0074.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.630] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Indian", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian", lpFilePart=0x0) returned 0x28 [0074.631] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian\\", lpFilePart=0x0) returned 0x29 [0074.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Indian\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.632] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Pacific", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific", lpFilePart=0x0) returned 0x29 [0074.633] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific\\", lpFilePart=0x0) returned 0x2a [0074.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.642] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.643] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\Pacific", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific", lpFilePart=0x0) returned 0x29 [0074.643] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific\\", lpFilePart=0x0) returned 0x2a [0074.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\Pacific\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.644] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\SystemV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV", lpFilePart=0x0) returned 0x29 [0074.645] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV\\", lpFilePart=0x0) returned 0x2a [0074.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.658] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Java\\jre7\\lib\\zi\\SystemV", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV", lpFilePart=0x0) returned 0x29 [0074.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV\\", lpFilePart=0x0) returned 0x2a [0074.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre7\\lib\\zi\\SystemV\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.660] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0074.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services", lpFilePart=0x0) returned 0x2c [0074.661] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\", lpFilePart=0x0) returned 0x2d [0074.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0074.662] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0074.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services", lpFilePart=0x0) returned 0x2c [0074.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\", lpFilePart=0x0) returned 0x2d [0074.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0074.662] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0074.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", lpFilePart=0x0) returned 0x35 [0074.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpFilePart=0x0) returned 0x36 [0074.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0074.663] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0074.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB", lpFilePart=0x0) returned 0x35 [0074.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", lpFilePart=0x0) returned 0x36 [0074.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0074.663] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0074.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", lpFilePart=0x0) returned 0x38 [0074.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpFilePart=0x0) returned 0x39 [0074.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0074.685] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0074.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0074.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0074.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10", lpFilePart=0x0) returned 0x38 [0074.687] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpFilePart=0x0) returned 0x39 [0074.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0074.688] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0074.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0074.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.689] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", lpFilePart=0x0) returned 0x43 [0074.689] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpFilePart=0x0) returned 0x44 [0074.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.694] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.695] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges", lpFilePart=0x0) returned 0x43 [0074.695] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpFilePart=0x0) returned 0x44 [0074.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.697] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", lpFilePart=0x0) returned 0x42 [0074.698] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpFilePart=0x0) returned 0x43 [0074.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.698] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0074.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources", lpFilePart=0x0) returned 0x42 [0074.699] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", lpFilePart=0x0) returned 0x43 [0074.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0074.699] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", lpFilePart=0x0) returned 0x47 [0074.699] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpFilePart=0x0) returned 0x48 [0074.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.699] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0074.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033", lpFilePart=0x0) returned 0x47 [0074.700] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpFilePart=0x0) returned 0x48 [0074.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed18 [0074.700] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0074.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0074.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0074.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office", lpFilePart=0x0) returned 0x21 [0074.700] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\", lpFilePart=0x0) returned 0x22 [0074.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0074.700] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0074.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0074.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0074.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office", lpFilePart=0x0) returned 0x21 [0074.700] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\", lpFilePart=0x0) returned 0x22 [0074.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0074.701] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0074.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART", lpFilePart=0x0) returned 0x29 [0074.701] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\", lpFilePart=0x0) returned 0x2a [0074.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0074.701] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0074.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART", lpFilePart=0x0) returned 0x29 [0074.701] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\", lpFilePart=0x0) returned 0x2a [0074.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0074.701] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0074.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0074.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", lpFilePart=0x0) returned 0x32 [0074.702] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpFilePart=0x0) returned 0x33 [0074.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0074.758] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0074.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0074.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0074.762] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR", lpFilePart=0x0) returned 0x32 [0074.762] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpFilePart=0x0) returned 0x33 [0074.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0074.767] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0074.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0074.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0074.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", lpFilePart=0x0) returned 0x3f [0074.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0074.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.773] GetFileType (hFile=0x154) returned 0x1 [0074.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0074.773] GetFileType (hFile=0x154) returned 0x1 [0074.773] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x60b7 [0074.822] CloseHandle (hObject=0x154) returned 1 [0074.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", lpFilePart=0x0) returned 0x3f [0074.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0074.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.862] GetFileType (hFile=0x154) returned 0x1 [0074.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0074.862] GetFileType (hFile=0x154) returned 0x1 [0074.862] WriteFile (in: hFile=0x154, lpBuffer=0x1ad0778*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ad0778*, lpNumberOfBytesWritten=0x2ae554*=0x60c0, lpOverlapped=0x0) returned 1 [0074.864] CloseHandle (hObject=0x154) returned 1 [0074.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", lpFilePart=0x0) returned 0x3f [0074.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0074.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0074.864] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3c32d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcb8f6570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60c0)) returned 1 [0074.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0074.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.anonymous")) returned 1 [0074.865] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", lpFilePart=0x0) returned 0x3f [0074.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0074.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0074.866] GetFileType (hFile=0x154) returned 0x1 [0074.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0074.866] GetFileType (hFile=0x154) returned 0x1 [0074.866] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5f39 [0074.866] ReadFile (in: hFile=0x154, lpBuffer=0x1ad6c5c, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ad6c5c*, lpNumberOfBytesRead=0x2ae560*=0x5f39, lpOverlapped=0x0) returned 1 [0074.986] CloseHandle (hObject=0x154) returned 1 [0075.021] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", lpFilePart=0x0) returned 0x3f [0075.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.023] GetFileType (hFile=0x154) returned 0x1 [0075.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.023] GetFileType (hFile=0x154) returned 0x1 [0075.023] WriteFile (in: hFile=0x154, lpBuffer=0x1987ca4*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1987ca4*, lpNumberOfBytesWritten=0x2ae554*=0x5f40, lpOverlapped=0x0) returned 1 [0075.025] CloseHandle (hObject=0x154) returned 1 [0075.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", lpFilePart=0x0) returned 0x3f [0075.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.025] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b902150, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcba73330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f40)) returned 1 [0075.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.anonymous")) returned 1 [0075.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", lpFilePart=0x0) returned 0x3f [0075.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.028] GetFileType (hFile=0x154) returned 0x1 [0075.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.028] GetFileType (hFile=0x154) returned 0x1 [0075.028] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4752 [0075.028] ReadFile (in: hFile=0x154, lpBuffer=0x198dff0, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x198dff0*, lpNumberOfBytesRead=0x2ae560*=0x4752, lpOverlapped=0x0) returned 1 [0075.047] CloseHandle (hObject=0x154) returned 1 [0075.096] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", lpFilePart=0x0) returned 0x3f [0075.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.098] GetFileType (hFile=0x154) returned 0x1 [0075.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.098] GetFileType (hFile=0x154) returned 0x1 [0075.098] WriteFile (in: hFile=0x154, lpBuffer=0x19f1418*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19f1418*, lpNumberOfBytesWritten=0x2ae554*=0x4760, lpOverlapped=0x0) returned 1 [0075.099] CloseHandle (hObject=0x154) returned 1 [0075.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", lpFilePart=0x0) returned 0x3f [0075.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.099] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b902150, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbb31a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1 [0075.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.anonymous")) returned 1 [0075.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", lpFilePart=0x0) returned 0x3f [0075.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.100] GetFileType (hFile=0x154) returned 0x1 [0075.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.100] GetFileType (hFile=0x154) returned 0x1 [0075.100] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x559a [0075.100] ReadFile (in: hFile=0x154, lpBuffer=0x19f5f9c, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19f5f9c*, lpNumberOfBytesRead=0x2ae560*=0x559a, lpOverlapped=0x0) returned 1 [0075.102] CloseHandle (hObject=0x154) returned 1 [0075.115] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", lpFilePart=0x0) returned 0x3f [0075.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.117] GetFileType (hFile=0x154) returned 0x1 [0075.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.117] GetFileType (hFile=0x154) returned 0x1 [0075.117] WriteFile (in: hFile=0x154, lpBuffer=0x1a5d9a8*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a5d9a8*, lpNumberOfBytesWritten=0x2ae554*=0x55a0, lpOverlapped=0x0) returned 1 [0075.118] CloseHandle (hObject=0x154) returned 1 [0075.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", lpFilePart=0x0) returned 0x3f [0075.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.118] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b902150, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbb57b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x55a0)) returned 1 [0075.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.anonymous")) returned 1 [0075.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", lpFilePart=0x0) returned 0x3f [0075.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.120] GetFileType (hFile=0x154) returned 0x1 [0075.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.120] GetFileType (hFile=0x154) returned 0x1 [0075.120] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2dae [0075.120] ReadFile (in: hFile=0x154, lpBuffer=0x1a6336c, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a6336c*, lpNumberOfBytesRead=0x2ae560*=0x2dae, lpOverlapped=0x0) returned 1 [0075.134] CloseHandle (hObject=0x154) returned 1 [0075.146] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", lpFilePart=0x0) returned 0x3f [0075.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.148] GetFileType (hFile=0x154) returned 0x1 [0075.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.148] GetFileType (hFile=0x154) returned 0x1 [0075.148] WriteFile (in: hFile=0x154, lpBuffer=0x1abe5c8*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1abe5c8*, lpNumberOfBytesWritten=0x2ae554*=0x2db0, lpOverlapped=0x0) returned 1 [0075.149] CloseHandle (hObject=0x154) returned 1 [0075.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", lpFilePart=0x0) returned 0x3f [0075.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.149] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b902150, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbba3e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2db0)) returned 1 [0075.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.anonymous")) returned 1 [0075.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", lpFilePart=0x0) returned 0x3f [0075.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.151] GetFileType (hFile=0x154) returned 0x1 [0075.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.151] GetFileType (hFile=0x154) returned 0x1 [0075.151] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1b11 [0075.151] ReadFile (in: hFile=0x154, lpBuffer=0x1ac179c, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ac179c*, lpNumberOfBytesRead=0x2ae560*=0x1b11, lpOverlapped=0x0) returned 1 [0075.153] CloseHandle (hObject=0x154) returned 1 [0075.164] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", lpFilePart=0x0) returned 0x3f [0075.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.166] GetFileType (hFile=0x154) returned 0x1 [0075.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.166] GetFileType (hFile=0x154) returned 0x1 [0075.166] WriteFile (in: hFile=0x154, lpBuffer=0x1b16d28*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b16d28*, lpNumberOfBytesWritten=0x2ae554*=0x1b20, lpOverlapped=0x0) returned 1 [0075.167] CloseHandle (hObject=0x154) returned 1 [0075.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", lpFilePart=0x0) returned 0x3f [0075.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.168] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3c32d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbbf00f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b20)) returned 1 [0075.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.anonymous")) returned 1 [0075.168] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", lpFilePart=0x0) returned 0x3f [0075.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.169] GetFileType (hFile=0x154) returned 0x1 [0075.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.169] GetFileType (hFile=0x154) returned 0x1 [0075.169] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x227a [0075.169] ReadFile (in: hFile=0x154, lpBuffer=0x1b18c54, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b18c54*, lpNumberOfBytesRead=0x2ae560*=0x227a, lpOverlapped=0x0) returned 1 [0075.171] CloseHandle (hObject=0x154) returned 1 [0075.184] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", lpFilePart=0x0) returned 0x3f [0075.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.185] GetFileType (hFile=0x154) returned 0x1 [0075.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.186] GetFileType (hFile=0x154) returned 0x1 [0075.186] WriteFile (in: hFile=0x154, lpBuffer=0x1b706c0*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b706c0*, lpNumberOfBytesWritten=0x2ae554*=0x2280, lpOverlapped=0x0) returned 1 [0075.187] CloseHandle (hObject=0x154) returned 1 [0075.187] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", lpFilePart=0x0) returned 0x3f [0075.187] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3c32d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbc16250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2280)) returned 1 [0075.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.anonymous")) returned 1 [0075.188] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", lpFilePart=0x0) returned 0x3f [0075.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.188] GetFileType (hFile=0x154) returned 0x1 [0075.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.188] GetFileType (hFile=0x154) returned 0x1 [0075.188] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3682 [0075.188] ReadFile (in: hFile=0x154, lpBuffer=0x1b72d4c, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b72d4c*, lpNumberOfBytesRead=0x2ae560*=0x3682, lpOverlapped=0x0) returned 1 [0075.190] CloseHandle (hObject=0x154) returned 1 [0075.205] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", lpFilePart=0x0) returned 0x3f [0075.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.206] GetFileType (hFile=0x154) returned 0x1 [0075.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.206] GetFileType (hFile=0x154) returned 0x1 [0075.206] WriteFile (in: hFile=0x154, lpBuffer=0x1bd0c08*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1bd0c08*, lpNumberOfBytesWritten=0x2ae554*=0x3690, lpOverlapped=0x0) returned 1 [0075.207] CloseHandle (hObject=0x154) returned 1 [0075.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", lpFilePart=0x0) returned 0x3f [0075.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.208] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3c32d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbc3c3b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3690)) returned 1 [0075.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.anonymous")) returned 1 [0075.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", lpFilePart=0x0) returned 0x3f [0075.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.209] GetFileType (hFile=0x154) returned 0x1 [0075.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.209] GetFileType (hFile=0x154) returned 0x1 [0075.209] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x25c7 [0075.209] ReadFile (in: hFile=0x154, lpBuffer=0x1bd46a4, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1bd46a4*, lpNumberOfBytesRead=0x2ae560*=0x25c7, lpOverlapped=0x0) returned 1 [0075.210] CloseHandle (hObject=0x154) returned 1 [0075.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", lpFilePart=0x0) returned 0x3f [0075.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.231] GetFileType (hFile=0x154) returned 0x1 [0075.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.231] GetFileType (hFile=0x154) returned 0x1 [0075.231] WriteFile (in: hFile=0x154, lpBuffer=0x1c2d1a0*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1c2d1a0*, lpNumberOfBytesWritten=0x2ae554*=0x25d0, lpOverlapped=0x0) returned 1 [0075.233] CloseHandle (hObject=0x154) returned 1 [0075.233] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", lpFilePart=0x0) returned 0x3f [0075.233] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.233] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3c32d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbc88670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25d0)) returned 1 [0075.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.anonymous")) returned 1 [0075.233] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", lpFilePart=0x0) returned 0x3f [0075.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.234] GetFileType (hFile=0x154) returned 0x1 [0075.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.234] GetFileType (hFile=0x154) returned 0x1 [0075.234] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3b29 [0075.234] ReadFile (in: hFile=0x154, lpBuffer=0x1c2fbac, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1c2fbac*, lpNumberOfBytesRead=0x2ae560*=0x3b29, lpOverlapped=0x0) returned 1 [0075.235] CloseHandle (hObject=0x154) returned 1 [0075.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", lpFilePart=0x0) returned 0x3f [0075.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.256] GetFileType (hFile=0x154) returned 0x1 [0075.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.256] GetFileType (hFile=0x154) returned 0x1 [0075.256] WriteFile (in: hFile=0x154, lpBuffer=0x1c8f188*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1c8f188*, lpNumberOfBytesWritten=0x2ae554*=0x3b30, lpOverlapped=0x0) returned 1 [0075.257] CloseHandle (hObject=0x154) returned 1 [0075.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", lpFilePart=0x0) returned 0x3f [0075.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3c32d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbcae7d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b30)) returned 1 [0075.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.anonymous")) returned 1 [0075.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpFilePart=0x0) returned 0x3f [0075.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.259] GetFileType (hFile=0x154) returned 0x1 [0075.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.259] GetFileType (hFile=0x154) returned 0x1 [0075.259] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1bf2 [0075.259] ReadFile (in: hFile=0x154, lpBuffer=0x1c930c4, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1c930c4*, lpNumberOfBytesRead=0x2ae560*=0x1bf2, lpOverlapped=0x0) returned 1 [0075.260] CloseHandle (hObject=0x154) returned 1 [0075.279] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpFilePart=0x0) returned 0x3f [0075.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.281] GetFileType (hFile=0x154) returned 0x1 [0075.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.281] GetFileType (hFile=0x154) returned 0x1 [0075.281] WriteFile (in: hFile=0x154, lpBuffer=0x1ce8ab0*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ce8ab0*, lpNumberOfBytesWritten=0x2ae554*=0x1c00, lpOverlapped=0x0) returned 1 [0075.282] CloseHandle (hObject=0x154) returned 1 [0075.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", lpFilePart=0x0) returned 0x3f [0075.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.282] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3e9430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbcfaa90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0075.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.anonymous")) returned 1 [0075.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", lpFilePart=0x0) returned 0x3f [0075.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.283] GetFileType (hFile=0x154) returned 0x1 [0075.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.283] GetFileType (hFile=0x154) returned 0x1 [0075.283] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4cc8 [0075.284] ReadFile (in: hFile=0x154, lpBuffer=0x1ceaabc, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ceaabc*, lpNumberOfBytesRead=0x2ae560*=0x4cc8, lpOverlapped=0x0) returned 1 [0075.286] CloseHandle (hObject=0x154) returned 1 [0075.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", lpFilePart=0x0) returned 0x3f [0075.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.306] GetFileType (hFile=0x154) returned 0x1 [0075.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.306] GetFileType (hFile=0x154) returned 0x1 [0075.306] WriteFile (in: hFile=0x154, lpBuffer=0x1d4f8b4*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1d4f8b4*, lpNumberOfBytesWritten=0x2ae554*=0x4cd0, lpOverlapped=0x0) returned 1 [0075.308] CloseHandle (hObject=0x154) returned 1 [0075.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", lpFilePart=0x0) returned 0x3f [0075.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3e9430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbd46d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4cd0)) returned 1 [0075.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.anonymous")) returned 1 [0075.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", lpFilePart=0x0) returned 0x3f [0075.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.309] GetFileType (hFile=0x154) returned 0x1 [0075.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.309] GetFileType (hFile=0x154) returned 0x1 [0075.309] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc53a [0075.310] ReadFile (in: hFile=0x154, lpBuffer=0x1d549c0, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1d549c0*, lpNumberOfBytesRead=0x2ae560*=0xc53a, lpOverlapped=0x0) returned 1 [0075.312] CloseHandle (hObject=0x154) returned 1 [0075.331] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", lpFilePart=0x0) returned 0x3f [0075.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.333] GetFileType (hFile=0x154) returned 0x1 [0075.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.333] GetFileType (hFile=0x154) returned 0x1 [0075.333] WriteFile (in: hFile=0x154, lpBuffer=0x1dc6780*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1dc6780*, lpNumberOfBytesWritten=0x2ae554*=0xc540, lpOverlapped=0x0) returned 1 [0075.335] CloseHandle (hObject=0x154) returned 1 [0075.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", lpFilePart=0x0) returned 0x3f [0075.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.335] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3e9430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbd6ceb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc540)) returned 1 [0075.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.anonymous")) returned 1 [0075.336] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", lpFilePart=0x0) returned 0x3f [0075.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.336] GetFileType (hFile=0x154) returned 0x1 [0075.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.336] GetFileType (hFile=0x154) returned 0x1 [0075.336] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xfcff [0075.337] ReadFile (in: hFile=0x154, lpBuffer=0x1dd30cc, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1dd30cc*, lpNumberOfBytesRead=0x2ae560*=0xfcff, lpOverlapped=0x0) returned 1 [0075.347] CloseHandle (hObject=0x154) returned 1 [0075.368] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", lpFilePart=0x0) returned 0x3f [0075.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.369] GetFileType (hFile=0x154) returned 0x1 [0075.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.370] GetFileType (hFile=0x154) returned 0x1 [0075.370] WriteFile (in: hFile=0x154, lpBuffer=0x1e4f5cc*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1e4f5cc*, lpNumberOfBytesWritten=0x2ae554*=0xfd00, lpOverlapped=0x0) returned 1 [0075.372] CloseHandle (hObject=0x154) returned 1 [0075.372] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", lpFilePart=0x0) returned 0x3f [0075.372] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.372] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b3e9430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbddf2d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfd00)) returned 1 [0075.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.anonymous")) returned 1 [0075.373] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", lpFilePart=0x0) returned 0x3f [0075.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.374] GetFileType (hFile=0x154) returned 0x1 [0075.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.374] GetFileType (hFile=0x154) returned 0x1 [0075.374] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xabad [0075.374] ReadFile (in: hFile=0x154, lpBuffer=0x1e5f6d8, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1e5f6d8*, lpNumberOfBytesRead=0x2ae560*=0xabad, lpOverlapped=0x0) returned 1 [0075.380] CloseHandle (hObject=0x154) returned 1 [0075.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", lpFilePart=0x0) returned 0x3f [0075.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.402] GetFileType (hFile=0x154) returned 0x1 [0075.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.403] GetFileType (hFile=0x154) returned 0x1 [0075.403] WriteFile (in: hFile=0x154, lpBuffer=0x1ecc7e8*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ecc7e8*, lpNumberOfBytesWritten=0x2ae554*=0xabb0, lpOverlapped=0x0) returned 1 [0075.404] CloseHandle (hObject=0x154) returned 1 [0075.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", lpFilePart=0x0) returned 0x3f [0075.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.405] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b9282b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbe2b590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xabb0)) returned 1 [0075.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.anonymous")) returned 1 [0075.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", lpFilePart=0x0) returned 0x3f [0075.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.405] GetFileType (hFile=0x154) returned 0x1 [0075.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.405] GetFileType (hFile=0x154) returned 0x1 [0075.405] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4ed3 [0075.406] ReadFile (in: hFile=0x154, lpBuffer=0x1ed77a4, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ed77a4*, lpNumberOfBytesRead=0x2ae560*=0x4ed3, lpOverlapped=0x0) returned 1 [0075.408] CloseHandle (hObject=0x154) returned 1 [0075.436] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", lpFilePart=0x0) returned 0x3f [0075.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.437] GetFileType (hFile=0x154) returned 0x1 [0075.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.437] GetFileType (hFile=0x154) returned 0x1 [0075.437] WriteFile (in: hFile=0x154, lpBuffer=0x1f3cff0*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1f3cff0*, lpNumberOfBytesWritten=0x2ae554*=0x4ee0, lpOverlapped=0x0) returned 1 [0075.439] CloseHandle (hObject=0x154) returned 1 [0075.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", lpFilePart=0x0) returned 0x3f [0075.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.439] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b9282b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbe77850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ee0)) returned 1 [0075.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.anonymous")) returned 1 [0075.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", lpFilePart=0x0) returned 0x3f [0075.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.440] GetFileType (hFile=0x154) returned 0x1 [0075.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.440] GetFileType (hFile=0x154) returned 0x1 [0075.440] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xcd2 [0075.440] ReadFile (in: hFile=0x154, lpBuffer=0x1f4313c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1f4313c*, lpNumberOfBytesRead=0x2ae560*=0xcd2, lpOverlapped=0x0) returned 1 [0075.445] CloseHandle (hObject=0x154) returned 1 [0075.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", lpFilePart=0x0) returned 0x3f [0075.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.486] GetFileType (hFile=0x154) returned 0x1 [0075.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.487] GetFileType (hFile=0x154) returned 0x1 [0075.487] WriteFile (in: hFile=0x154, lpBuffer=0x19a90c8*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19a90c8*, lpNumberOfBytesWritten=0x2ae528*=0xce0, lpOverlapped=0x0) returned 1 [0075.488] CloseHandle (hObject=0x154) returned 1 [0075.488] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", lpFilePart=0x0) returned 0x3f [0075.488] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.488] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b9282b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbee9c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xce0)) returned 1 [0075.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.anonymous")) returned 1 [0075.489] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", lpFilePart=0x0) returned 0x3f [0075.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.489] GetFileType (hFile=0x154) returned 0x1 [0075.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.489] GetFileType (hFile=0x154) returned 0x1 [0075.489] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4162 [0075.490] ReadFile (in: hFile=0x154, lpBuffer=0x19aa3c4, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19aa3c4*, lpNumberOfBytesRead=0x2ae560*=0x4162, lpOverlapped=0x0) returned 1 [0075.491] CloseHandle (hObject=0x154) returned 1 [0075.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", lpFilePart=0x0) returned 0x3f [0075.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.507] GetFileType (hFile=0x154) returned 0x1 [0075.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.507] GetFileType (hFile=0x154) returned 0x1 [0075.507] WriteFile (in: hFile=0x154, lpBuffer=0x1a0ba3c*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a0ba3c*, lpNumberOfBytesWritten=0x2ae554*=0x4170, lpOverlapped=0x0) returned 1 [0075.509] CloseHandle (hObject=0x154) returned 1 [0075.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", lpFilePart=0x0) returned 0x3f [0075.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.509] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad71cf00, ftCreationTime.dwHighDateTime=0x1bdbfd8, ftLastAccessTime.dwLowDateTime=0x7b40f590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbf0fdd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4170)) returned 1 [0075.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.anonymous")) returned 1 [0075.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", lpFilePart=0x0) returned 0x3f [0075.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.510] GetFileType (hFile=0x154) returned 0x1 [0075.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.510] GetFileType (hFile=0x154) returned 0x1 [0075.510] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5fd0 [0075.510] ReadFile (in: hFile=0x154, lpBuffer=0x1a0ffb8, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0ffb8*, lpNumberOfBytesRead=0x2ae560*=0x5fd0, lpOverlapped=0x0) returned 1 [0075.512] CloseHandle (hObject=0x154) returned 1 [0075.525] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", lpFilePart=0x0) returned 0x3f [0075.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.526] GetFileType (hFile=0x154) returned 0x1 [0075.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.526] GetFileType (hFile=0x154) returned 0x1 [0075.526] WriteFile (in: hFile=0x154, lpBuffer=0x1a7ad00*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a7ad00*, lpNumberOfBytesWritten=0x2ae554*=0x5fe0, lpOverlapped=0x0) returned 1 [0075.528] CloseHandle (hObject=0x154) returned 1 [0075.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", lpFilePart=0x0) returned 0x3f [0075.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5199400, ftCreationTime.dwHighDateTime=0x1bdbfd8, ftLastAccessTime.dwLowDateTime=0x8b9282b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbf5c090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0)) returned 1 [0075.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.anonymous")) returned 1 [0075.531] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", lpFilePart=0x0) returned 0x3f [0075.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.532] GetFileType (hFile=0x154) returned 0x1 [0075.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.532] GetFileType (hFile=0x154) returned 0x1 [0075.532] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2378 [0075.532] ReadFile (in: hFile=0x154, lpBuffer=0x1a810ec, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a810ec*, lpNumberOfBytesRead=0x2ae560*=0x2378, lpOverlapped=0x0) returned 1 [0075.533] CloseHandle (hObject=0x154) returned 1 [0075.545] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", lpFilePart=0x0) returned 0x3f [0075.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.547] GetFileType (hFile=0x154) returned 0x1 [0075.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.547] GetFileType (hFile=0x154) returned 0x1 [0075.547] WriteFile (in: hFile=0x154, lpBuffer=0x1ad9054*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ad9054*, lpNumberOfBytesWritten=0x2ae554*=0x2380, lpOverlapped=0x0) returned 1 [0075.548] CloseHandle (hObject=0x154) returned 1 [0075.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", lpFilePart=0x0) returned 0x3f [0075.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.548] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b9282b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbf821f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2380)) returned 1 [0075.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.anonymous")) returned 1 [0075.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", lpFilePart=0x0) returned 0x3f [0075.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.549] GetFileType (hFile=0x154) returned 0x1 [0075.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.549] GetFileType (hFile=0x154) returned 0x1 [0075.549] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1f8c [0075.550] ReadFile (in: hFile=0x154, lpBuffer=0x1adb7e0, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1adb7e0*, lpNumberOfBytesRead=0x2ae560*=0x1f8c, lpOverlapped=0x0) returned 1 [0075.567] CloseHandle (hObject=0x154) returned 1 [0075.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", lpFilePart=0x0) returned 0x3f [0075.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.582] GetFileType (hFile=0x154) returned 0x1 [0075.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.582] GetFileType (hFile=0x154) returned 0x1 [0075.582] WriteFile (in: hFile=0x154, lpBuffer=0x1b32398*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b32398*, lpNumberOfBytesWritten=0x2ae554*=0x1f90, lpOverlapped=0x0) returned 1 [0075.583] CloseHandle (hObject=0x154) returned 1 [0075.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", lpFilePart=0x0) returned 0x3f [0075.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.583] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x8b9282b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcbfce4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f90)) returned 1 [0075.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.anonymous")) returned 1 [0075.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", lpFilePart=0x0) returned 0x3f [0075.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.584] GetFileType (hFile=0x154) returned 0x1 [0075.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.584] GetFileType (hFile=0x154) returned 0x1 [0075.584] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xab74 [0075.584] ReadFile (in: hFile=0x154, lpBuffer=0x1b34734, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b34734*, lpNumberOfBytesRead=0x2ae560*=0xab74, lpOverlapped=0x0) returned 1 [0075.586] CloseHandle (hObject=0x154) returned 1 [0075.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", lpFilePart=0x0) returned 0x3f [0075.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.630] GetFileType (hFile=0x154) returned 0x1 [0075.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.630] GetFileType (hFile=0x154) returned 0x1 [0075.630] WriteFile (in: hFile=0x154, lpBuffer=0x19ae160*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19ae160*, lpNumberOfBytesWritten=0x2ae554*=0xab80, lpOverlapped=0x0) returned 1 [0075.632] CloseHandle (hObject=0x154) returned 1 [0075.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", lpFilePart=0x0) returned 0x3f [0075.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b40f590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc0408d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xab80)) returned 1 [0075.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.anonymous")) returned 1 [0075.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", lpFilePart=0x0) returned 0x3f [0075.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.633] GetFileType (hFile=0x154) returned 0x1 [0075.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.633] GetFileType (hFile=0x154) returned 0x1 [0075.633] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf39f [0075.633] ReadFile (in: hFile=0x154, lpBuffer=0x19b90ec, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19b90ec*, lpNumberOfBytesRead=0x2ae560*=0xf39f, lpOverlapped=0x0) returned 1 [0075.635] CloseHandle (hObject=0x154) returned 1 [0075.651] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", lpFilePart=0x0) returned 0x3f [0075.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.653] GetFileType (hFile=0x154) returned 0x1 [0075.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.653] GetFileType (hFile=0x154) returned 0x1 [0075.653] WriteFile (in: hFile=0x154, lpBuffer=0x1a33b28*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a33b28*, lpNumberOfBytesWritten=0x2ae554*=0xf3a0, lpOverlapped=0x0) returned 1 [0075.655] CloseHandle (hObject=0x154) returned 1 [0075.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", lpFilePart=0x0) returned 0x3f [0075.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500bf800, ftCreationTime.dwHighDateTime=0x1bd32ab, ftLastAccessTime.dwLowDateTime=0x7b40f590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc08cb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf3a0)) returned 1 [0075.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.anonymous")) returned 1 [0075.656] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", lpFilePart=0x0) returned 0x3f [0075.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.657] GetFileType (hFile=0x154) returned 0x1 [0075.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.657] GetFileType (hFile=0x154) returned 0x1 [0075.657] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9d27 [0075.657] ReadFile (in: hFile=0x154, lpBuffer=0x1a4430c, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a4430c*, lpNumberOfBytesRead=0x2ae560*=0x9d27, lpOverlapped=0x0) returned 1 [0075.659] CloseHandle (hObject=0x154) returned 1 [0075.672] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", lpFilePart=0x0) returned 0x3f [0075.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.673] GetFileType (hFile=0x154) returned 0x1 [0075.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.673] GetFileType (hFile=0x154) returned 0x1 [0075.673] WriteFile (in: hFile=0x154, lpBuffer=0x1ac22e8*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ac22e8*, lpNumberOfBytesWritten=0x2ae554*=0x9d30, lpOverlapped=0x0) returned 1 [0075.675] CloseHandle (hObject=0x154) returned 1 [0075.675] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", lpFilePart=0x0) returned 0x3f [0075.675] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.675] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb202900, ftCreationTime.dwHighDateTime=0x1bdbfd3, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc0b2cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9d30)) returned 1 [0075.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.anonymous")) returned 1 [0075.676] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", lpFilePart=0x0) returned 0x3f [0075.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.676] GetFileType (hFile=0x154) returned 0x1 [0075.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.676] GetFileType (hFile=0x154) returned 0x1 [0075.676] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8379 [0075.676] ReadFile (in: hFile=0x154, lpBuffer=0x1acc424, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1acc424*, lpNumberOfBytesRead=0x2ae560*=0x8379, lpOverlapped=0x0) returned 1 [0075.690] CloseHandle (hObject=0x154) returned 1 [0075.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", lpFilePart=0x0) returned 0x3f [0075.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.705] GetFileType (hFile=0x154) returned 0x1 [0075.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.705] GetFileType (hFile=0x154) returned 0x1 [0075.705] WriteFile (in: hFile=0x154, lpBuffer=0x1b42390*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b42390*, lpNumberOfBytesWritten=0x2ae554*=0x8380, lpOverlapped=0x0) returned 1 [0075.707] CloseHandle (hObject=0x154) returned 1 [0075.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", lpFilePart=0x0) returned 0x3f [0075.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.707] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc0fefb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8380)) returned 1 [0075.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.anonymous")) returned 1 [0075.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", lpFilePart=0x0) returned 0x3f [0075.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.708] GetFileType (hFile=0x154) returned 0x1 [0075.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.709] GetFileType (hFile=0x154) returned 0x1 [0075.709] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf0c1 [0075.709] ReadFile (in: hFile=0x154, lpBuffer=0x1b4ab1c, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b4ab1c*, lpNumberOfBytesRead=0x2ae560*=0xf0c1, lpOverlapped=0x0) returned 1 [0075.711] CloseHandle (hObject=0x154) returned 1 [0075.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", lpFilePart=0x0) returned 0x3f [0075.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.754] GetFileType (hFile=0x154) returned 0x1 [0075.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.754] GetFileType (hFile=0x154) returned 0x1 [0075.754] WriteFile (in: hFile=0x154, lpBuffer=0x19d40a4*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19d40a4*, lpNumberOfBytesWritten=0x2ae554*=0xf0d0, lpOverlapped=0x0) returned 1 [0075.756] CloseHandle (hObject=0x154) returned 1 [0075.756] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", lpFilePart=0x0) returned 0x3f [0075.756] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8ba7ef10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc1713d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0d0)) returned 1 [0075.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.anonymous")) returned 1 [0075.757] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", lpFilePart=0x0) returned 0x3f [0075.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.757] GetFileType (hFile=0x154) returned 0x1 [0075.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.757] GetFileType (hFile=0x154) returned 0x1 [0075.757] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc056 [0075.757] ReadFile (in: hFile=0x154, lpBuffer=0x19e3580, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e3580*, lpNumberOfBytesRead=0x2ae560*=0xc056, lpOverlapped=0x0) returned 1 [0075.759] CloseHandle (hObject=0x154) returned 1 [0075.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", lpFilePart=0x0) returned 0x3f [0075.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.776] GetFileType (hFile=0x154) returned 0x1 [0075.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.776] GetFileType (hFile=0x154) returned 0x1 [0075.776] WriteFile (in: hFile=0x154, lpBuffer=0x1a545fc*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a545fc*, lpNumberOfBytesWritten=0x2ae554*=0xc060, lpOverlapped=0x0) returned 1 [0075.778] CloseHandle (hObject=0x154) returned 1 [0075.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", lpFilePart=0x0) returned 0x3f [0075.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.778] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc1bd690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc060)) returned 1 [0075.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.anonymous")) returned 1 [0075.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", lpFilePart=0x0) returned 0x3f [0075.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.779] GetFileType (hFile=0x154) returned 0x1 [0075.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.779] GetFileType (hFile=0x154) returned 0x1 [0075.779] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5285 [0075.779] ReadFile (in: hFile=0x154, lpBuffer=0x1a60a68, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a60a68*, lpNumberOfBytesRead=0x2ae560*=0x5285, lpOverlapped=0x0) returned 1 [0075.790] CloseHandle (hObject=0x154) returned 1 [0075.802] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", lpFilePart=0x0) returned 0x3f [0075.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.804] GetFileType (hFile=0x154) returned 0x1 [0075.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.804] GetFileType (hFile=0x154) returned 0x1 [0075.804] WriteFile (in: hFile=0x154, lpBuffer=0x1ac7524*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ac7524*, lpNumberOfBytesWritten=0x2ae554*=0x5290, lpOverlapped=0x0) returned 1 [0075.805] CloseHandle (hObject=0x154) returned 1 [0075.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", lpFilePart=0x0) returned 0x3f [0075.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.806] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8ba7ef10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc1e37f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5290)) returned 1 [0075.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.anonymous")) returned 1 [0075.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", lpFilePart=0x0) returned 0x3f [0075.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.807] GetFileType (hFile=0x154) returned 0x1 [0075.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.807] GetFileType (hFile=0x154) returned 0x1 [0075.807] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x45cb [0075.807] ReadFile (in: hFile=0x154, lpBuffer=0x1accbc0, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1accbc0*, lpNumberOfBytesRead=0x2ae560*=0x45cb, lpOverlapped=0x0) returned 1 [0075.808] CloseHandle (hObject=0x154) returned 1 [0075.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", lpFilePart=0x0) returned 0x3f [0075.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.822] GetFileType (hFile=0x154) returned 0x1 [0075.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.822] GetFileType (hFile=0x154) returned 0x1 [0075.822] WriteFile (in: hFile=0x154, lpBuffer=0x1b2f6bc*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b2f6bc*, lpNumberOfBytesWritten=0x2ae554*=0x45d0, lpOverlapped=0x0) returned 1 [0075.824] CloseHandle (hObject=0x154) returned 1 [0075.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", lpFilePart=0x0) returned 0x3f [0075.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.824] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6afac300, ftCreationTime.dwHighDateTime=0x1bdbfd5, ftLastAccessTime.dwLowDateTime=0x8ba7ef10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc22fab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x45d0)) returned 1 [0075.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.anonymous")) returned 1 [0075.825] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", lpFilePart=0x0) returned 0x3f [0075.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.825] GetFileType (hFile=0x154) returned 0x1 [0075.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.825] GetFileType (hFile=0x154) returned 0x1 [0075.825] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7c6a [0075.825] ReadFile (in: hFile=0x154, lpBuffer=0x1b34098, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b34098*, lpNumberOfBytesRead=0x2ae560*=0x7c6a, lpOverlapped=0x0) returned 1 [0075.828] CloseHandle (hObject=0x154) returned 1 [0075.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", lpFilePart=0x0) returned 0x3f [0075.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.868] GetFileType (hFile=0x154) returned 0x1 [0075.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.868] GetFileType (hFile=0x154) returned 0x1 [0075.868] WriteFile (in: hFile=0x154, lpBuffer=0x19afdb8*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19afdb8*, lpNumberOfBytesWritten=0x2ae554*=0x7c70, lpOverlapped=0x0) returned 1 [0075.883] CloseHandle (hObject=0x154) returned 1 [0075.883] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", lpFilePart=0x0) returned 0x3f [0075.883] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.883] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd83900, ftCreationTime.dwHighDateTime=0x1bdbfd6, ftLastAccessTime.dwLowDateTime=0x8ba7ef10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc2a1ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7c70)) returned 1 [0075.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.anonymous")) returned 1 [0075.884] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", lpFilePart=0x0) returned 0x3f [0075.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.884] GetFileType (hFile=0x154) returned 0x1 [0075.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.884] GetFileType (hFile=0x154) returned 0x1 [0075.884] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8fd4 [0075.885] ReadFile (in: hFile=0x154, lpBuffer=0x19b7e34, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19b7e34*, lpNumberOfBytesRead=0x2ae560*=0x8fd4, lpOverlapped=0x0) returned 1 [0075.886] CloseHandle (hObject=0x154) returned 1 [0075.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", lpFilePart=0x0) returned 0x3f [0075.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.901] GetFileType (hFile=0x154) returned 0x1 [0075.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.901] GetFileType (hFile=0x154) returned 0x1 [0075.901] WriteFile (in: hFile=0x154, lpBuffer=0x1a31cd8*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a31cd8*, lpNumberOfBytesWritten=0x2ae554*=0x8fe0, lpOverlapped=0x0) returned 1 [0075.902] CloseHandle (hObject=0x154) returned 1 [0075.903] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", lpFilePart=0x0) returned 0x3f [0075.903] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.903] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3a9300, ftCreationTime.dwHighDateTime=0x1bdbfd6, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc2ee190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8fe0)) returned 1 [0075.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.anonymous")) returned 1 [0075.903] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", lpFilePart=0x0) returned 0x3f [0075.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.904] GetFileType (hFile=0x154) returned 0x1 [0075.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.904] GetFileType (hFile=0x154) returned 0x1 [0075.904] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8fb8 [0075.904] ReadFile (in: hFile=0x154, lpBuffer=0x1a3b0c4, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a3b0c4*, lpNumberOfBytesRead=0x2ae560*=0x8fb8, lpOverlapped=0x0) returned 1 [0075.906] CloseHandle (hObject=0x154) returned 1 [0075.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", lpFilePart=0x0) returned 0x3f [0075.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.920] GetFileType (hFile=0x154) returned 0x1 [0075.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.920] GetFileType (hFile=0x154) returned 0x1 [0075.920] WriteFile (in: hFile=0x154, lpBuffer=0x1ab4d6c*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ab4d6c*, lpNumberOfBytesWritten=0x2ae554*=0x8fc0, lpOverlapped=0x0) returned 1 [0075.922] CloseHandle (hObject=0x154) returned 1 [0075.922] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", lpFilePart=0x0) returned 0x3f [0075.922] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe610a900, ftCreationTime.dwHighDateTime=0x1bdbfd6, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc3142f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8fc0)) returned 1 [0075.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.anonymous")) returned 1 [0075.923] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", lpFilePart=0x0) returned 0x3f [0075.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.924] GetFileType (hFile=0x154) returned 0x1 [0075.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.924] GetFileType (hFile=0x154) returned 0x1 [0075.924] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8a5b [0075.924] ReadFile (in: hFile=0x154, lpBuffer=0x1abe138, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1abe138*, lpNumberOfBytesRead=0x2ae560*=0x8a5b, lpOverlapped=0x0) returned 1 [0075.926] CloseHandle (hObject=0x154) returned 1 [0075.939] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", lpFilePart=0x0) returned 0x3f [0075.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.940] GetFileType (hFile=0x154) returned 0x1 [0075.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.940] GetFileType (hFile=0x154) returned 0x1 [0075.940] WriteFile (in: hFile=0x154, lpBuffer=0x1b36304*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b36304*, lpNumberOfBytesWritten=0x2ae554*=0x8a60, lpOverlapped=0x0) returned 1 [0075.942] CloseHandle (hObject=0x154) returned 1 [0075.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", lpFilePart=0x0) returned 0x3f [0075.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.942] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b0d2e00, ftCreationTime.dwHighDateTime=0x1c0271b, ftLastAccessTime.dwLowDateTime=0x8ba7ef10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc33a450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8a60)) returned 1 [0075.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.anonymous")) returned 1 [0075.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", lpFilePart=0x0) returned 0x3f [0075.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.943] GetFileType (hFile=0x154) returned 0x1 [0075.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.943] GetFileType (hFile=0x154) returned 0x1 [0075.943] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x84a6 [0075.943] ReadFile (in: hFile=0x154, lpBuffer=0x1b3f170, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b3f170*, lpNumberOfBytesRead=0x2ae560*=0x84a6, lpOverlapped=0x0) returned 1 [0075.945] CloseHandle (hObject=0x154) returned 1 [0075.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", lpFilePart=0x0) returned 0x3f [0075.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0075.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.986] GetFileType (hFile=0x154) returned 0x1 [0075.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0075.987] GetFileType (hFile=0x154) returned 0x1 [0075.987] WriteFile (in: hFile=0x154, lpBuffer=0x19cd8e4*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19cd8e4*, lpNumberOfBytesWritten=0x2ae554*=0x84b0, lpOverlapped=0x0) returned 1 [0075.988] CloseHandle (hObject=0x154) returned 1 [0075.988] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", lpFilePart=0x0) returned 0x3f [0075.988] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0075.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0075.988] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ccb0500, ftCreationTime.dwHighDateTime=0x1c03dee, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc3ac870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x84b0)) returned 1 [0075.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0075.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.anonymous")) returned 1 [0075.989] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", lpFilePart=0x0) returned 0x3f [0075.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0075.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0075.989] GetFileType (hFile=0x154) returned 0x1 [0075.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0075.989] GetFileType (hFile=0x154) returned 0x1 [0075.989] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9a76 [0075.989] ReadFile (in: hFile=0x154, lpBuffer=0x19d61a0, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19d61a0*, lpNumberOfBytesRead=0x2ae560*=0x9a76, lpOverlapped=0x0) returned 1 [0075.991] CloseHandle (hObject=0x154) returned 1 [0076.004] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", lpFilePart=0x0) returned 0x3f [0076.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.005] GetFileType (hFile=0x154) returned 0x1 [0076.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.005] GetFileType (hFile=0x154) returned 0x1 [0076.005] WriteFile (in: hFile=0x154, lpBuffer=0x1a53568*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a53568*, lpNumberOfBytesWritten=0x2ae554*=0x9a80, lpOverlapped=0x0) returned 1 [0076.007] CloseHandle (hObject=0x154) returned 1 [0076.007] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", lpFilePart=0x0) returned 0x3f [0076.007] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.007] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e47ab00, ftCreationTime.dwHighDateTime=0x1bdbfd7, ftLastAccessTime.dwLowDateTime=0x8ba7ef10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc3d29d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a80)) returned 1 [0076.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.anonymous")) returned 1 [0076.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", lpFilePart=0x0) returned 0x3f [0076.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.008] GetFileType (hFile=0x154) returned 0x1 [0076.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.008] GetFileType (hFile=0x154) returned 0x1 [0076.008] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb5ac [0076.008] ReadFile (in: hFile=0x154, lpBuffer=0x1a5d3f4, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a5d3f4*, lpNumberOfBytesRead=0x2ae560*=0xb5ac, lpOverlapped=0x0) returned 1 [0076.010] CloseHandle (hObject=0x154) returned 1 [0076.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", lpFilePart=0x0) returned 0x3f [0076.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.026] GetFileType (hFile=0x154) returned 0x1 [0076.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.027] GetFileType (hFile=0x154) returned 0x1 [0076.027] WriteFile (in: hFile=0x154, lpBuffer=0x1acc300*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1acc300*, lpNumberOfBytesWritten=0x2ae554*=0xb5b0, lpOverlapped=0x0) returned 1 [0076.028] CloseHandle (hObject=0x154) returned 1 [0076.028] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", lpFilePart=0x0) returned 0x3f [0076.028] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.029] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc41ec90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb5b0)) returned 1 [0076.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.anonymous")) returned 1 [0076.029] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", lpFilePart=0x0) returned 0x3f [0076.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.030] GetFileType (hFile=0x154) returned 0x1 [0076.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.030] GetFileType (hFile=0x154) returned 0x1 [0076.030] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xaa9a [0076.030] ReadFile (in: hFile=0x154, lpBuffer=0x1ad7cbc, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ad7cbc*, lpNumberOfBytesRead=0x2ae560*=0xaa9a, lpOverlapped=0x0) returned 1 [0076.037] CloseHandle (hObject=0x154) returned 1 [0076.051] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", lpFilePart=0x0) returned 0x3f [0076.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.052] GetFileType (hFile=0x154) returned 0x1 [0076.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.052] GetFileType (hFile=0x154) returned 0x1 [0076.052] WriteFile (in: hFile=0x154, lpBuffer=0x1b44a9c*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b44a9c*, lpNumberOfBytesWritten=0x2ae554*=0xaaa0, lpOverlapped=0x0) returned 1 [0076.054] CloseHandle (hObject=0x154) returned 1 [0076.054] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", lpFilePart=0x0) returned 0x3f [0076.054] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.054] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8baa5070, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc444df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaaa0)) returned 1 [0076.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.anonymous")) returned 1 [0076.055] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", lpFilePart=0x0) returned 0x3f [0076.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.055] GetFileType (hFile=0x154) returned 0x1 [0076.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.055] GetFileType (hFile=0x154) returned 0x1 [0076.055] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x107d4 [0076.055] ReadFile (in: hFile=0x154, lpBuffer=0x1b4f948, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b4f948*, lpNumberOfBytesRead=0x2ae560*=0x107d4, lpOverlapped=0x0) returned 1 [0076.057] CloseHandle (hObject=0x154) returned 1 [0076.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", lpFilePart=0x0) returned 0x3f [0076.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.099] GetFileType (hFile=0x154) returned 0x1 [0076.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.099] GetFileType (hFile=0x154) returned 0x1 [0076.099] WriteFile (in: hFile=0x154, lpBuffer=0x19d6248*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19d6248*, lpNumberOfBytesWritten=0x2ae554*=0x107e0, lpOverlapped=0x0) returned 1 [0076.101] CloseHandle (hObject=0x154) returned 1 [0076.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", lpFilePart=0x0) returned 0x3f [0076.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc4b7210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x107e0)) returned 1 [0076.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.anonymous")) returned 1 [0076.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", lpFilePart=0x0) returned 0x3f [0076.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.102] GetFileType (hFile=0x154) returned 0x1 [0076.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.102] GetFileType (hFile=0x154) returned 0x1 [0076.102] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x955d [0076.102] ReadFile (in: hFile=0x154, lpBuffer=0x19e6e34, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e6e34*, lpNumberOfBytesRead=0x2ae560*=0x955d, lpOverlapped=0x0) returned 1 [0076.104] CloseHandle (hObject=0x154) returned 1 [0076.116] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", lpFilePart=0x0) returned 0x3f [0076.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.118] GetFileType (hFile=0x154) returned 0x1 [0076.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.119] GetFileType (hFile=0x154) returned 0x1 [0076.119] WriteFile (in: hFile=0x154, lpBuffer=0x1a6285c*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a6285c*, lpNumberOfBytesWritten=0x2ae554*=0x9560, lpOverlapped=0x0) returned 1 [0076.121] CloseHandle (hObject=0x154) returned 1 [0076.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", lpFilePart=0x0) returned 0x3f [0076.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8baa5070, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc5034d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9560)) returned 1 [0076.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.anonymous")) returned 1 [0076.122] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", lpFilePart=0x0) returned 0x3f [0076.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.123] GetFileType (hFile=0x154) returned 0x1 [0076.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.123] GetFileType (hFile=0x154) returned 0x1 [0076.123] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6b01 [0076.123] ReadFile (in: hFile=0x154, lpBuffer=0x1a6c1c8, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a6c1c8*, lpNumberOfBytesRead=0x2ae560*=0x6b01, lpOverlapped=0x0) returned 1 [0076.125] CloseHandle (hObject=0x154) returned 1 [0076.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", lpFilePart=0x0) returned 0x3f [0076.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.139] GetFileType (hFile=0x154) returned 0x1 [0076.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.139] GetFileType (hFile=0x154) returned 0x1 [0076.139] WriteFile (in: hFile=0x154, lpBuffer=0x1ada704*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ada704*, lpNumberOfBytesWritten=0x2ae554*=0x6b10, lpOverlapped=0x0) returned 1 [0076.141] CloseHandle (hObject=0x154) returned 1 [0076.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", lpFilePart=0x0) returned 0x3f [0076.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.141] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b540090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc529630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6b10)) returned 1 [0076.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.anonymous")) returned 1 [0076.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", lpFilePart=0x0) returned 0x3f [0076.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.143] GetFileType (hFile=0x154) returned 0x1 [0076.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.143] GetFileType (hFile=0x154) returned 0x1 [0076.143] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xfd22 [0076.143] ReadFile (in: hFile=0x154, lpBuffer=0x1ae1620, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ae1620*, lpNumberOfBytesRead=0x2ae560*=0xfd22, lpOverlapped=0x0) returned 1 [0076.165] CloseHandle (hObject=0x154) returned 1 [0076.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", lpFilePart=0x0) returned 0x3f [0076.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.182] GetFileType (hFile=0x154) returned 0x1 [0076.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.182] GetFileType (hFile=0x154) returned 0x1 [0076.182] WriteFile (in: hFile=0x154, lpBuffer=0x1b5dbb0*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b5dbb0*, lpNumberOfBytesWritten=0x2ae554*=0xfd30, lpOverlapped=0x0) returned 1 [0076.184] CloseHandle (hObject=0x154) returned 1 [0076.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", lpFilePart=0x0) returned 0x3f [0076.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.185] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37a600, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8baa5070, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc59ba50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfd30)) returned 1 [0076.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.anonymous")) returned 1 [0076.185] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", lpFilePart=0x0) returned 0x3f [0076.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.186] GetFileType (hFile=0x154) returned 0x1 [0076.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.186] GetFileType (hFile=0x154) returned 0x1 [0076.186] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb594 [0076.186] ReadFile (in: hFile=0x154, lpBuffer=0x1b6e3dc, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b6e3dc*, lpNumberOfBytesRead=0x2ae560*=0xb594, lpOverlapped=0x0) returned 1 [0076.204] CloseHandle (hObject=0x154) returned 1 [0076.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", lpFilePart=0x0) returned 0x3f [0076.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.221] GetFileType (hFile=0x154) returned 0x1 [0076.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.221] GetFileType (hFile=0x154) returned 0x1 [0076.221] WriteFile (in: hFile=0x154, lpBuffer=0x1bdd2b8*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1bdd2b8*, lpNumberOfBytesWritten=0x2ae554*=0xb5a0, lpOverlapped=0x0) returned 1 [0076.223] CloseHandle (hObject=0x154) returned 1 [0076.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", lpFilePart=0x0) returned 0x3f [0076.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.223] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5d8610, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc5e7d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0)) returned 1 [0076.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.anonymous")) returned 1 [0076.224] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", lpFilePart=0x0) returned 0x3f [0076.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.225] GetFileType (hFile=0x154) returned 0x1 [0076.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.225] GetFileType (hFile=0x154) returned 0x1 [0076.225] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6196 [0076.225] ReadFile (in: hFile=0x154, lpBuffer=0x1be8d3c, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1be8d3c*, lpNumberOfBytesRead=0x2ae560*=0x6196, lpOverlapped=0x0) returned 1 [0076.226] CloseHandle (hObject=0x154) returned 1 [0076.265] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", lpFilePart=0x0) returned 0x3f [0076.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.266] GetFileType (hFile=0x154) returned 0x1 [0076.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.267] GetFileType (hFile=0x154) returned 0x1 [0076.267] WriteFile (in: hFile=0x154, lpBuffer=0x1a060e4*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a060e4*, lpNumberOfBytesWritten=0x2ae554*=0x61a0, lpOverlapped=0x0) returned 1 [0076.268] CloseHandle (hObject=0x154) returned 1 [0076.268] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", lpFilePart=0x0) returned 0x3f [0076.268] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.268] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5d8610, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc65a130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x61a0)) returned 1 [0076.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.anonymous")) returned 1 [0076.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", lpFilePart=0x0) returned 0x3f [0076.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.269] GetFileType (hFile=0x154) returned 0x1 [0076.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.269] GetFileType (hFile=0x154) returned 0x1 [0076.269] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb57d [0076.269] ReadFile (in: hFile=0x154, lpBuffer=0x1a0c690, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0c690*, lpNumberOfBytesRead=0x2ae560*=0xb57d, lpOverlapped=0x0) returned 1 [0076.271] CloseHandle (hObject=0x154) returned 1 [0076.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", lpFilePart=0x0) returned 0x3f [0076.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.288] GetFileType (hFile=0x154) returned 0x1 [0076.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.288] GetFileType (hFile=0x154) returned 0x1 [0076.288] WriteFile (in: hFile=0x154, lpBuffer=0x1a7b66c*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a7b66c*, lpNumberOfBytesWritten=0x2ae554*=0xb580, lpOverlapped=0x0) returned 1 [0076.290] CloseHandle (hObject=0x154) returned 1 [0076.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", lpFilePart=0x0) returned 0x3f [0076.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.290] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5d8610, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc6a63f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb580)) returned 1 [0076.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.anonymous")) returned 1 [0076.291] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", lpFilePart=0x0) returned 0x3f [0076.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.291] GetFileType (hFile=0x154) returned 0x1 [0076.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.292] GetFileType (hFile=0x154) returned 0x1 [0076.292] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x38d8 [0076.292] ReadFile (in: hFile=0x154, lpBuffer=0x1a86ff8, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a86ff8*, lpNumberOfBytesRead=0x2ae560*=0x38d8, lpOverlapped=0x0) returned 1 [0076.293] CloseHandle (hObject=0x154) returned 1 [0076.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", lpFilePart=0x0) returned 0x3f [0076.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.308] GetFileType (hFile=0x154) returned 0x1 [0076.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.308] GetFileType (hFile=0x154) returned 0x1 [0076.308] WriteFile (in: hFile=0x154, lpBuffer=0x1ae5a40*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ae5a40*, lpNumberOfBytesWritten=0x2ae554*=0x38e0, lpOverlapped=0x0) returned 1 [0076.310] CloseHandle (hObject=0x154) returned 1 [0076.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", lpFilePart=0x0) returned 0x3f [0076.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.310] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5d8610, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc6cc550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x38e0)) returned 1 [0076.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.anonymous")) returned 1 [0076.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", lpFilePart=0x0) returned 0x3f [0076.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.311] GetFileType (hFile=0x154) returned 0x1 [0076.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.311] GetFileType (hFile=0x154) returned 0x1 [0076.311] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb12e [0076.311] ReadFile (in: hFile=0x154, lpBuffer=0x1ae972c, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ae972c*, lpNumberOfBytesRead=0x2ae560*=0xb12e, lpOverlapped=0x0) returned 1 [0076.313] CloseHandle (hObject=0x154) returned 1 [0076.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", lpFilePart=0x0) returned 0x3f [0076.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.328] GetFileType (hFile=0x154) returned 0x1 [0076.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.328] GetFileType (hFile=0x154) returned 0x1 [0076.328] WriteFile (in: hFile=0x154, lpBuffer=0x1b578bc*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b578bc*, lpNumberOfBytesWritten=0x2ae554*=0xb130, lpOverlapped=0x0) returned 1 [0076.330] CloseHandle (hObject=0x154) returned 1 [0076.330] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", lpFilePart=0x0) returned 0x3f [0076.330] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.331] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5d8610, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc6f26b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb130)) returned 1 [0076.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.anonymous")) returned 1 [0076.331] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", lpFilePart=0x0) returned 0x3f [0076.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.332] GetFileType (hFile=0x154) returned 0x1 [0076.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.332] GetFileType (hFile=0x154) returned 0x1 [0076.332] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd902 [0076.332] ReadFile (in: hFile=0x154, lpBuffer=0x1b62df8, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b62df8*, lpNumberOfBytesRead=0x2ae560*=0xd902, lpOverlapped=0x0) returned 1 [0076.334] CloseHandle (hObject=0x154) returned 1 [0076.376] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", lpFilePart=0x0) returned 0x3f [0076.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.378] GetFileType (hFile=0x154) returned 0x1 [0076.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.378] GetFileType (hFile=0x154) returned 0x1 [0076.378] WriteFile (in: hFile=0x154, lpBuffer=0x19dfee0*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19dfee0*, lpNumberOfBytesWritten=0x2ae554*=0xd910, lpOverlapped=0x0) returned 1 [0076.380] CloseHandle (hObject=0x154) returned 1 [0076.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", lpFilePart=0x0) returned 0x3f [0076.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.380] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bb17490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc764ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd910)) returned 1 [0076.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.anonymous")) returned 1 [0076.381] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", lpFilePart=0x0) returned 0x3f [0076.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.381] GetFileType (hFile=0x154) returned 0x1 [0076.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.381] GetFileType (hFile=0x154) returned 0x1 [0076.381] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x907d [0076.381] ReadFile (in: hFile=0x154, lpBuffer=0x19edbfc, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19edbfc*, lpNumberOfBytesRead=0x2ae560*=0x907d, lpOverlapped=0x0) returned 1 [0076.383] CloseHandle (hObject=0x154) returned 1 [0076.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", lpFilePart=0x0) returned 0x3f [0076.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.399] GetFileType (hFile=0x154) returned 0x1 [0076.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.399] GetFileType (hFile=0x154) returned 0x1 [0076.399] WriteFile (in: hFile=0x154, lpBuffer=0x1a67dc4*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a67dc4*, lpNumberOfBytesWritten=0x2ae554*=0x9080, lpOverlapped=0x0) returned 1 [0076.400] CloseHandle (hObject=0x154) returned 1 [0076.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", lpFilePart=0x0) returned 0x3f [0076.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.401] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5fe770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc7b0d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9080)) returned 1 [0076.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.anonymous")) returned 1 [0076.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", lpFilePart=0x0) returned 0x3f [0076.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.402] GetFileType (hFile=0x154) returned 0x1 [0076.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.402] GetFileType (hFile=0x154) returned 0x1 [0076.402] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7214 [0076.402] ReadFile (in: hFile=0x154, lpBuffer=0x1a71250, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a71250*, lpNumberOfBytesRead=0x2ae560*=0x7214, lpOverlapped=0x0) returned 1 [0076.404] CloseHandle (hObject=0x154) returned 1 [0076.417] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", lpFilePart=0x0) returned 0x3f [0076.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.418] GetFileType (hFile=0x154) returned 0x1 [0076.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.418] GetFileType (hFile=0x154) returned 0x1 [0076.418] WriteFile (in: hFile=0x154, lpBuffer=0x1ae1ad8*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ae1ad8*, lpNumberOfBytesWritten=0x2ae554*=0x7220, lpOverlapped=0x0) returned 1 [0076.420] CloseHandle (hObject=0x154) returned 1 [0076.420] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", lpFilePart=0x0) returned 0x3f [0076.420] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.420] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bb17490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc7d6ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7220)) returned 1 [0076.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.anonymous")) returned 1 [0076.421] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", lpFilePart=0x0) returned 0x3f [0076.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.421] GetFileType (hFile=0x154) returned 0x1 [0076.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.421] GetFileType (hFile=0x154) returned 0x1 [0076.421] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x67a3 [0076.421] ReadFile (in: hFile=0x154, lpBuffer=0x1ae9104, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ae9104*, lpNumberOfBytesRead=0x2ae560*=0x67a3, lpOverlapped=0x0) returned 1 [0076.423] CloseHandle (hObject=0x154) returned 1 [0076.437] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", lpFilePart=0x0) returned 0x3f [0076.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.438] GetFileType (hFile=0x154) returned 0x1 [0076.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.438] GetFileType (hFile=0x154) returned 0x1 [0076.438] WriteFile (in: hFile=0x154, lpBuffer=0x1b56560*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b56560*, lpNumberOfBytesWritten=0x2ae554*=0x67b0, lpOverlapped=0x0) returned 1 [0076.440] CloseHandle (hObject=0x154) returned 1 [0076.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", lpFilePart=0x0) returned 0x3f [0076.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.440] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x352e7200, ftCreationTime.dwHighDateTime=0x1c97c1a, ftLastAccessTime.dwLowDateTime=0x8bb17490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc7fd050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x67b0)) returned 1 [0076.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.anonymous")) returned 1 [0076.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", lpFilePart=0x0) returned 0x3f [0076.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.441] GetFileType (hFile=0x154) returned 0x1 [0076.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.441] GetFileType (hFile=0x154) returned 0x1 [0076.441] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5de2 [0076.441] ReadFile (in: hFile=0x154, lpBuffer=0x1b5d11c, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b5d11c*, lpNumberOfBytesRead=0x2ae560*=0x5de2, lpOverlapped=0x0) returned 1 [0076.443] CloseHandle (hObject=0x154) returned 1 [0076.458] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", lpFilePart=0x0) returned 0x3f [0076.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.459] GetFileType (hFile=0x154) returned 0x1 [0076.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.459] GetFileType (hFile=0x154) returned 0x1 [0076.459] WriteFile (in: hFile=0x154, lpBuffer=0x19c2740*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c2740*, lpNumberOfBytesWritten=0x2ae554*=0x5df0, lpOverlapped=0x0) returned 1 [0076.461] CloseHandle (hObject=0x154) returned 1 [0076.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", lpFilePart=0x0) returned 0x3f [0076.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.461] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5fe770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc8231b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5df0)) returned 1 [0076.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.anonymous")) returned 1 [0076.467] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", lpFilePart=0x0) returned 0x3f [0076.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.467] GetFileType (hFile=0x154) returned 0x1 [0076.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.467] GetFileType (hFile=0x154) returned 0x1 [0076.467] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5b2a [0076.467] ReadFile (in: hFile=0x154, lpBuffer=0x19c893c, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c893c*, lpNumberOfBytesRead=0x2ae560*=0x5b2a, lpOverlapped=0x0) returned 1 [0076.469] CloseHandle (hObject=0x154) returned 1 [0076.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", lpFilePart=0x0) returned 0x3f [0076.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.507] GetFileType (hFile=0x154) returned 0x1 [0076.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.507] GetFileType (hFile=0x154) returned 0x1 [0076.507] WriteFile (in: hFile=0x154, lpBuffer=0x1a32074*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a32074*, lpNumberOfBytesWritten=0x2ae554*=0x5b30, lpOverlapped=0x0) returned 1 [0076.509] CloseHandle (hObject=0x154) returned 1 [0076.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", lpFilePart=0x0) returned 0x3f [0076.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.509] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bb17490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc8bb730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b30)) returned 1 [0076.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.anonymous")) returned 1 [0076.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", lpFilePart=0x0) returned 0x3f [0076.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.510] GetFileType (hFile=0x154) returned 0x1 [0076.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.510] GetFileType (hFile=0x154) returned 0x1 [0076.510] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7d26 [0076.510] ReadFile (in: hFile=0x154, lpBuffer=0x1a37fb0, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a37fb0*, lpNumberOfBytesRead=0x2ae560*=0x7d26, lpOverlapped=0x0) returned 1 [0076.512] CloseHandle (hObject=0x154) returned 1 [0076.525] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", lpFilePart=0x0) returned 0x3f [0076.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.526] GetFileType (hFile=0x154) returned 0x1 [0076.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.526] GetFileType (hFile=0x154) returned 0x1 [0076.526] WriteFile (in: hFile=0x154, lpBuffer=0x1aabf8c*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aabf8c*, lpNumberOfBytesWritten=0x2ae554*=0x7d30, lpOverlapped=0x0) returned 1 [0076.528] CloseHandle (hObject=0x154) returned 1 [0076.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", lpFilePart=0x0) returned 0x3f [0076.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5fe770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc8e1890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d30)) returned 1 [0076.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.anonymous")) returned 1 [0076.529] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", lpFilePart=0x0) returned 0x3f [0076.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.529] GetFileType (hFile=0x154) returned 0x1 [0076.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.529] GetFileType (hFile=0x154) returned 0x1 [0076.529] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8a0c [0076.529] ReadFile (in: hFile=0x154, lpBuffer=0x1ab40c8, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab40c8*, lpNumberOfBytesRead=0x2ae560*=0x8a0c, lpOverlapped=0x0) returned 1 [0076.531] CloseHandle (hObject=0x154) returned 1 [0076.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", lpFilePart=0x0) returned 0x3f [0076.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.545] GetFileType (hFile=0x154) returned 0x1 [0076.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.545] GetFileType (hFile=0x154) returned 0x1 [0076.545] WriteFile (in: hFile=0x154, lpBuffer=0x1b2c100*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b2c100*, lpNumberOfBytesWritten=0x2ae554*=0x8a10, lpOverlapped=0x0) returned 1 [0076.547] CloseHandle (hObject=0x154) returned 1 [0076.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", lpFilePart=0x0) returned 0x3f [0076.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.547] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5fe770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc9079f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8a10)) returned 1 [0076.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.anonymous")) returned 1 [0076.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", lpFilePart=0x0) returned 0x3f [0076.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.548] GetFileType (hFile=0x154) returned 0x1 [0076.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.548] GetFileType (hFile=0x154) returned 0x1 [0076.548] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7d6e [0076.548] ReadFile (in: hFile=0x154, lpBuffer=0x1b34f1c, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b34f1c*, lpNumberOfBytesRead=0x2ae560*=0x7d6e, lpOverlapped=0x0) returned 1 [0076.550] CloseHandle (hObject=0x154) returned 1 [0076.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", lpFilePart=0x0) returned 0x3f [0076.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.565] GetFileType (hFile=0x154) returned 0x1 [0076.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.565] GetFileType (hFile=0x154) returned 0x1 [0076.565] WriteFile (in: hFile=0x154, lpBuffer=0x1ba9038*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ba9038*, lpNumberOfBytesWritten=0x2ae554*=0x7d70, lpOverlapped=0x0) returned 1 [0076.567] CloseHandle (hObject=0x154) returned 1 [0076.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", lpFilePart=0x0) returned 0x3f [0076.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.567] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b5fe770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc92db50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d70)) returned 1 [0076.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.anonymous")) returned 1 [0076.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", lpFilePart=0x0) returned 0x3f [0076.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.568] GetFileType (hFile=0x154) returned 0x1 [0076.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.568] GetFileType (hFile=0x154) returned 0x1 [0076.568] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x40e7 [0076.568] ReadFile (in: hFile=0x154, lpBuffer=0x1bb11b4, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1bb11b4*, lpNumberOfBytesRead=0x2ae560*=0x40e7, lpOverlapped=0x0) returned 1 [0076.570] CloseHandle (hObject=0x154) returned 1 [0076.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", lpFilePart=0x0) returned 0x3f [0076.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.609] GetFileType (hFile=0x154) returned 0x1 [0076.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.609] GetFileType (hFile=0x154) returned 0x1 [0076.610] WriteFile (in: hFile=0x154, lpBuffer=0x1a0a5b4*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a0a5b4*, lpNumberOfBytesWritten=0x2ae554*=0x40f0, lpOverlapped=0x0) returned 1 [0076.611] CloseHandle (hObject=0x154) returned 1 [0076.611] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", lpFilePart=0x0) returned 0x3f [0076.611] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.611] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb68d300, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bb17490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc99ff70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40f0)) returned 1 [0076.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.anonymous")) returned 1 [0076.612] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", lpFilePart=0x0) returned 0x3f [0076.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.613] GetFileType (hFile=0x154) returned 0x1 [0076.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.613] GetFileType (hFile=0x154) returned 0x1 [0076.613] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa50e [0076.613] ReadFile (in: hFile=0x154, lpBuffer=0x1a0f4b8, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0f4b8*, lpNumberOfBytesRead=0x2ae560*=0xa50e, lpOverlapped=0x0) returned 1 [0076.615] CloseHandle (hObject=0x154) returned 1 [0076.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", lpFilePart=0x0) returned 0x3f [0076.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.632] GetFileType (hFile=0x154) returned 0x1 [0076.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.632] GetFileType (hFile=0x154) returned 0x1 [0076.632] WriteFile (in: hFile=0x154, lpBuffer=0x1a8fd50*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a8fd50*, lpNumberOfBytesWritten=0x2ae554*=0xa510, lpOverlapped=0x0) returned 1 [0076.634] CloseHandle (hObject=0x154) returned 1 [0076.634] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", lpFilePart=0x0) returned 0x3f [0076.634] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.634] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bbafa10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcc9ec230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa510)) returned 1 [0076.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.anonymous")) returned 1 [0076.635] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", lpFilePart=0x0) returned 0x3f [0076.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.635] GetFileType (hFile=0x154) returned 0x1 [0076.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.635] GetFileType (hFile=0x154) returned 0x1 [0076.635] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa783 [0076.635] ReadFile (in: hFile=0x154, lpBuffer=0x1a9a7ec, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a9a7ec*, lpNumberOfBytesRead=0x2ae560*=0xa783, lpOverlapped=0x0) returned 1 [0076.646] CloseHandle (hObject=0x154) returned 1 [0076.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", lpFilePart=0x0) returned 0x3f [0076.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.662] GetFileType (hFile=0x154) returned 0x1 [0076.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.662] GetFileType (hFile=0x154) returned 0x1 [0076.662] WriteFile (in: hFile=0x154, lpBuffer=0x1b06c9c*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b06c9c*, lpNumberOfBytesWritten=0x2ae554*=0xa790, lpOverlapped=0x0) returned 1 [0076.664] CloseHandle (hObject=0x154) returned 1 [0076.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", lpFilePart=0x0) returned 0x3f [0076.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.664] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bbd5b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcca12390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa790)) returned 1 [0076.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.anonymous")) returned 1 [0076.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", lpFilePart=0x0) returned 0x3f [0076.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.665] GetFileType (hFile=0x154) returned 0x1 [0076.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.665] GetFileType (hFile=0x154) returned 0x1 [0076.665] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5474 [0076.665] ReadFile (in: hFile=0x154, lpBuffer=0x1b11838, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b11838*, lpNumberOfBytesRead=0x2ae560*=0x5474, lpOverlapped=0x0) returned 1 [0076.690] CloseHandle (hObject=0x154) returned 1 [0076.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", lpFilePart=0x0) returned 0x3f [0076.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.706] GetFileType (hFile=0x154) returned 0x1 [0076.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.707] GetFileType (hFile=0x154) returned 0x1 [0076.707] WriteFile (in: hFile=0x154, lpBuffer=0x1b78ca0*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b78ca0*, lpNumberOfBytesWritten=0x2ae554*=0x5480, lpOverlapped=0x0) returned 1 [0076.708] CloseHandle (hObject=0x154) returned 1 [0076.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", lpFilePart=0x0) returned 0x3f [0076.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.709] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b72f270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcca847b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5480)) returned 1 [0076.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.anonymous")) returned 1 [0076.710] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", lpFilePart=0x0) returned 0x3f [0076.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.710] GetFileType (hFile=0x154) returned 0x1 [0076.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.710] GetFileType (hFile=0x154) returned 0x1 [0076.710] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8ad6 [0076.710] ReadFile (in: hFile=0x154, lpBuffer=0x1b7e5ec, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b7e5ec*, lpNumberOfBytesRead=0x2ae560*=0x8ad6, lpOverlapped=0x0) returned 1 [0076.731] CloseHandle (hObject=0x154) returned 1 [0076.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", lpFilePart=0x0) returned 0x3f [0076.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.776] GetFileType (hFile=0x154) returned 0x1 [0076.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.776] GetFileType (hFile=0x154) returned 0x1 [0076.776] WriteFile (in: hFile=0x154, lpBuffer=0x19fb3ec*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19fb3ec*, lpNumberOfBytesWritten=0x2ae554*=0x8ae0, lpOverlapped=0x0) returned 1 [0076.778] CloseHandle (hObject=0x154) returned 1 [0076.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", lpFilePart=0x0) returned 0x3f [0076.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.778] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bbd5b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccb42e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8ae0)) returned 1 [0076.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.anonymous")) returned 1 [0076.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", lpFilePart=0x0) returned 0x3f [0076.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.780] GetFileType (hFile=0x154) returned 0x1 [0076.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.780] GetFileType (hFile=0x154) returned 0x1 [0076.780] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe2e9 [0076.780] ReadFile (in: hFile=0x154, lpBuffer=0x1a042d8, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a042d8*, lpNumberOfBytesRead=0x2ae560*=0xe2e9, lpOverlapped=0x0) returned 1 [0076.801] CloseHandle (hObject=0x154) returned 1 [0076.816] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", lpFilePart=0x0) returned 0x3f [0076.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.818] GetFileType (hFile=0x154) returned 0x1 [0076.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.818] GetFileType (hFile=0x154) returned 0x1 [0076.818] WriteFile (in: hFile=0x154, lpBuffer=0x1a7bb04*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a7bb04*, lpNumberOfBytesWritten=0x2ae554*=0xe2f0, lpOverlapped=0x0) returned 1 [0076.820] CloseHandle (hObject=0x154) returned 1 [0076.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", lpFilePart=0x0) returned 0x3f [0076.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b7553d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccbb52b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe2f0)) returned 1 [0076.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.anonymous")) returned 1 [0076.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", lpFilePart=0x0) returned 0x3f [0076.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.822] GetFileType (hFile=0x154) returned 0x1 [0076.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.822] GetFileType (hFile=0x154) returned 0x1 [0076.822] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x89a4 [0076.822] ReadFile (in: hFile=0x154, lpBuffer=0x1a8a9e0, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a8a9e0*, lpNumberOfBytesRead=0x2ae560*=0x89a4, lpOverlapped=0x0) returned 1 [0076.840] CloseHandle (hObject=0x154) returned 1 [0076.852] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", lpFilePart=0x0) returned 0x3f [0076.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.854] GetFileType (hFile=0x154) returned 0x1 [0076.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.854] GetFileType (hFile=0x154) returned 0x1 [0076.854] WriteFile (in: hFile=0x154, lpBuffer=0x1b02838*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b02838*, lpNumberOfBytesWritten=0x2ae554*=0x89b0, lpOverlapped=0x0) returned 1 [0076.856] CloseHandle (hObject=0x154) returned 1 [0076.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", lpFilePart=0x0) returned 0x3f [0076.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.856] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x176b7200, ftCreationTime.dwHighDateTime=0x1bf594b, ftLastAccessTime.dwLowDateTime=0x8bc94250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccc01570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x89b0)) returned 1 [0076.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.anonymous")) returned 1 [0076.857] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", lpFilePart=0x0) returned 0x3f [0076.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.857] GetFileType (hFile=0x154) returned 0x1 [0076.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.857] GetFileType (hFile=0x154) returned 0x1 [0076.857] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x42d1 [0076.857] ReadFile (in: hFile=0x154, lpBuffer=0x1b0b5f4, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0b5f4*, lpNumberOfBytesRead=0x2ae560*=0x42d1, lpOverlapped=0x0) returned 1 [0076.859] CloseHandle (hObject=0x154) returned 1 [0076.885] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", lpFilePart=0x0) returned 0x3f [0076.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.886] GetFileType (hFile=0x154) returned 0x1 [0076.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.886] GetFileType (hFile=0x154) returned 0x1 [0076.886] WriteFile (in: hFile=0x154, lpBuffer=0x1b6d240*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b6d240*, lpNumberOfBytesWritten=0x2ae554*=0x42e0, lpOverlapped=0x0) returned 1 [0076.888] CloseHandle (hObject=0x154) returned 1 [0076.888] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", lpFilePart=0x0) returned 0x3f [0076.888] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.888] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c08f000, ftCreationTime.dwHighDateTime=0x1bf593f, ftLastAccessTime.dwLowDateTime=0x8bc94250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccc4d830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x42e0)) returned 1 [0076.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.anonymous")) returned 1 [0076.889] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", lpFilePart=0x0) returned 0x3f [0076.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.889] GetFileType (hFile=0x154) returned 0x1 [0076.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.889] GetFileType (hFile=0x154) returned 0x1 [0076.889] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3e91 [0076.890] ReadFile (in: hFile=0x154, lpBuffer=0x1b7192c, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b7192c*, lpNumberOfBytesRead=0x2ae560*=0x3e91, lpOverlapped=0x0) returned 1 [0076.901] CloseHandle (hObject=0x154) returned 1 [0076.950] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", lpFilePart=0x0) returned 0x3f [0076.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.952] GetFileType (hFile=0x154) returned 0x1 [0076.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.952] GetFileType (hFile=0x154) returned 0x1 [0076.952] WriteFile (in: hFile=0x154, lpBuffer=0x19cd438*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19cd438*, lpNumberOfBytesWritten=0x2ae554*=0x3ea0, lpOverlapped=0x0) returned 1 [0076.953] CloseHandle (hObject=0x154) returned 1 [0076.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", lpFilePart=0x0) returned 0x3f [0076.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ad7c300, ftCreationTime.dwHighDateTime=0x1bf593f, ftLastAccessTime.dwLowDateTime=0x8bcba3b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccce5db0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ea0)) returned 1 [0076.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.anonymous")) returned 1 [0076.954] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", lpFilePart=0x0) returned 0x3f [0076.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.955] GetFileType (hFile=0x154) returned 0x1 [0076.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.955] GetFileType (hFile=0x154) returned 0x1 [0076.955] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x43c5 [0076.955] ReadFile (in: hFile=0x154, lpBuffer=0x19d16e4, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19d16e4*, lpNumberOfBytesRead=0x2ae560*=0x43c5, lpOverlapped=0x0) returned 1 [0076.956] CloseHandle (hObject=0x154) returned 1 [0076.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", lpFilePart=0x0) returned 0x3f [0076.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.970] GetFileType (hFile=0x154) returned 0x1 [0076.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.970] GetFileType (hFile=0x154) returned 0x1 [0076.970] WriteFile (in: hFile=0x154, lpBuffer=0x1a3393c*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a3393c*, lpNumberOfBytesWritten=0x2ae554*=0x43d0, lpOverlapped=0x0) returned 1 [0076.972] CloseHandle (hObject=0x154) returned 1 [0076.972] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", lpFilePart=0x0) returned 0x3f [0076.972] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.972] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ad7c300, ftCreationTime.dwHighDateTime=0x1bf593f, ftLastAccessTime.dwLowDateTime=0x8bcba3b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccd0bf10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x43d0)) returned 1 [0076.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.anonymous")) returned 1 [0076.973] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", lpFilePart=0x0) returned 0x3f [0076.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.973] GetFileType (hFile=0x154) returned 0x1 [0076.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.973] GetFileType (hFile=0x154) returned 0x1 [0076.973] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8d86 [0076.973] ReadFile (in: hFile=0x154, lpBuffer=0x1a38118, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a38118*, lpNumberOfBytesRead=0x2ae560*=0x8d86, lpOverlapped=0x0) returned 1 [0076.975] CloseHandle (hObject=0x154) returned 1 [0076.987] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", lpFilePart=0x0) returned 0x3f [0076.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0076.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.989] GetFileType (hFile=0x154) returned 0x1 [0076.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0076.989] GetFileType (hFile=0x154) returned 0x1 [0076.989] WriteFile (in: hFile=0x154, lpBuffer=0x1ab12d4*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ab12d4*, lpNumberOfBytesWritten=0x2ae554*=0x8d90, lpOverlapped=0x0) returned 1 [0076.990] CloseHandle (hObject=0x154) returned 1 [0076.990] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", lpFilePart=0x0) returned 0x3f [0076.990] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0076.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0076.991] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ad7c300, ftCreationTime.dwHighDateTime=0x1bf593f, ftLastAccessTime.dwLowDateTime=0x8bcba3b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccd32070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8d90)) returned 1 [0076.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0076.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.anonymous")) returned 1 [0076.991] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", lpFilePart=0x0) returned 0x3f [0076.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0076.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0076.991] GetFileType (hFile=0x154) returned 0x1 [0076.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0076.992] GetFileType (hFile=0x154) returned 0x1 [0076.992] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2d21 [0076.992] ReadFile (in: hFile=0x154, lpBuffer=0x1aba470, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aba470*, lpNumberOfBytesRead=0x2ae560*=0x2d21, lpOverlapped=0x0) returned 1 [0076.993] CloseHandle (hObject=0x154) returned 1 [0077.005] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", lpFilePart=0x0) returned 0x3f [0077.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.007] GetFileType (hFile=0x154) returned 0x1 [0077.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.007] GetFileType (hFile=0x154) returned 0x1 [0077.007] WriteFile (in: hFile=0x154, lpBuffer=0x1b1544c*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b1544c*, lpNumberOfBytesWritten=0x2ae554*=0x2d30, lpOverlapped=0x0) returned 1 [0077.008] CloseHandle (hObject=0x154) returned 1 [0077.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", lpFilePart=0x0) returned 0x3f [0077.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.008] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bcba3b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccd7e330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d30)) returned 1 [0077.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.anonymous")) returned 1 [0077.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", lpFilePart=0x0) returned 0x3f [0077.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.009] GetFileType (hFile=0x154) returned 0x1 [0077.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.010] GetFileType (hFile=0x154) returned 0x1 [0077.010] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x29c4 [0077.010] ReadFile (in: hFile=0x154, lpBuffer=0x1b18870, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b18870*, lpNumberOfBytesRead=0x2ae560*=0x29c4, lpOverlapped=0x0) returned 1 [0077.011] CloseHandle (hObject=0x154) returned 1 [0077.023] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", lpFilePart=0x0) returned 0x3f [0077.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.025] GetFileType (hFile=0x154) returned 0x1 [0077.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.025] GetFileType (hFile=0x154) returned 0x1 [0077.025] WriteFile (in: hFile=0x154, lpBuffer=0x1b72768*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b72768*, lpNumberOfBytesWritten=0x2ae554*=0x29d0, lpOverlapped=0x0) returned 1 [0077.026] CloseHandle (hObject=0x154) returned 1 [0077.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", lpFilePart=0x0) returned 0x3f [0077.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.026] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd06670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccda4490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x29d0)) returned 1 [0077.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.anonymous")) returned 1 [0077.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", lpFilePart=0x0) returned 0x3f [0077.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.028] GetFileType (hFile=0x154) returned 0x1 [0077.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.028] GetFileType (hFile=0x154) returned 0x1 [0077.028] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x544c [0077.028] ReadFile (in: hFile=0x154, lpBuffer=0x1b75544, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b75544*, lpNumberOfBytesRead=0x2ae560*=0x544c, lpOverlapped=0x0) returned 1 [0077.030] CloseHandle (hObject=0x154) returned 1 [0077.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", lpFilePart=0x0) returned 0x3f [0077.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.075] GetFileType (hFile=0x154) returned 0x1 [0077.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.075] GetFileType (hFile=0x154) returned 0x1 [0077.075] WriteFile (in: hFile=0x154, lpBuffer=0x19dde80*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19dde80*, lpNumberOfBytesWritten=0x2ae554*=0x5450, lpOverlapped=0x0) returned 1 [0077.076] CloseHandle (hObject=0x154) returned 1 [0077.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", lpFilePart=0x0) returned 0x3f [0077.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.077] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd06670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcce168b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5450)) returned 1 [0077.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.anonymous")) returned 1 [0077.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", lpFilePart=0x0) returned 0x3f [0077.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.077] GetFileType (hFile=0x154) returned 0x1 [0077.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.078] GetFileType (hFile=0x154) returned 0x1 [0077.078] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9a8b [0077.078] ReadFile (in: hFile=0x154, lpBuffer=0x19e36dc, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e36dc*, lpNumberOfBytesRead=0x2ae560*=0x9a8b, lpOverlapped=0x0) returned 1 [0077.083] CloseHandle (hObject=0x154) returned 1 [0077.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", lpFilePart=0x0) returned 0x3f [0077.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.099] GetFileType (hFile=0x154) returned 0x1 [0077.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.099] GetFileType (hFile=0x154) returned 0x1 [0077.099] WriteFile (in: hFile=0x154, lpBuffer=0x1a60af4*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a60af4*, lpNumberOfBytesWritten=0x2ae554*=0x9a90, lpOverlapped=0x0) returned 1 [0077.100] CloseHandle (hObject=0x154) returned 1 [0077.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", lpFilePart=0x0) returned 0x3f [0077.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.100] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcce3ca10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a90)) returned 1 [0077.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.anonymous")) returned 1 [0077.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", lpFilePart=0x0) returned 0x3f [0077.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.102] GetFileType (hFile=0x154) returned 0x1 [0077.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.102] GetFileType (hFile=0x154) returned 0x1 [0077.102] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x81f0 [0077.102] ReadFile (in: hFile=0x154, lpBuffer=0x1a6a990, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a6a990*, lpNumberOfBytesRead=0x2ae560*=0x81f0, lpOverlapped=0x0) returned 1 [0077.104] CloseHandle (hObject=0x154) returned 1 [0077.117] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", lpFilePart=0x0) returned 0x3f [0077.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.118] GetFileType (hFile=0x154) returned 0x1 [0077.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.118] GetFileType (hFile=0x154) returned 0x1 [0077.118] WriteFile (in: hFile=0x154, lpBuffer=0x1ae0178*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ae0178*, lpNumberOfBytesWritten=0x2ae554*=0x8200, lpOverlapped=0x0) returned 1 [0077.120] CloseHandle (hObject=0x154) returned 1 [0077.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", lpFilePart=0x0) returned 0x3f [0077.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.120] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcce88cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8200)) returned 1 [0077.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.anonymous")) returned 1 [0077.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", lpFilePart=0x0) returned 0x3f [0077.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.121] GetFileType (hFile=0x154) returned 0x1 [0077.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.121] GetFileType (hFile=0x154) returned 0x1 [0077.121] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xaabb [0077.121] ReadFile (in: hFile=0x154, lpBuffer=0x1ae8784, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ae8784*, lpNumberOfBytesRead=0x2ae560*=0xaabb, lpOverlapped=0x0) returned 1 [0077.123] CloseHandle (hObject=0x154) returned 1 [0077.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", lpFilePart=0x0) returned 0x3f [0077.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.139] GetFileType (hFile=0x154) returned 0x1 [0077.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.139] GetFileType (hFile=0x154) returned 0x1 [0077.139] WriteFile (in: hFile=0x154, lpBuffer=0x1b555c4*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b555c4*, lpNumberOfBytesWritten=0x2ae554*=0xaac0, lpOverlapped=0x0) returned 1 [0077.141] CloseHandle (hObject=0x154) returned 1 [0077.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", lpFilePart=0x0) returned 0x3f [0077.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.141] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a0000, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcceaee30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaac0)) returned 1 [0077.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.anonymous")) returned 1 [0077.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", lpFilePart=0x0) returned 0x3f [0077.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.142] GetFileType (hFile=0x154) returned 0x1 [0077.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.142] GetFileType (hFile=0x154) returned 0x1 [0077.142] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4ada [0077.142] ReadFile (in: hFile=0x154, lpBuffer=0x1b60490, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b60490*, lpNumberOfBytesRead=0x2ae560*=0x4ada, lpOverlapped=0x0) returned 1 [0077.143] CloseHandle (hObject=0x154) returned 1 [0077.177] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", lpFilePart=0x0) returned 0x3f [0077.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.179] GetFileType (hFile=0x154) returned 0x1 [0077.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.179] GetFileType (hFile=0x154) returned 0x1 [0077.179] WriteFile (in: hFile=0x154, lpBuffer=0x19c3f3c*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c3f3c*, lpNumberOfBytesWritten=0x2ae554*=0x4ae0, lpOverlapped=0x0) returned 1 [0077.180] CloseHandle (hObject=0x154) returned 1 [0077.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", lpFilePart=0x0) returned 0x3f [0077.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.181] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd06670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccf21250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ae0)) returned 1 [0077.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.anonymous")) returned 1 [0077.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", lpFilePart=0x0) returned 0x3f [0077.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.182] GetFileType (hFile=0x154) returned 0x1 [0077.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.182] GetFileType (hFile=0x154) returned 0x1 [0077.182] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x911a [0077.182] ReadFile (in: hFile=0x154, lpBuffer=0x19c8e70, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c8e70*, lpNumberOfBytesRead=0x2ae560*=0x911a, lpOverlapped=0x0) returned 1 [0077.184] CloseHandle (hObject=0x154) returned 1 [0077.200] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", lpFilePart=0x0) returned 0x3f [0077.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.202] GetFileType (hFile=0x154) returned 0x1 [0077.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.202] GetFileType (hFile=0x154) returned 0x1 [0077.202] WriteFile (in: hFile=0x154, lpBuffer=0x1a43358*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a43358*, lpNumberOfBytesWritten=0x2ae554*=0x9120, lpOverlapped=0x0) returned 1 [0077.204] CloseHandle (hObject=0x154) returned 1 [0077.204] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", lpFilePart=0x0) returned 0x3f [0077.204] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.204] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f389100, ftCreationTime.dwHighDateTime=0x1c97c1a, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccf473b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9120)) returned 1 [0077.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.anonymous")) returned 1 [0077.205] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", lpFilePart=0x0) returned 0x3f [0077.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.205] GetFileType (hFile=0x154) returned 0x1 [0077.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.205] GetFileType (hFile=0x154) returned 0x1 [0077.205] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa75a [0077.205] ReadFile (in: hFile=0x154, lpBuffer=0x1a4c884, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a4c884*, lpNumberOfBytesRead=0x2ae560*=0xa75a, lpOverlapped=0x0) returned 1 [0077.207] CloseHandle (hObject=0x154) returned 1 [0077.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", lpFilePart=0x0) returned 0x3f [0077.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.222] GetFileType (hFile=0x154) returned 0x1 [0077.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.222] GetFileType (hFile=0x154) returned 0x1 [0077.222] WriteFile (in: hFile=0x154, lpBuffer=0x1ab8ca4*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ab8ca4*, lpNumberOfBytesWritten=0x2ae554*=0xa760, lpOverlapped=0x0) returned 1 [0077.224] CloseHandle (hObject=0x154) returned 1 [0077.224] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", lpFilePart=0x0) returned 0x3f [0077.224] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b09700, ftCreationTime.dwHighDateTime=0x1c97c1a, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccf6d510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa760)) returned 1 [0077.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.anonymous")) returned 1 [0077.225] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", lpFilePart=0x0) returned 0x3f [0077.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.225] GetFileType (hFile=0x154) returned 0x1 [0077.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.225] GetFileType (hFile=0x154) returned 0x1 [0077.225] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x81ab [0077.226] ReadFile (in: hFile=0x154, lpBuffer=0x1ac3810, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ac3810*, lpNumberOfBytesRead=0x2ae560*=0x81ab, lpOverlapped=0x0) returned 1 [0077.227] CloseHandle (hObject=0x154) returned 1 [0077.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", lpFilePart=0x0) returned 0x3f [0077.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.241] GetFileType (hFile=0x154) returned 0x1 [0077.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.242] GetFileType (hFile=0x154) returned 0x1 [0077.242] WriteFile (in: hFile=0x154, lpBuffer=0x1b38e6c*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b38e6c*, lpNumberOfBytesWritten=0x2ae554*=0x81b0, lpOverlapped=0x0) returned 1 [0077.243] CloseHandle (hObject=0x154) returned 1 [0077.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", lpFilePart=0x0) returned 0x3f [0077.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.244] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b20500, ftCreationTime.dwHighDateTime=0x1c97c19, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccfb97d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x81b0)) returned 1 [0077.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.anonymous")) returned 1 [0077.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", lpFilePart=0x0) returned 0x3f [0077.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.245] GetFileType (hFile=0x154) returned 0x1 [0077.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.245] GetFileType (hFile=0x154) returned 0x1 [0077.245] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb9d1 [0077.245] ReadFile (in: hFile=0x154, lpBuffer=0x1b41428, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b41428*, lpNumberOfBytesRead=0x2ae560*=0xb9d1, lpOverlapped=0x0) returned 1 [0077.247] CloseHandle (hObject=0x154) returned 1 [0077.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", lpFilePart=0x0) returned 0x3f [0077.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.265] GetFileType (hFile=0x154) returned 0x1 [0077.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.265] GetFileType (hFile=0x154) returned 0x1 [0077.265] WriteFile (in: hFile=0x154, lpBuffer=0x19b690c*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19b690c*, lpNumberOfBytesWritten=0x2ae554*=0xb9e0, lpOverlapped=0x0) returned 1 [0077.267] CloseHandle (hObject=0x154) returned 1 [0077.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", lpFilePart=0x0) returned 0x3f [0077.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.267] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23cdb00, ftCreationTime.dwHighDateTime=0x1c97c19, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xccfdf930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb9e0)) returned 1 [0077.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.anonymous")) returned 1 [0077.268] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", lpFilePart=0x0) returned 0x3f [0077.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.268] GetFileType (hFile=0x154) returned 0x1 [0077.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.268] GetFileType (hFile=0x154) returned 0x1 [0077.268] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x40f2 [0077.269] ReadFile (in: hFile=0x154, lpBuffer=0x19c26f8, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c26f8*, lpNumberOfBytesRead=0x2ae560*=0x40f2, lpOverlapped=0x0) returned 1 [0077.270] CloseHandle (hObject=0x154) returned 1 [0077.306] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", lpFilePart=0x0) returned 0x3f [0077.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.307] GetFileType (hFile=0x154) returned 0x1 [0077.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.308] GetFileType (hFile=0x154) returned 0x1 [0077.308] WriteFile (in: hFile=0x154, lpBuffer=0x1a23b40*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a23b40*, lpNumberOfBytesWritten=0x2ae554*=0x4100, lpOverlapped=0x0) returned 1 [0077.309] CloseHandle (hObject=0x154) returned 1 [0077.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", lpFilePart=0x0) returned 0x3f [0077.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.309] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51fec00, ftCreationTime.dwHighDateTime=0x1c97c19, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd051d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4100)) returned 1 [0077.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.anonymous")) returned 1 [0077.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", lpFilePart=0x0) returned 0x3f [0077.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.310] GetFileType (hFile=0x154) returned 0x1 [0077.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.310] GetFileType (hFile=0x154) returned 0x1 [0077.310] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4b02 [0077.310] ReadFile (in: hFile=0x154, lpBuffer=0x1a2804c, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a2804c*, lpNumberOfBytesRead=0x2ae560*=0x4b02, lpOverlapped=0x0) returned 1 [0077.312] CloseHandle (hObject=0x154) returned 1 [0077.324] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", lpFilePart=0x0) returned 0x3f [0077.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.326] GetFileType (hFile=0x154) returned 0x1 [0077.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.326] GetFileType (hFile=0x154) returned 0x1 [0077.326] WriteFile (in: hFile=0x154, lpBuffer=0x1a8c588*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a8c588*, lpNumberOfBytesWritten=0x2ae554*=0x4b10, lpOverlapped=0x0) returned 1 [0077.327] CloseHandle (hObject=0x154) returned 1 [0077.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", lpFilePart=0x0) returned 0x3f [0077.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.327] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b885ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd077eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4b10)) returned 1 [0077.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.anonymous")) returned 1 [0077.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", lpFilePart=0x0) returned 0x3f [0077.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.328] GetFileType (hFile=0x154) returned 0x1 [0077.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.328] GetFileType (hFile=0x154) returned 0x1 [0077.328] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x423a [0077.328] ReadFile (in: hFile=0x154, lpBuffer=0x1a914a4, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a914a4*, lpNumberOfBytesRead=0x2ae560*=0x423a, lpOverlapped=0x0) returned 1 [0077.330] CloseHandle (hObject=0x154) returned 1 [0077.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", lpFilePart=0x0) returned 0x3f [0077.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.345] GetFileType (hFile=0x154) returned 0x1 [0077.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.345] GetFileType (hFile=0x154) returned 0x1 [0077.346] WriteFile (in: hFile=0x154, lpBuffer=0x1af2dd0*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1af2dd0*, lpNumberOfBytesWritten=0x2ae554*=0x4240, lpOverlapped=0x0) returned 1 [0077.347] CloseHandle (hObject=0x154) returned 1 [0077.347] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", lpFilePart=0x0) returned 0x3f [0077.347] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.347] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8ac030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd09e010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4240)) returned 1 [0077.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.anonymous")) returned 1 [0077.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", lpFilePart=0x0) returned 0x3f [0077.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.348] GetFileType (hFile=0x154) returned 0x1 [0077.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.348] GetFileType (hFile=0x154) returned 0x1 [0077.348] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x24d7 [0077.348] ReadFile (in: hFile=0x154, lpBuffer=0x1af7464, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af7464*, lpNumberOfBytesRead=0x2ae560*=0x24d7, lpOverlapped=0x0) returned 1 [0077.350] CloseHandle (hObject=0x154) returned 1 [0077.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", lpFilePart=0x0) returned 0x3f [0077.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.363] GetFileType (hFile=0x154) returned 0x1 [0077.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.363] GetFileType (hFile=0x154) returned 0x1 [0077.363] WriteFile (in: hFile=0x154, lpBuffer=0x1b4fab0*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b4fab0*, lpNumberOfBytesWritten=0x2ae554*=0x24e0, lpOverlapped=0x0) returned 1 [0077.365] CloseHandle (hObject=0x154) returned 1 [0077.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", lpFilePart=0x0) returned 0x3f [0077.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.365] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd0c4170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24e0)) returned 1 [0077.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.anonymous")) returned 1 [0077.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpFilePart=0x0) returned 0x3f [0077.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.366] GetFileType (hFile=0x154) returned 0x1 [0077.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.366] GetFileType (hFile=0x154) returned 0x1 [0077.366] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3260 [0077.366] ReadFile (in: hFile=0x154, lpBuffer=0x1b523cc, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b523cc*, lpNumberOfBytesRead=0x2ae560*=0x3260, lpOverlapped=0x0) returned 1 [0077.368] CloseHandle (hObject=0x154) returned 1 [0077.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpFilePart=0x0) returned 0x3f [0077.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.381] GetFileType (hFile=0x154) returned 0x1 [0077.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.382] GetFileType (hFile=0x154) returned 0x1 [0077.382] WriteFile (in: hFile=0x154, lpBuffer=0x1baede4*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1baede4*, lpNumberOfBytesWritten=0x2ae554*=0x3270, lpOverlapped=0x0) returned 1 [0077.383] CloseHandle (hObject=0x154) returned 1 [0077.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", lpFilePart=0x0) returned 0x3f [0077.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8ac030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd110430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3270)) returned 1 [0077.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.anonymous")) returned 1 [0077.384] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpFilePart=0x0) returned 0x3f [0077.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.385] GetFileType (hFile=0x154) returned 0x1 [0077.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.385] GetFileType (hFile=0x154) returned 0x1 [0077.385] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x27d4 [0077.385] ReadFile (in: hFile=0x154, lpBuffer=0x1bb2460, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1bb2460*, lpNumberOfBytesRead=0x2ae560*=0x27d4, lpOverlapped=0x0) returned 1 [0077.386] CloseHandle (hObject=0x154) returned 1 [0077.425] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpFilePart=0x0) returned 0x3f [0077.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.426] GetFileType (hFile=0x154) returned 0x1 [0077.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.426] GetFileType (hFile=0x154) returned 0x1 [0077.426] WriteFile (in: hFile=0x154, lpBuffer=0x1a02478*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a02478*, lpNumberOfBytesWritten=0x2ae554*=0x27e0, lpOverlapped=0x0) returned 1 [0077.427] CloseHandle (hObject=0x154) returned 1 [0077.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", lpFilePart=0x0) returned 0x3f [0077.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.428] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd15c6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27e0)) returned 1 [0077.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.anonymous")) returned 1 [0077.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", lpFilePart=0x0) returned 0x3f [0077.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.429] GetFileType (hFile=0x154) returned 0x1 [0077.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.429] GetFileType (hFile=0x154) returned 0x1 [0077.429] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2cdd [0077.429] ReadFile (in: hFile=0x154, lpBuffer=0x1a05064, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a05064*, lpNumberOfBytesRead=0x2ae560*=0x2cdd, lpOverlapped=0x0) returned 1 [0077.430] CloseHandle (hObject=0x154) returned 1 [0077.443] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", lpFilePart=0x0) returned 0x3f [0077.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.444] GetFileType (hFile=0x154) returned 0x1 [0077.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.444] GetFileType (hFile=0x154) returned 0x1 [0077.444] WriteFile (in: hFile=0x154, lpBuffer=0x1a6000c*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a6000c*, lpNumberOfBytesWritten=0x2ae554*=0x2ce0, lpOverlapped=0x0) returned 1 [0077.445] CloseHandle (hObject=0x154) returned 1 [0077.445] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", lpFilePart=0x0) returned 0x3f [0077.445] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.445] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8ac030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd1a89b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ce0)) returned 1 [0077.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.anonymous")) returned 1 [0077.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", lpFilePart=0x0) returned 0x3f [0077.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.446] GetFileType (hFile=0x154) returned 0x1 [0077.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.446] GetFileType (hFile=0x154) returned 0x1 [0077.446] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4c6d [0077.446] ReadFile (in: hFile=0x154, lpBuffer=0x1a630f8, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a630f8*, lpNumberOfBytesRead=0x2ae560*=0x4c6d, lpOverlapped=0x0) returned 1 [0077.448] CloseHandle (hObject=0x154) returned 1 [0077.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", lpFilePart=0x0) returned 0x3f [0077.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.465] GetFileType (hFile=0x154) returned 0x1 [0077.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.465] GetFileType (hFile=0x154) returned 0x1 [0077.466] WriteFile (in: hFile=0x154, lpBuffer=0x1ac7d14*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ac7d14*, lpNumberOfBytesWritten=0x2ae554*=0x4c70, lpOverlapped=0x0) returned 1 [0077.467] CloseHandle (hObject=0x154) returned 1 [0077.467] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", lpFilePart=0x0) returned 0x3f [0077.467] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.467] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8ac030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd1ceb10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4c70)) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.anonymous")) returned 1 [0077.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpFilePart=0x0) returned 0x3f [0077.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.468] GetFileType (hFile=0x154) returned 0x1 [0077.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.468] GetFileType (hFile=0x154) returned 0x1 [0077.469] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4ad8 [0077.469] ReadFile (in: hFile=0x154, lpBuffer=0x1accd90, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1accd90*, lpNumberOfBytesRead=0x2ae560*=0x4ad8, lpOverlapped=0x0) returned 1 [0077.471] CloseHandle (hObject=0x154) returned 1 [0077.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpFilePart=0x0) returned 0x3f [0077.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.485] GetFileType (hFile=0x154) returned 0x1 [0077.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.485] GetFileType (hFile=0x154) returned 0x1 [0077.485] WriteFile (in: hFile=0x154, lpBuffer=0x1b311d8*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b311d8*, lpNumberOfBytesWritten=0x2ae554*=0x4ae0, lpOverlapped=0x0) returned 1 [0077.486] CloseHandle (hObject=0x154) returned 1 [0077.486] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", lpFilePart=0x0) returned 0x3f [0077.486] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.486] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8ac030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd1f4c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ae0)) returned 1 [0077.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.anonymous")) returned 1 [0077.487] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpFilePart=0x0) returned 0x3f [0077.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.487] GetFileType (hFile=0x154) returned 0x1 [0077.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.487] GetFileType (hFile=0x154) returned 0x1 [0077.487] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x52c3 [0077.487] ReadFile (in: hFile=0x154, lpBuffer=0x1b360c4, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b360c4*, lpNumberOfBytesRead=0x2ae560*=0x52c3, lpOverlapped=0x0) returned 1 [0077.489] CloseHandle (hObject=0x154) returned 1 [0077.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpFilePart=0x0) returned 0x3f [0077.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.504] GetFileType (hFile=0x154) returned 0x1 [0077.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.504] GetFileType (hFile=0x154) returned 0x1 [0077.504] WriteFile (in: hFile=0x154, lpBuffer=0x1b9ccc0*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b9ccc0*, lpNumberOfBytesWritten=0x2ae554*=0x52d0, lpOverlapped=0x0) returned 1 [0077.505] CloseHandle (hObject=0x154) returned 1 [0077.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", lpFilePart=0x0) returned 0x3f [0077.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.506] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8ac030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd21add0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x52d0)) returned 1 [0077.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.anonymous")) returned 1 [0077.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpFilePart=0x0) returned 0x3f [0077.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.507] GetFileType (hFile=0x154) returned 0x1 [0077.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.507] GetFileType (hFile=0x154) returned 0x1 [0077.507] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7457 [0077.507] ReadFile (in: hFile=0x154, lpBuffer=0x1ba239c, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ba239c*, lpNumberOfBytesRead=0x2ae560*=0x7457, lpOverlapped=0x0) returned 1 [0077.509] CloseHandle (hObject=0x154) returned 1 [0077.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpFilePart=0x0) returned 0x3f [0077.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.564] GetFileType (hFile=0x154) returned 0x1 [0077.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.564] GetFileType (hFile=0x154) returned 0x1 [0077.564] WriteFile (in: hFile=0x154, lpBuffer=0x1a183b4*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a183b4*, lpNumberOfBytesWritten=0x2ae554*=0x7460, lpOverlapped=0x0) returned 1 [0077.566] CloseHandle (hObject=0x154) returned 1 [0077.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", lpFilePart=0x0) returned 0x3f [0077.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.567] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd2b3350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7460)) returned 1 [0077.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.anonymous")) returned 1 [0077.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpFilePart=0x0) returned 0x3f [0077.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.568] GetFileType (hFile=0x154) returned 0x1 [0077.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.568] GetFileType (hFile=0x154) returned 0x1 [0077.568] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa9e2 [0077.568] ReadFile (in: hFile=0x154, lpBuffer=0x1a1fc20, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a1fc20*, lpNumberOfBytesRead=0x2ae560*=0xa9e2, lpOverlapped=0x0) returned 1 [0077.570] CloseHandle (hObject=0x154) returned 1 [0077.590] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpFilePart=0x0) returned 0x3f [0077.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.592] GetFileType (hFile=0x154) returned 0x1 [0077.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.592] GetFileType (hFile=0x154) returned 0x1 [0077.592] WriteFile (in: hFile=0x154, lpBuffer=0x1a8c94c*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a8c94c*, lpNumberOfBytesWritten=0x2ae554*=0xa9f0, lpOverlapped=0x0) returned 1 [0077.594] CloseHandle (hObject=0x154) returned 1 [0077.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", lpFilePart=0x0) returned 0x3f [0077.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd2ff610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa9f0)) returned 1 [0077.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.anonymous")) returned 1 [0077.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpFilePart=0x0) returned 0x3f [0077.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.596] GetFileType (hFile=0x154) returned 0x1 [0077.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.597] GetFileType (hFile=0x154) returned 0x1 [0077.597] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3ee3 [0077.597] ReadFile (in: hFile=0x154, lpBuffer=0x1a97748, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a97748*, lpNumberOfBytesRead=0x2ae560*=0x3ee3, lpOverlapped=0x0) returned 1 [0077.598] CloseHandle (hObject=0x154) returned 1 [0077.613] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpFilePart=0x0) returned 0x3f [0077.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.614] GetFileType (hFile=0x154) returned 0x1 [0077.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.614] GetFileType (hFile=0x154) returned 0x1 [0077.614] WriteFile (in: hFile=0x154, lpBuffer=0x1af7fe4*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1af7fe4*, lpNumberOfBytesWritten=0x2ae554*=0x3ef0, lpOverlapped=0x0) returned 1 [0077.616] CloseHandle (hObject=0x154) returned 1 [0077.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", lpFilePart=0x0) returned 0x3f [0077.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.616] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd34b8d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0)) returned 1 [0077.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.anonymous")) returned 1 [0077.617] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpFilePart=0x0) returned 0x3f [0077.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.617] GetFileType (hFile=0x154) returned 0x1 [0077.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.617] GetFileType (hFile=0x154) returned 0x1 [0077.617] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1f8a [0077.617] ReadFile (in: hFile=0x154, lpBuffer=0x1afc2e0, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1afc2e0*, lpNumberOfBytesRead=0x2ae560*=0x1f8a, lpOverlapped=0x0) returned 1 [0077.619] CloseHandle (hObject=0x154) returned 1 [0077.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpFilePart=0x0) returned 0x3f [0077.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.634] GetFileType (hFile=0x154) returned 0x1 [0077.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.634] GetFileType (hFile=0x154) returned 0x1 [0077.634] WriteFile (in: hFile=0x154, lpBuffer=0x1b52e9c*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b52e9c*, lpNumberOfBytesWritten=0x2ae554*=0x1f90, lpOverlapped=0x0) returned 1 [0077.635] CloseHandle (hObject=0x154) returned 1 [0077.636] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", lpFilePart=0x0) returned 0x3f [0077.636] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.636] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd371a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f90)) returned 1 [0077.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.anonymous")) returned 1 [0077.637] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpFilePart=0x0) returned 0x3f [0077.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.637] GetFileType (hFile=0x154) returned 0x1 [0077.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.637] GetFileType (hFile=0x154) returned 0x1 [0077.637] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5a56 [0077.637] ReadFile (in: hFile=0x154, lpBuffer=0x1b55238, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b55238*, lpNumberOfBytesRead=0x2ae560*=0x5a56, lpOverlapped=0x0) returned 1 [0077.639] CloseHandle (hObject=0x154) returned 1 [0077.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpFilePart=0x0) returned 0x3f [0077.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.668] GetFileType (hFile=0x154) returned 0x1 [0077.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.668] GetFileType (hFile=0x154) returned 0x1 [0077.668] WriteFile (in: hFile=0x154, lpBuffer=0x19c1904*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c1904*, lpNumberOfBytesWritten=0x2ae554*=0x5a60, lpOverlapped=0x0) returned 1 [0077.670] CloseHandle (hObject=0x154) returned 1 [0077.670] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", lpFilePart=0x0) returned 0x3f [0077.670] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.670] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd3bdcf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5a60)) returned 1 [0077.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.anonymous")) returned 1 [0077.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpFilePart=0x0) returned 0x3f [0077.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.671] GetFileType (hFile=0x154) returned 0x1 [0077.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.671] GetFileType (hFile=0x154) returned 0x1 [0077.671] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6f43 [0077.671] ReadFile (in: hFile=0x154, lpBuffer=0x19c7770, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c7770*, lpNumberOfBytesRead=0x2ae560*=0x6f43, lpOverlapped=0x0) returned 1 [0077.673] CloseHandle (hObject=0x154) returned 1 [0077.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpFilePart=0x0) returned 0x3f [0077.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.719] GetFileType (hFile=0x154) returned 0x1 [0077.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.719] GetFileType (hFile=0x154) returned 0x1 [0077.719] WriteFile (in: hFile=0x154, lpBuffer=0x1a37348*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a37348*, lpNumberOfBytesWritten=0x2ae554*=0x6f50, lpOverlapped=0x0) returned 1 [0077.721] CloseHandle (hObject=0x154) returned 1 [0077.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", lpFilePart=0x0) returned 0x3f [0077.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.721] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd430110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6f50)) returned 1 [0077.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.anonymous")) returned 1 [0077.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpFilePart=0x0) returned 0x3f [0077.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.722] GetFileType (hFile=0x154) returned 0x1 [0077.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.722] GetFileType (hFile=0x154) returned 0x1 [0077.722] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6aa8 [0077.722] ReadFile (in: hFile=0x154, lpBuffer=0x1a3e6a4, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a3e6a4*, lpNumberOfBytesRead=0x2ae560*=0x6aa8, lpOverlapped=0x0) returned 1 [0077.724] CloseHandle (hObject=0x154) returned 1 [0077.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpFilePart=0x0) returned 0x3f [0077.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.738] GetFileType (hFile=0x154) returned 0x1 [0077.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.738] GetFileType (hFile=0x154) returned 0x1 [0077.738] WriteFile (in: hFile=0x154, lpBuffer=0x1aac9fc*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aac9fc*, lpNumberOfBytesWritten=0x2ae554*=0x6ab0, lpOverlapped=0x0) returned 1 [0077.741] CloseHandle (hObject=0x154) returned 1 [0077.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", lpFilePart=0x0) returned 0x3f [0077.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.741] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd47c3d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ab0)) returned 1 [0077.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.anonymous")) returned 1 [0077.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpFilePart=0x0) returned 0x3f [0077.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.742] GetFileType (hFile=0x154) returned 0x1 [0077.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.742] GetFileType (hFile=0x154) returned 0x1 [0077.742] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6873 [0077.742] ReadFile (in: hFile=0x154, lpBuffer=0x1ab38b8, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab38b8*, lpNumberOfBytesRead=0x2ae560*=0x6873, lpOverlapped=0x0) returned 1 [0077.747] CloseHandle (hObject=0x154) returned 1 [0077.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpFilePart=0x0) returned 0x3f [0077.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.762] GetFileType (hFile=0x154) returned 0x1 [0077.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.762] GetFileType (hFile=0x154) returned 0x1 [0077.762] WriteFile (in: hFile=0x154, lpBuffer=0x1b21124*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b21124*, lpNumberOfBytesWritten=0x2ae554*=0x6880, lpOverlapped=0x0) returned 1 [0077.763] CloseHandle (hObject=0x154) returned 1 [0077.763] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", lpFilePart=0x0) returned 0x3f [0077.763] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.763] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd4a2530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6880)) returned 1 [0077.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.anonymous")) returned 1 [0077.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", lpFilePart=0x0) returned 0x3f [0077.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.765] GetFileType (hFile=0x154) returned 0x1 [0077.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.765] GetFileType (hFile=0x154) returned 0x1 [0077.765] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa497 [0077.765] ReadFile (in: hFile=0x154, lpBuffer=0x1b27db0, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b27db0*, lpNumberOfBytesRead=0x2ae560*=0xa497, lpOverlapped=0x0) returned 1 [0077.767] CloseHandle (hObject=0x154) returned 1 [0077.781] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", lpFilePart=0x0) returned 0x3f [0077.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.783] GetFileType (hFile=0x154) returned 0x1 [0077.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.783] GetFileType (hFile=0x154) returned 0x1 [0077.783] WriteFile (in: hFile=0x154, lpBuffer=0x1ba82bc*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ba82bc*, lpNumberOfBytesWritten=0x2ae554*=0xa4a0, lpOverlapped=0x0) returned 1 [0077.785] CloseHandle (hObject=0x154) returned 1 [0077.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", lpFilePart=0x0) returned 0x3f [0077.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.785] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd4c8690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa4a0)) returned 1 [0077.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.anonymous")) returned 1 [0077.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", lpFilePart=0x0) returned 0x3f [0077.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.786] GetFileType (hFile=0x154) returned 0x1 [0077.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.786] GetFileType (hFile=0x154) returned 0x1 [0077.786] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1e7b [0077.786] ReadFile (in: hFile=0x154, lpBuffer=0x1bb2b68, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1bb2b68*, lpNumberOfBytesRead=0x2ae560*=0x1e7b, lpOverlapped=0x0) returned 1 [0077.788] CloseHandle (hObject=0x154) returned 1 [0077.825] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", lpFilePart=0x0) returned 0x3f [0077.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.826] GetFileType (hFile=0x154) returned 0x1 [0077.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.826] GetFileType (hFile=0x154) returned 0x1 [0077.826] WriteFile (in: hFile=0x154, lpBuffer=0x19ff7e4*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19ff7e4*, lpNumberOfBytesWritten=0x2ae554*=0x1e80, lpOverlapped=0x0) returned 1 [0077.827] CloseHandle (hObject=0x154) returned 1 [0077.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", lpFilePart=0x0) returned 0x3f [0077.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.828] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd53aab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e80)) returned 1 [0077.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.anonymous")) returned 1 [0077.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", lpFilePart=0x0) returned 0x3f [0077.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.829] GetFileType (hFile=0x154) returned 0x1 [0077.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.829] GetFileType (hFile=0x154) returned 0x1 [0077.829] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3615 [0077.829] ReadFile (in: hFile=0x154, lpBuffer=0x1a01a70, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a01a70*, lpNumberOfBytesRead=0x2ae560*=0x3615, lpOverlapped=0x0) returned 1 [0077.830] CloseHandle (hObject=0x154) returned 1 [0077.842] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", lpFilePart=0x0) returned 0x3f [0077.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.844] GetFileType (hFile=0x154) returned 0x1 [0077.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.844] GetFileType (hFile=0x154) returned 0x1 [0077.844] WriteFile (in: hFile=0x154, lpBuffer=0x1a5f858*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a5f858*, lpNumberOfBytesWritten=0x2ae554*=0x3620, lpOverlapped=0x0) returned 1 [0077.845] CloseHandle (hObject=0x154) returned 1 [0077.845] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", lpFilePart=0x0) returned 0x3f [0077.845] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.846] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd2c7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd560c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3620)) returned 1 [0077.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.anonymous")) returned 1 [0077.846] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", lpFilePart=0x0) returned 0x3f [0077.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.847] GetFileType (hFile=0x154) returned 0x1 [0077.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.847] GetFileType (hFile=0x154) returned 0x1 [0077.847] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2026 [0077.847] ReadFile (in: hFile=0x154, lpBuffer=0x1a63284, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a63284*, lpNumberOfBytesRead=0x2ae560*=0x2026, lpOverlapped=0x0) returned 1 [0077.849] CloseHandle (hObject=0x154) returned 1 [0077.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", lpFilePart=0x0) returned 0x3f [0077.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.862] GetFileType (hFile=0x154) returned 0x1 [0077.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.862] GetFileType (hFile=0x154) returned 0x1 [0077.862] WriteFile (in: hFile=0x154, lpBuffer=0x1aba160*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aba160*, lpNumberOfBytesWritten=0x2ae554*=0x2030, lpOverlapped=0x0) returned 1 [0077.863] CloseHandle (hObject=0x154) returned 1 [0077.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", lpFilePart=0x0) returned 0x3f [0077.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.864] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd586d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2030)) returned 1 [0077.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.anonymous")) returned 1 [0077.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", lpFilePart=0x0) returned 0x3f [0077.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.865] GetFileType (hFile=0x154) returned 0x1 [0077.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.865] GetFileType (hFile=0x154) returned 0x1 [0077.865] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3df7 [0077.865] ReadFile (in: hFile=0x154, lpBuffer=0x1abc59c, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1abc59c*, lpNumberOfBytesRead=0x2ae560*=0x3df7, lpOverlapped=0x0) returned 1 [0077.867] CloseHandle (hObject=0x154) returned 1 [0077.879] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", lpFilePart=0x0) returned 0x3f [0077.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.880] GetFileType (hFile=0x154) returned 0x1 [0077.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.880] GetFileType (hFile=0x154) returned 0x1 [0077.880] WriteFile (in: hFile=0x154, lpBuffer=0x1b1c988*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b1c988*, lpNumberOfBytesWritten=0x2ae554*=0x3e00, lpOverlapped=0x0) returned 1 [0077.898] CloseHandle (hObject=0x154) returned 1 [0077.898] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", lpFilePart=0x0) returned 0x3f [0077.898] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.898] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd5f9190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e00)) returned 1 [0077.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.anonymous")) returned 1 [0077.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", lpFilePart=0x0) returned 0x3f [0077.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.899] GetFileType (hFile=0x154) returned 0x1 [0077.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.899] GetFileType (hFile=0x154) returned 0x1 [0077.899] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3d7f [0077.899] ReadFile (in: hFile=0x154, lpBuffer=0x1b20b94, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b20b94*, lpNumberOfBytesRead=0x2ae560*=0x3d7f, lpOverlapped=0x0) returned 1 [0077.901] CloseHandle (hObject=0x154) returned 1 [0077.913] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", lpFilePart=0x0) returned 0x3f [0077.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.914] GetFileType (hFile=0x154) returned 0x1 [0077.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.914] GetFileType (hFile=0x154) returned 0x1 [0077.914] WriteFile (in: hFile=0x154, lpBuffer=0x1b80d00*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b80d00*, lpNumberOfBytesWritten=0x2ae554*=0x3d80, lpOverlapped=0x0) returned 1 [0077.915] CloseHandle (hObject=0x154) returned 1 [0077.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", lpFilePart=0x0) returned 0x3f [0077.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.916] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd61f2f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d80)) returned 1 [0077.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.anonymous")) returned 1 [0077.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", lpFilePart=0x0) returned 0x3f [0077.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.917] GetFileType (hFile=0x154) returned 0x1 [0077.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.917] GetFileType (hFile=0x154) returned 0x1 [0077.917] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4ec6 [0077.917] ReadFile (in: hFile=0x154, lpBuffer=0x1b84e8c, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b84e8c*, lpNumberOfBytesRead=0x2ae560*=0x4ec6, lpOverlapped=0x0) returned 1 [0077.918] CloseHandle (hObject=0x154) returned 1 [0077.955] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", lpFilePart=0x0) returned 0x3f [0077.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.957] GetFileType (hFile=0x154) returned 0x1 [0077.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.957] GetFileType (hFile=0x154) returned 0x1 [0077.957] WriteFile (in: hFile=0x154, lpBuffer=0x19ed6d4*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19ed6d4*, lpNumberOfBytesWritten=0x2ae554*=0x4ed0, lpOverlapped=0x0) returned 1 [0077.958] CloseHandle (hObject=0x154) returned 1 [0077.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", lpFilePart=0x0) returned 0x3f [0077.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.958] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd66b5b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ed0)) returned 1 [0077.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.anonymous")) returned 1 [0077.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", lpFilePart=0x0) returned 0x3f [0077.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.960] GetFileType (hFile=0x154) returned 0x1 [0077.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.960] GetFileType (hFile=0x154) returned 0x1 [0077.960] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x49ba [0077.960] ReadFile (in: hFile=0x154, lpBuffer=0x19f29b0, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19f29b0*, lpNumberOfBytesRead=0x2ae560*=0x49ba, lpOverlapped=0x0) returned 1 [0077.961] CloseHandle (hObject=0x154) returned 1 [0077.973] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", lpFilePart=0x0) returned 0x3f [0077.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.975] GetFileType (hFile=0x154) returned 0x1 [0077.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.975] GetFileType (hFile=0x154) returned 0x1 [0077.975] WriteFile (in: hFile=0x154, lpBuffer=0x1a569b8*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a569b8*, lpNumberOfBytesWritten=0x2ae554*=0x49c0, lpOverlapped=0x0) returned 1 [0077.977] CloseHandle (hObject=0x154) returned 1 [0077.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", lpFilePart=0x0) returned 0x3f [0077.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.977] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd6b7870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x49c0)) returned 1 [0077.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.anonymous")) returned 1 [0077.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", lpFilePart=0x0) returned 0x3f [0077.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0077.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.979] GetFileType (hFile=0x154) returned 0x1 [0077.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0077.979] GetFileType (hFile=0x154) returned 0x1 [0077.979] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x10bdc [0077.979] ReadFile (in: hFile=0x154, lpBuffer=0x1a5b784, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a5b784*, lpNumberOfBytesRead=0x2ae560*=0x10bdc, lpOverlapped=0x0) returned 1 [0077.981] CloseHandle (hObject=0x154) returned 1 [0077.995] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", lpFilePart=0x0) returned 0x3f [0077.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0077.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0077.997] GetFileType (hFile=0x154) returned 0x1 [0077.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0077.997] GetFileType (hFile=0x154) returned 0x1 [0077.997] WriteFile (in: hFile=0x154, lpBuffer=0x1ada920*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ada920*, lpNumberOfBytesWritten=0x2ae554*=0x10be0, lpOverlapped=0x0) returned 1 [0077.999] CloseHandle (hObject=0x154) returned 1 [0077.999] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", lpFilePart=0x0) returned 0x3f [0077.999] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0077.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0077.999] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8d2190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd6dd9d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10be0)) returned 1 [0077.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0077.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.anonymous")) returned 1 [0078.000] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", lpFilePart=0x0) returned 0x3f [0078.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.001] GetFileType (hFile=0x154) returned 0x1 [0078.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.001] GetFileType (hFile=0x154) returned 0x1 [0078.001] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1ce5a [0078.001] ReadFile (in: hFile=0x154, lpBuffer=0x3482d98, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x3482d98*, lpNumberOfBytesRead=0x2ae560*=0x1ce5a, lpOverlapped=0x0) returned 1 [0078.004] CloseHandle (hObject=0x154) returned 1 [0078.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", lpFilePart=0x0) returned 0x3f [0078.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.027] GetFileType (hFile=0x154) returned 0x1 [0078.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.027] GetFileType (hFile=0x154) returned 0x1 [0078.027] WriteFile (in: hFile=0x154, lpBuffer=0x35135b0*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x35135b0*, lpNumberOfBytesWritten=0x2ae554*=0x1ce60, lpOverlapped=0x0) returned 1 [0078.030] CloseHandle (hObject=0x154) returned 1 [0078.030] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", lpFilePart=0x0) returned 0x3f [0078.030] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.030] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8f82f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd729c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ce60)) returned 1 [0078.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.anonymous")) returned 1 [0078.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", lpFilePart=0x0) returned 0x3f [0078.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.032] GetFileType (hFile=0x154) returned 0x1 [0078.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.032] GetFileType (hFile=0x154) returned 0x1 [0078.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1672c [0078.033] ReadFile (in: hFile=0x154, lpBuffer=0x3530430, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x3530430*, lpNumberOfBytesRead=0x2ae560*=0x1672c, lpOverlapped=0x0) returned 1 [0078.035] CloseHandle (hObject=0x154) returned 1 [0078.056] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", lpFilePart=0x0) returned 0x3f [0078.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.058] GetFileType (hFile=0x154) returned 0x1 [0078.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.058] GetFileType (hFile=0x154) returned 0x1 [0078.058] WriteFile (in: hFile=0x154, lpBuffer=0x35a0858*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x35a0858*, lpNumberOfBytesWritten=0x2ae554*=0x16730, lpOverlapped=0x0) returned 1 [0078.060] CloseHandle (hObject=0x154) returned 1 [0078.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", lpFilePart=0x0) returned 0x3f [0078.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd775f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16730)) returned 1 [0078.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.anonymous")) returned 1 [0078.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", lpFilePart=0x0) returned 0x3f [0078.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.061] GetFileType (hFile=0x154) returned 0x1 [0078.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.061] GetFileType (hFile=0x154) returned 0x1 [0078.061] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1f86c [0078.062] ReadFile (in: hFile=0x154, lpBuffer=0x35b6fa8, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x35b6fa8*, lpNumberOfBytesRead=0x2ae560*=0x1f86c, lpOverlapped=0x0) returned 1 [0078.089] CloseHandle (hObject=0x154) returned 1 [0078.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", lpFilePart=0x0) returned 0x3f [0078.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.138] GetFileType (hFile=0x154) returned 0x1 [0078.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.138] GetFileType (hFile=0x154) returned 0x1 [0078.138] WriteFile (in: hFile=0x154, lpBuffer=0x3654a10*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x3654a10*, lpNumberOfBytesWritten=0x2ae554*=0x1f870, lpOverlapped=0x0) returned 1 [0078.142] CloseHandle (hObject=0x154) returned 1 [0078.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", lpFilePart=0x0) returned 0x3f [0078.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd834630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f870)) returned 1 [0078.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.anonymous")) returned 1 [0078.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", lpFilePart=0x0) returned 0x3f [0078.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.143] GetFileType (hFile=0x154) returned 0x1 [0078.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.143] GetFileType (hFile=0x154) returned 0x1 [0078.143] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1b83a [0078.143] ReadFile (in: hFile=0x154, lpBuffer=0x36742a0, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x36742a0*, lpNumberOfBytesRead=0x2ae560*=0x1b83a, lpOverlapped=0x0) returned 1 [0078.147] CloseHandle (hObject=0x154) returned 1 [0078.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", lpFilePart=0x0) returned 0x3f [0078.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.169] GetFileType (hFile=0x154) returned 0x1 [0078.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.169] GetFileType (hFile=0x154) returned 0x1 [0078.169] WriteFile (in: hFile=0x154, lpBuffer=0x36fdc18*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x36fdc18*, lpNumberOfBytesWritten=0x2ae554*=0x1b840, lpOverlapped=0x0) returned 1 [0078.172] CloseHandle (hObject=0x154) returned 1 [0078.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", lpFilePart=0x0) returned 0x3f [0078.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.172] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd8808f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b840)) returned 1 [0078.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.anonymous")) returned 1 [0078.173] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", lpFilePart=0x0) returned 0x3f [0078.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.173] GetFileType (hFile=0x154) returned 0x1 [0078.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.173] GetFileType (hFile=0x154) returned 0x1 [0078.173] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1df43 [0078.174] ReadFile (in: hFile=0x154, lpBuffer=0x3719478, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x3719478*, lpNumberOfBytesRead=0x2ae560*=0x1df43, lpOverlapped=0x0) returned 1 [0078.178] CloseHandle (hObject=0x154) returned 1 [0078.199] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", lpFilePart=0x0) returned 0x3f [0078.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.201] GetFileType (hFile=0x154) returned 0x1 [0078.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.201] GetFileType (hFile=0x154) returned 0x1 [0078.201] WriteFile (in: hFile=0x154, lpBuffer=0x37af138*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x37af138*, lpNumberOfBytesWritten=0x2ae554*=0x1df50, lpOverlapped=0x0) returned 1 [0078.204] CloseHandle (hObject=0x154) returned 1 [0078.204] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", lpFilePart=0x0) returned 0x3f [0078.204] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.204] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8f82f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd8ccbb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1df50)) returned 1 [0078.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.anonymous")) returned 1 [0078.205] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", lpFilePart=0x0) returned 0x3f [0078.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.205] GetFileType (hFile=0x154) returned 0x1 [0078.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.205] GetFileType (hFile=0x154) returned 0x1 [0078.205] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x184d3 [0078.205] ReadFile (in: hFile=0x154, lpBuffer=0x37cd0a8, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x37cd0a8*, lpNumberOfBytesRead=0x2ae560*=0x184d3, lpOverlapped=0x0) returned 1 [0078.208] CloseHandle (hObject=0x154) returned 1 [0078.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", lpFilePart=0x0) returned 0x3f [0078.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.230] GetFileType (hFile=0x154) returned 0x1 [0078.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.230] GetFileType (hFile=0x154) returned 0x1 [0078.230] WriteFile (in: hFile=0x154, lpBuffer=0x3846938*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x3846938*, lpNumberOfBytesWritten=0x2ae554*=0x184e0, lpOverlapped=0x0) returned 1 [0078.233] CloseHandle (hObject=0x154) returned 1 [0078.233] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", lpFilePart=0x0) returned 0x3f [0078.233] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.233] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd918e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x184e0)) returned 1 [0078.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.anonymous")) returned 1 [0078.235] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", lpFilePart=0x0) returned 0x3f [0078.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.238] GetFileType (hFile=0x154) returned 0x1 [0078.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.238] GetFileType (hFile=0x154) returned 0x1 [0078.238] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1aba5 [0078.239] ReadFile (in: hFile=0x154, lpBuffer=0x385ee38, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x385ee38*, lpNumberOfBytesRead=0x2ae560*=0x1aba5, lpOverlapped=0x0) returned 1 [0078.242] CloseHandle (hObject=0x154) returned 1 [0078.262] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", lpFilePart=0x0) returned 0x3f [0078.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.264] GetFileType (hFile=0x154) returned 0x1 [0078.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.264] GetFileType (hFile=0x154) returned 0x1 [0078.264] WriteFile (in: hFile=0x154, lpBuffer=0x38e48e0*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x38e48e0*, lpNumberOfBytesWritten=0x2ae554*=0x1abb0, lpOverlapped=0x0) returned 1 [0078.266] CloseHandle (hObject=0x154) returned 1 [0078.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", lpFilePart=0x0) returned 0x3f [0078.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.267] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd965130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1abb0)) returned 1 [0078.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.anonymous")) returned 1 [0078.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", lpFilePart=0x0) returned 0x3f [0078.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.270] GetFileType (hFile=0x154) returned 0x1 [0078.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.270] GetFileType (hFile=0x154) returned 0x1 [0078.270] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1653a [0078.271] ReadFile (in: hFile=0x154, lpBuffer=0x107d5c68, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x107d5c68*, lpNumberOfBytesRead=0x2ae560*=0x1653a, lpOverlapped=0x0) returned 1 [0078.276] CloseHandle (hObject=0x154) returned 1 [0078.295] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", lpFilePart=0x0) returned 0x3f [0078.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.297] GetFileType (hFile=0x154) returned 0x1 [0078.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.297] GetFileType (hFile=0x154) returned 0x1 [0078.297] WriteFile (in: hFile=0x154, lpBuffer=0x108456e0*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x108456e0*, lpNumberOfBytesWritten=0x2ae554*=0x16540, lpOverlapped=0x0) returned 1 [0078.299] CloseHandle (hObject=0x154) returned 1 [0078.299] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", lpFilePart=0x0) returned 0x3f [0078.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.300] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8f82f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcd9b13f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16540)) returned 1 [0078.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.anonymous")) returned 1 [0078.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", lpFilePart=0x0) returned 0x3f [0078.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.301] GetFileType (hFile=0x154) returned 0x1 [0078.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.301] GetFileType (hFile=0x154) returned 0x1 [0078.301] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x13e1d [0078.301] ReadFile (in: hFile=0x154, lpBuffer=0x1b4fb9c, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b4fb9c*, lpNumberOfBytesRead=0x2ae560*=0x13e1d, lpOverlapped=0x0) returned 1 [0078.304] CloseHandle (hObject=0x154) returned 1 [0078.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", lpFilePart=0x0) returned 0x3f [0078.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.345] GetFileType (hFile=0x154) returned 0x1 [0078.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.346] GetFileType (hFile=0x154) returned 0x1 [0078.346] WriteFile (in: hFile=0x154, lpBuffer=0x19ec278*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19ec278*, lpNumberOfBytesWritten=0x2ae554*=0x13e20, lpOverlapped=0x0) returned 1 [0078.348] CloseHandle (hObject=0x154) returned 1 [0078.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", lpFilePart=0x0) returned 0x3f [0078.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.348] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd52930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcda23810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13e20)) returned 1 [0078.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.anonymous")) returned 1 [0078.349] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", lpFilePart=0x0) returned 0x3f [0078.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.349] GetFileType (hFile=0x154) returned 0x1 [0078.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.349] GetFileType (hFile=0x154) returned 0x1 [0078.349] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1531c [0078.350] ReadFile (in: hFile=0x154, lpBuffer=0x10883880, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10883880*, lpNumberOfBytesRead=0x2ae560*=0x1531c, lpOverlapped=0x0) returned 1 [0078.365] CloseHandle (hObject=0x154) returned 1 [0078.384] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", lpFilePart=0x0) returned 0x3f [0078.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.385] GetFileType (hFile=0x154) returned 0x1 [0078.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.386] GetFileType (hFile=0x154) returned 0x1 [0078.386] WriteFile (in: hFile=0x154, lpBuffer=0x108ed858*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x108ed858*, lpNumberOfBytesWritten=0x2ae554*=0x15320, lpOverlapped=0x0) returned 1 [0078.388] CloseHandle (hObject=0x154) returned 1 [0078.388] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", lpFilePart=0x0) returned 0x3f [0078.388] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.388] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcda95c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15320)) returned 1 [0078.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.anonymous")) returned 1 [0078.389] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", lpFilePart=0x0) returned 0x3f [0078.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.389] GetFileType (hFile=0x154) returned 0x1 [0078.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.389] GetFileType (hFile=0x154) returned 0x1 [0078.389] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1ad37 [0078.390] ReadFile (in: hFile=0x154, lpBuffer=0x10902b98, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10902b98*, lpNumberOfBytesRead=0x2ae560*=0x1ad37, lpOverlapped=0x0) returned 1 [0078.393] CloseHandle (hObject=0x154) returned 1 [0078.445] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", lpFilePart=0x0) returned 0x3f [0078.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.447] GetFileType (hFile=0x154) returned 0x1 [0078.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.447] GetFileType (hFile=0x154) returned 0x1 [0078.447] WriteFile (in: hFile=0x154, lpBuffer=0x10988e10*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10988e10*, lpNumberOfBytesWritten=0x2ae554*=0x1ad40, lpOverlapped=0x0) returned 1 [0078.450] CloseHandle (hObject=0x154) returned 1 [0078.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", lpFilePart=0x0) returned 0x3f [0078.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.450] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8f82f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdb2e1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ad40)) returned 1 [0078.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.anonymous")) returned 1 [0078.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", lpFilePart=0x0) returned 0x3f [0078.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.451] GetFileType (hFile=0x154) returned 0x1 [0078.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.451] GetFileType (hFile=0x154) returned 0x1 [0078.451] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x178d2 [0078.451] ReadFile (in: hFile=0x154, lpBuffer=0x109a3b70, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x109a3b70*, lpNumberOfBytesRead=0x2ae560*=0x178d2, lpOverlapped=0x0) returned 1 [0078.454] CloseHandle (hObject=0x154) returned 1 [0078.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", lpFilePart=0x0) returned 0x3f [0078.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.475] GetFileType (hFile=0x154) returned 0x1 [0078.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.475] GetFileType (hFile=0x154) returned 0x1 [0078.475] WriteFile (in: hFile=0x154, lpBuffer=0x10a19800*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10a19800*, lpNumberOfBytesWritten=0x2ae554*=0x178e0, lpOverlapped=0x0) returned 1 [0078.478] CloseHandle (hObject=0x154) returned 1 [0078.478] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", lpFilePart=0x0) returned 0x3f [0078.478] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.478] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdb7a470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x178e0)) returned 1 [0078.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.anonymous")) returned 1 [0078.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", lpFilePart=0x0) returned 0x3f [0078.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.479] GetFileType (hFile=0x154) returned 0x1 [0078.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.479] GetFileType (hFile=0x154) returned 0x1 [0078.479] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x17749 [0078.480] ReadFile (in: hFile=0x154, lpBuffer=0x10a31100, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10a31100*, lpNumberOfBytesRead=0x2ae560*=0x17749, lpOverlapped=0x0) returned 1 [0078.482] CloseHandle (hObject=0x154) returned 1 [0078.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", lpFilePart=0x0) returned 0x3f [0078.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.504] GetFileType (hFile=0x154) returned 0x1 [0078.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.504] GetFileType (hFile=0x154) returned 0x1 [0078.504] WriteFile (in: hFile=0x154, lpBuffer=0x10aa65c8*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10aa65c8*, lpNumberOfBytesWritten=0x2ae554*=0x17750, lpOverlapped=0x0) returned 1 [0078.506] CloseHandle (hObject=0x154) returned 1 [0078.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", lpFilePart=0x0) returned 0x3f [0078.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.506] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdbc6730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17750)) returned 1 [0078.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.anonymous")) returned 1 [0078.507] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", lpFilePart=0x0) returned 0x3f [0078.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.508] GetFileType (hFile=0x154) returned 0x1 [0078.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.508] GetFileType (hFile=0x154) returned 0x1 [0078.508] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x15a7f [0078.509] ReadFile (in: hFile=0x154, lpBuffer=0x10abdd38, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10abdd38*, lpNumberOfBytesRead=0x2ae560*=0x15a7f, lpOverlapped=0x0) returned 1 [0078.511] CloseHandle (hObject=0x154) returned 1 [0078.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", lpFilePart=0x0) returned 0x3f [0078.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.533] GetFileType (hFile=0x154) returned 0x1 [0078.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.533] GetFileType (hFile=0x154) returned 0x1 [0078.533] WriteFile (in: hFile=0x154, lpBuffer=0x10b2a1f8*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10b2a1f8*, lpNumberOfBytesWritten=0x2ae554*=0x15a80, lpOverlapped=0x0) returned 1 [0078.535] CloseHandle (hObject=0x154) returned 1 [0078.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", lpFilePart=0x0) returned 0x3f [0078.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.536] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8f82f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdbec890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15a80)) returned 1 [0078.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.anonymous")) returned 1 [0078.536] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", lpFilePart=0x0) returned 0x3f [0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.537] GetFileType (hFile=0x154) returned 0x1 [0078.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.537] GetFileType (hFile=0x154) returned 0x1 [0078.537] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x15fef [0078.537] ReadFile (in: hFile=0x154, lpBuffer=0x10b3fc98, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10b3fc98*, lpNumberOfBytesRead=0x2ae560*=0x15fef, lpOverlapped=0x0) returned 1 [0078.540] CloseHandle (hObject=0x154) returned 1 [0078.589] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", lpFilePart=0x0) returned 0x3f [0078.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.591] GetFileType (hFile=0x154) returned 0x1 [0078.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.591] GetFileType (hFile=0x154) returned 0x1 [0078.591] WriteFile (in: hFile=0x154, lpBuffer=0x10badc88*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10badc88*, lpNumberOfBytesWritten=0x2ae554*=0x15ff0, lpOverlapped=0x0) returned 1 [0078.594] CloseHandle (hObject=0x154) returned 1 [0078.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", lpFilePart=0x0) returned 0x3f [0078.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b8f82f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdc84e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15ff0)) returned 1 [0078.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.anonymous")) returned 1 [0078.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", lpFilePart=0x0) returned 0x3f [0078.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.595] GetFileType (hFile=0x154) returned 0x1 [0078.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.595] GetFileType (hFile=0x154) returned 0x1 [0078.595] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1a9ed [0078.596] ReadFile (in: hFile=0x154, lpBuffer=0x10bc3c98, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10bc3c98*, lpNumberOfBytesRead=0x2ae560*=0x1a9ed, lpOverlapped=0x0) returned 1 [0078.599] CloseHandle (hObject=0x154) returned 1 [0078.619] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", lpFilePart=0x0) returned 0x3f [0078.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.621] GetFileType (hFile=0x154) returned 0x1 [0078.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.621] GetFileType (hFile=0x154) returned 0x1 [0078.621] WriteFile (in: hFile=0x154, lpBuffer=0x10c48e88*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10c48e88*, lpNumberOfBytesWritten=0x2ae554*=0x1a9f0, lpOverlapped=0x0) returned 1 [0078.624] CloseHandle (hObject=0x154) returned 1 [0078.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", lpFilePart=0x0) returned 0x3f [0078.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.624] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdcd10d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a9f0)) returned 1 [0078.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.anonymous")) returned 1 [0078.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", lpFilePart=0x0) returned 0x3f [0078.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.625] GetFileType (hFile=0x154) returned 0x1 [0078.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.625] GetFileType (hFile=0x154) returned 0x1 [0078.625] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x193e7 [0078.626] ReadFile (in: hFile=0x154, lpBuffer=0x10c63898, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10c63898*, lpNumberOfBytesRead=0x2ae560*=0x193e7, lpOverlapped=0x0) returned 1 [0078.648] CloseHandle (hObject=0x154) returned 1 [0078.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", lpFilePart=0x0) returned 0x3f [0078.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.671] GetFileType (hFile=0x154) returned 0x1 [0078.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.671] GetFileType (hFile=0x154) returned 0x1 [0078.671] WriteFile (in: hFile=0x154, lpBuffer=0x10ce1c80*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10ce1c80*, lpNumberOfBytesWritten=0x2ae554*=0x193f0, lpOverlapped=0x0) returned 1 [0078.674] CloseHandle (hObject=0x154) returned 1 [0078.674] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", lpFilePart=0x0) returned 0x3f [0078.674] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.674] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdd434f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x193f0)) returned 1 [0078.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.anonymous")) returned 1 [0078.675] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", lpFilePart=0x0) returned 0x3f [0078.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.675] GetFileType (hFile=0x154) returned 0x1 [0078.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.675] GetFileType (hFile=0x154) returned 0x1 [0078.675] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x14f8a [0078.676] ReadFile (in: hFile=0x154, lpBuffer=0x10cfb090, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10cfb090*, lpNumberOfBytesRead=0x2ae560*=0x14f8a, lpOverlapped=0x0) returned 1 [0078.683] CloseHandle (hObject=0x154) returned 1 [0078.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", lpFilePart=0x0) returned 0x3f [0078.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.704] GetFileType (hFile=0x154) returned 0x1 [0078.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.704] GetFileType (hFile=0x154) returned 0x1 [0078.704] WriteFile (in: hFile=0x154, lpBuffer=0x10d63e98*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10d63e98*, lpNumberOfBytesWritten=0x2ae554*=0x14f90, lpOverlapped=0x0) returned 1 [0078.706] CloseHandle (hObject=0x154) returned 1 [0078.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", lpFilePart=0x0) returned 0x3f [0078.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.706] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdd8f7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14f90)) returned 1 [0078.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.anonymous")) returned 1 [0078.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", lpFilePart=0x0) returned 0x3f [0078.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.707] GetFileType (hFile=0x154) returned 0x1 [0078.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.707] GetFileType (hFile=0x154) returned 0x1 [0078.707] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1a3f4 [0078.708] ReadFile (in: hFile=0x154, lpBuffer=0x10d78e48, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10d78e48*, lpNumberOfBytesRead=0x2ae560*=0x1a3f4, lpOverlapped=0x0) returned 1 [0078.711] CloseHandle (hObject=0x154) returned 1 [0078.731] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", lpFilePart=0x0) returned 0x3f [0078.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.733] GetFileType (hFile=0x154) returned 0x1 [0078.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.733] GetFileType (hFile=0x154) returned 0x1 [0078.733] WriteFile (in: hFile=0x154, lpBuffer=0x10dfc278*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10dfc278*, lpNumberOfBytesWritten=0x2ae554*=0x1a400, lpOverlapped=0x0) returned 1 [0078.735] CloseHandle (hObject=0x154) returned 1 [0078.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", lpFilePart=0x0) returned 0x3f [0078.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.736] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b91e450, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdddba70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a400)) returned 1 [0078.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.anonymous")) returned 1 [0078.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", lpFilePart=0x0) returned 0x3f [0078.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.738] GetFileType (hFile=0x154) returned 0x1 [0078.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.738] GetFileType (hFile=0x154) returned 0x1 [0078.738] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x18ac4 [0078.738] ReadFile (in: hFile=0x154, lpBuffer=0x10e16698, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10e16698*, lpNumberOfBytesRead=0x2ae560*=0x18ac4, lpOverlapped=0x0) returned 1 [0078.741] CloseHandle (hObject=0x154) returned 1 [0078.761] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", lpFilePart=0x0) returned 0x3f [0078.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.763] GetFileType (hFile=0x154) returned 0x1 [0078.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.763] GetFileType (hFile=0x154) returned 0x1 [0078.764] WriteFile (in: hFile=0x154, lpBuffer=0x10e91cd8*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10e91cd8*, lpNumberOfBytesWritten=0x2ae554*=0x18ad0, lpOverlapped=0x0) returned 1 [0078.766] CloseHandle (hObject=0x154) returned 1 [0078.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", lpFilePart=0x0) returned 0x3f [0078.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.766] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcde27d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18ad0)) returned 1 [0078.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.anonymous")) returned 1 [0078.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", lpFilePart=0x0) returned 0x3f [0078.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.767] GetFileType (hFile=0x154) returned 0x1 [0078.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.767] GetFileType (hFile=0x154) returned 0x1 [0078.767] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1bef7 [0078.768] ReadFile (in: hFile=0x154, lpBuffer=0x10eaa7c8, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10eaa7c8*, lpNumberOfBytesRead=0x2ae560*=0x1bef7, lpOverlapped=0x0) returned 1 [0078.816] CloseHandle (hObject=0x154) returned 1 [0078.839] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", lpFilePart=0x0) returned 0x3f [0078.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.841] GetFileType (hFile=0x154) returned 0x1 [0078.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.841] GetFileType (hFile=0x154) returned 0x1 [0078.841] WriteFile (in: hFile=0x154, lpBuffer=0x10f36300*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10f36300*, lpNumberOfBytesWritten=0x2ae554*=0x1bf00, lpOverlapped=0x0) returned 1 [0078.844] CloseHandle (hObject=0x154) returned 1 [0078.844] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", lpFilePart=0x0) returned 0x3f [0078.844] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.844] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b91e450, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcdee6410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1bf00)) returned 1 [0078.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.anonymous")) returned 1 [0078.845] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", lpFilePart=0x0) returned 0x3f [0078.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.897] GetFileType (hFile=0x154) returned 0x1 [0078.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.897] GetFileType (hFile=0x154) returned 0x1 [0078.897] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x17dee [0078.898] ReadFile (in: hFile=0x154, lpBuffer=0x10f52220, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10f52220*, lpNumberOfBytesRead=0x2ae560*=0x17dee, lpOverlapped=0x0) returned 1 [0078.901] CloseHandle (hObject=0x154) returned 1 [0078.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", lpFilePart=0x0) returned 0x3f [0078.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0078.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.960] GetFileType (hFile=0x154) returned 0x1 [0078.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0078.960] GetFileType (hFile=0x154) returned 0x1 [0078.960] WriteFile (in: hFile=0x154, lpBuffer=0x10fc9810*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x10fc9810*, lpNumberOfBytesWritten=0x2ae554*=0x17df0, lpOverlapped=0x0) returned 1 [0078.964] CloseHandle (hObject=0x154) returned 1 [0078.964] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", lpFilePart=0x0) returned 0x3f [0078.964] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0078.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0078.964] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b91e450, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce016f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17df0)) returned 1 [0078.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0078.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.anonymous")) returned 1 [0078.965] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", lpFilePart=0x0) returned 0x3f [0078.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0078.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0078.966] GetFileType (hFile=0x154) returned 0x1 [0078.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0078.966] GetFileType (hFile=0x154) returned 0x1 [0078.966] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1bb02 [0078.967] ReadFile (in: hFile=0x154, lpBuffer=0x10fe1620, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x10fe1620*, lpNumberOfBytesRead=0x2ae560*=0x1bb02, lpOverlapped=0x0) returned 1 [0078.973] CloseHandle (hObject=0x154) returned 1 [0079.026] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", lpFilePart=0x0) returned 0x3f [0079.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.028] GetFileType (hFile=0x154) returned 0x1 [0079.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.028] GetFileType (hFile=0x154) returned 0x1 [0079.028] WriteFile (in: hFile=0x154, lpBuffer=0x1106bda0*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1106bda0*, lpNumberOfBytesWritten=0x2ae554*=0x1bb10, lpOverlapped=0x0) returned 1 [0079.031] CloseHandle (hObject=0x154) returned 1 [0079.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", lpFilePart=0x0) returned 0x3f [0079.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.031] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd78a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce0af490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1bb10)) returned 1 [0079.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.anonymous")) returned 1 [0079.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", lpFilePart=0x0) returned 0x3f [0079.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.032] GetFileType (hFile=0x154) returned 0x1 [0079.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.032] GetFileType (hFile=0x154) returned 0x1 [0079.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x18888 [0079.033] ReadFile (in: hFile=0x154, lpBuffer=0x110878d0, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x110878d0*, lpNumberOfBytesRead=0x2ae560*=0x18888, lpOverlapped=0x0) returned 1 [0079.035] CloseHandle (hObject=0x154) returned 1 [0079.057] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", lpFilePart=0x0) returned 0x3f [0079.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.059] GetFileType (hFile=0x154) returned 0x1 [0079.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.059] GetFileType (hFile=0x154) returned 0x1 [0079.059] WriteFile (in: hFile=0x154, lpBuffer=0x111023d8*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x111023d8*, lpNumberOfBytesWritten=0x2ae554*=0x18890, lpOverlapped=0x0) returned 1 [0079.062] CloseHandle (hObject=0x154) returned 1 [0079.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", lpFilePart=0x0) returned 0x3f [0079.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.062] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b91e450, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce0fb750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18890)) returned 1 [0079.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.anonymous")) returned 1 [0079.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", lpFilePart=0x0) returned 0x3f [0079.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.063] GetFileType (hFile=0x154) returned 0x1 [0079.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.063] GetFileType (hFile=0x154) returned 0x1 [0079.063] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x16d08 [0079.063] ReadFile (in: hFile=0x154, lpBuffer=0x1111ac88, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1111ac88*, lpNumberOfBytesRead=0x2ae560*=0x16d08, lpOverlapped=0x0) returned 1 [0079.072] CloseHandle (hObject=0x154) returned 1 [0079.094] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", lpFilePart=0x0) returned 0x3f [0079.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.097] GetFileType (hFile=0x154) returned 0x1 [0079.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.097] GetFileType (hFile=0x154) returned 0x1 [0079.097] WriteFile (in: hFile=0x154, lpBuffer=0x1118ce10*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1118ce10*, lpNumberOfBytesWritten=0x2ae554*=0x16d10, lpOverlapped=0x0) returned 1 [0079.102] CloseHandle (hObject=0x154) returned 1 [0079.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", lpFilePart=0x0) returned 0x3f [0079.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.103] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b91e450, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce16db70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16d10)) returned 1 [0079.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.anonymous")) returned 1 [0079.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", lpFilePart=0x0) returned 0x3f [0079.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.104] GetFileType (hFile=0x154) returned 0x1 [0079.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.104] GetFileType (hFile=0x154) returned 0x1 [0079.104] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1b75f [0079.105] ReadFile (in: hFile=0x154, lpBuffer=0x111a3b40, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x111a3b40*, lpNumberOfBytesRead=0x2ae560*=0x1b75f, lpOverlapped=0x0) returned 1 [0079.109] CloseHandle (hObject=0x154) returned 1 [0079.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", lpFilePart=0x0) returned 0x3f [0079.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.140] GetFileType (hFile=0x154) returned 0x1 [0079.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.140] GetFileType (hFile=0x154) returned 0x1 [0079.140] WriteFile (in: hFile=0x154, lpBuffer=0x1122d060*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1122d060*, lpNumberOfBytesWritten=0x2ae554*=0x1b760, lpOverlapped=0x0) returned 1 [0079.142] CloseHandle (hObject=0x154) returned 1 [0079.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", lpFilePart=0x0) returned 0x3f [0079.143] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.143] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce1b9e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b760)) returned 1 [0079.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.anonymous")) returned 1 [0079.143] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", lpFilePart=0x0) returned 0x3f [0079.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.143] GetFileType (hFile=0x154) returned 0x1 [0079.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.144] GetFileType (hFile=0x154) returned 0x1 [0079.144] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1779f [0079.144] ReadFile (in: hFile=0x154, lpBuffer=0x112487e0, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x112487e0*, lpNumberOfBytesRead=0x2ae560*=0x1779f, lpOverlapped=0x0) returned 1 [0079.148] CloseHandle (hObject=0x154) returned 1 [0079.174] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", lpFilePart=0x0) returned 0x3f [0079.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.176] GetFileType (hFile=0x154) returned 0x1 [0079.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.176] GetFileType (hFile=0x154) returned 0x1 [0079.176] WriteFile (in: hFile=0x154, lpBuffer=0x112bde40*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x112bde40*, lpNumberOfBytesWritten=0x2ae554*=0x177a0, lpOverlapped=0x0) returned 1 [0079.179] CloseHandle (hObject=0x154) returned 1 [0079.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", lpFilePart=0x0) returned 0x3f [0079.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.179] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce22c250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x177a0)) returned 1 [0079.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.anonymous")) returned 1 [0079.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", lpFilePart=0x0) returned 0x3f [0079.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.180] GetFileType (hFile=0x154) returned 0x1 [0079.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.180] GetFileType (hFile=0x154) returned 0x1 [0079.180] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x15b94 [0079.181] ReadFile (in: hFile=0x154, lpBuffer=0x112d5600, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x112d5600*, lpNumberOfBytesRead=0x2ae560*=0x15b94, lpOverlapped=0x0) returned 1 [0079.183] CloseHandle (hObject=0x154) returned 1 [0079.202] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", lpFilePart=0x0) returned 0x3f [0079.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.204] GetFileType (hFile=0x154) returned 0x1 [0079.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.204] GetFileType (hFile=0x154) returned 0x1 [0079.204] WriteFile (in: hFile=0x154, lpBuffer=0x11342050*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x11342050*, lpNumberOfBytesWritten=0x2ae554*=0x15ba0, lpOverlapped=0x0) returned 1 [0079.206] CloseHandle (hObject=0x154) returned 1 [0079.206] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", lpFilePart=0x0) returned 0x3f [0079.206] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce2523b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15ba0)) returned 1 [0079.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.anonymous")) returned 1 [0079.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", lpFilePart=0x0) returned 0x3f [0079.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.209] GetFileType (hFile=0x154) returned 0x1 [0079.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.209] GetFileType (hFile=0x154) returned 0x1 [0079.209] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x190e9 [0079.209] ReadFile (in: hFile=0x154, lpBuffer=0x11357c10, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x11357c10*, lpNumberOfBytesRead=0x2ae560*=0x190e9, lpOverlapped=0x0) returned 1 [0079.212] CloseHandle (hObject=0x154) returned 1 [0079.259] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", lpFilePart=0x0) returned 0x3f [0079.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.261] GetFileType (hFile=0x154) returned 0x1 [0079.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.261] GetFileType (hFile=0x154) returned 0x1 [0079.261] WriteFile (in: hFile=0x154, lpBuffer=0x113d50f8*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x113d50f8*, lpNumberOfBytesWritten=0x2ae554*=0x190f0, lpOverlapped=0x0) returned 1 [0079.263] CloseHandle (hObject=0x154) returned 1 [0079.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", lpFilePart=0x0) returned 0x3f [0079.263] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.263] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce2ea930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x190f0)) returned 1 [0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.anonymous")) returned 1 [0079.264] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", lpFilePart=0x0) returned 0x3f [0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.265] GetFileType (hFile=0x154) returned 0x1 [0079.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.265] GetFileType (hFile=0x154) returned 0x1 [0079.265] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x17b79 [0079.266] ReadFile (in: hFile=0x154, lpBuffer=0x113ee208, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x113ee208*, lpNumberOfBytesRead=0x2ae560*=0x17b79, lpOverlapped=0x0) returned 1 [0079.268] CloseHandle (hObject=0x154) returned 1 [0079.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", lpFilePart=0x0) returned 0x3f [0079.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.291] GetFileType (hFile=0x154) returned 0x1 [0079.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.291] GetFileType (hFile=0x154) returned 0x1 [0079.291] WriteFile (in: hFile=0x154, lpBuffer=0x11464bc0*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x11464bc0*, lpNumberOfBytesWritten=0x2ae554*=0x17b80, lpOverlapped=0x0) returned 1 [0079.294] CloseHandle (hObject=0x154) returned 1 [0079.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", lpFilePart=0x0) returned 0x3f [0079.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.294] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce336bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17b80)) returned 1 [0079.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.anonymous")) returned 1 [0079.295] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", lpFilePart=0x0) returned 0x3f [0079.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.295] GetFileType (hFile=0x154) returned 0x1 [0079.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.295] GetFileType (hFile=0x154) returned 0x1 [0079.295] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x14033 [0079.295] ReadFile (in: hFile=0x154, lpBuffer=0x1a405a8, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a405a8*, lpNumberOfBytesRead=0x2ae560*=0x14033, lpOverlapped=0x0) returned 1 [0079.297] CloseHandle (hObject=0x154) returned 1 [0079.312] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", lpFilePart=0x0) returned 0x3f [0079.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.314] GetFileType (hFile=0x154) returned 0x1 [0079.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.314] GetFileType (hFile=0x154) returned 0x1 [0079.314] WriteFile (in: hFile=0x154, lpBuffer=0x1ac9468*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ac9468*, lpNumberOfBytesWritten=0x2ae554*=0x14040, lpOverlapped=0x0) returned 1 [0079.317] CloseHandle (hObject=0x154) returned 1 [0079.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", lpFilePart=0x0) returned 0x3f [0079.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.317] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce382eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14040)) returned 1 [0079.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.anonymous")) returned 1 [0079.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", lpFilePart=0x0) returned 0x3f [0079.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.318] GetFileType (hFile=0x154) returned 0x1 [0079.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.318] GetFileType (hFile=0x154) returned 0x1 [0079.318] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd8f6 [0079.318] ReadFile (in: hFile=0x154, lpBuffer=0x1add8b4, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1add8b4*, lpNumberOfBytesRead=0x2ae560*=0xd8f6, lpOverlapped=0x0) returned 1 [0079.320] CloseHandle (hObject=0x154) returned 1 [0079.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", lpFilePart=0x0) returned 0x3f [0079.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.336] GetFileType (hFile=0x154) returned 0x1 [0079.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.336] GetFileType (hFile=0x154) returned 0x1 [0079.336] WriteFile (in: hFile=0x154, lpBuffer=0x1b531b4*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b531b4*, lpNumberOfBytesWritten=0x2ae554*=0xd900, lpOverlapped=0x0) returned 1 [0079.338] CloseHandle (hObject=0x154) returned 1 [0079.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", lpFilePart=0x0) returned 0x3f [0079.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.338] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce3a9010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd900)) returned 1 [0079.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.anonymous")) returned 1 [0079.339] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpFilePart=0x0) returned 0x3f [0079.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.339] GetFileType (hFile=0x154) returned 0x1 [0079.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.339] GetFileType (hFile=0x154) returned 0x1 [0079.339] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x11780 [0079.339] ReadFile (in: hFile=0x154, lpBuffer=0x1b60ec0, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b60ec0*, lpNumberOfBytesRead=0x2ae560*=0x11780, lpOverlapped=0x0) returned 1 [0079.341] CloseHandle (hObject=0x154) returned 1 [0079.386] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpFilePart=0x0) returned 0x3f [0079.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.388] GetFileType (hFile=0x154) returned 0x1 [0079.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.388] GetFileType (hFile=0x154) returned 0x1 [0079.388] WriteFile (in: hFile=0x154, lpBuffer=0x19f3abc*, nNumberOfBytesToWrite=0x11790, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19f3abc*, lpNumberOfBytesWritten=0x2ae554*=0x11790, lpOverlapped=0x0) returned 1 [0079.391] CloseHandle (hObject=0x154) returned 1 [0079.391] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", lpFilePart=0x0) returned 0x3f [0079.391] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.391] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce41b430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11790)) returned 1 [0079.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.anonymous")) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpFilePart=0x0) returned 0x3f [0079.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.392] GetFileType (hFile=0x154) returned 0x1 [0079.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.392] GetFileType (hFile=0x154) returned 0x1 [0079.392] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x787a [0079.393] ReadFile (in: hFile=0x154, lpBuffer=0x1a05658, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a05658*, lpNumberOfBytesRead=0x2ae560*=0x787a, lpOverlapped=0x0) returned 1 [0079.395] CloseHandle (hObject=0x154) returned 1 [0079.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpFilePart=0x0) returned 0x3f [0079.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.415] GetFileType (hFile=0x154) returned 0x1 [0079.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.415] GetFileType (hFile=0x154) returned 0x1 [0079.415] WriteFile (in: hFile=0x154, lpBuffer=0x1a78020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a78020*, lpNumberOfBytesWritten=0x2ae554*=0x7880, lpOverlapped=0x0) returned 1 [0079.417] CloseHandle (hObject=0x154) returned 1 [0079.417] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", lpFilePart=0x0) returned 0x3f [0079.417] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.418] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce4676f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7880)) returned 1 [0079.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.anonymous")) returned 1 [0079.418] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpFilePart=0x0) returned 0x3f [0079.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.419] GetFileType (hFile=0x154) returned 0x1 [0079.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.419] GetFileType (hFile=0x154) returned 0x1 [0079.419] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa91e [0079.419] ReadFile (in: hFile=0x154, lpBuffer=0x1a7fcac, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a7fcac*, lpNumberOfBytesRead=0x2ae560*=0xa91e, lpOverlapped=0x0) returned 1 [0079.421] CloseHandle (hObject=0x154) returned 1 [0079.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpFilePart=0x0) returned 0x3f [0079.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.443] GetFileType (hFile=0x154) returned 0x1 [0079.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.443] GetFileType (hFile=0x154) returned 0x1 [0079.443] WriteFile (in: hFile=0x154, lpBuffer=0x1aec60c*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aec60c*, lpNumberOfBytesWritten=0x2ae554*=0xa920, lpOverlapped=0x0) returned 1 [0079.446] CloseHandle (hObject=0x154) returned 1 [0079.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", lpFilePart=0x0) returned 0x3f [0079.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce4b39b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa920)) returned 1 [0079.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.anonymous")) returned 1 [0079.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpFilePart=0x0) returned 0x3f [0079.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.447] GetFileType (hFile=0x154) returned 0x1 [0079.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.447] GetFileType (hFile=0x154) returned 0x1 [0079.447] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3b43 [0079.447] ReadFile (in: hFile=0x154, lpBuffer=0x1af7338, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af7338*, lpNumberOfBytesRead=0x2ae560*=0x3b43, lpOverlapped=0x0) returned 1 [0079.449] CloseHandle (hObject=0x154) returned 1 [0079.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpFilePart=0x0) returned 0x3f [0079.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.470] GetFileType (hFile=0x154) returned 0x1 [0079.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.470] GetFileType (hFile=0x154) returned 0x1 [0079.470] WriteFile (in: hFile=0x154, lpBuffer=0x1b569b4*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b569b4*, lpNumberOfBytesWritten=0x2ae554*=0x3b50, lpOverlapped=0x0) returned 1 [0079.472] CloseHandle (hObject=0x154) returned 1 [0079.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", lpFilePart=0x0) returned 0x3f [0079.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.472] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce4d9b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b50)) returned 1 [0079.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.anonymous")) returned 1 [0079.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpFilePart=0x0) returned 0x3f [0079.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.475] GetFileType (hFile=0x154) returned 0x1 [0079.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.475] GetFileType (hFile=0x154) returned 0x1 [0079.475] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x396a [0079.476] ReadFile (in: hFile=0x154, lpBuffer=0x1b5a910, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b5a910*, lpNumberOfBytesRead=0x2ae560*=0x396a, lpOverlapped=0x0) returned 1 [0079.478] CloseHandle (hObject=0x154) returned 1 [0079.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpFilePart=0x0) returned 0x3f [0079.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.499] GetFileType (hFile=0x154) returned 0x1 [0079.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.499] GetFileType (hFile=0x154) returned 0x1 [0079.499] WriteFile (in: hFile=0x154, lpBuffer=0x1bb962c*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1bb962c*, lpNumberOfBytesWritten=0x2ae554*=0x3970, lpOverlapped=0x0) returned 1 [0079.500] CloseHandle (hObject=0x154) returned 1 [0079.501] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", lpFilePart=0x0) returned 0x3f [0079.501] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.501] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce525dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3970)) returned 1 [0079.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.anonymous")) returned 1 [0079.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", lpFilePart=0x0) returned 0x3f [0079.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.502] GetFileType (hFile=0x154) returned 0x1 [0079.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.502] GetFileType (hFile=0x154) returned 0x1 [0079.502] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x693e [0079.506] ReadFile (in: hFile=0x154, lpBuffer=0x19aa984, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19aa984*, lpNumberOfBytesRead=0x2ae560*=0x693e, lpOverlapped=0x0) returned 1 [0079.508] CloseHandle (hObject=0x154) returned 1 [0079.553] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", lpFilePart=0x0) returned 0x3f [0079.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.555] GetFileType (hFile=0x154) returned 0x1 [0079.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.555] GetFileType (hFile=0x154) returned 0x1 [0079.555] WriteFile (in: hFile=0x154, lpBuffer=0x1a1870c*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a1870c*, lpNumberOfBytesWritten=0x2ae554*=0x6940, lpOverlapped=0x0) returned 1 [0079.556] CloseHandle (hObject=0x154) returned 1 [0079.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", lpFilePart=0x0) returned 0x3f [0079.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.556] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce5be350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6940)) returned 1 [0079.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.anonymous")) returned 1 [0079.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", lpFilePart=0x0) returned 0x3f [0079.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.557] GetFileType (hFile=0x154) returned 0x1 [0079.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.557] GetFileType (hFile=0x154) returned 0x1 [0079.557] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xcb0a [0079.557] ReadFile (in: hFile=0x154, lpBuffer=0x1a1f458, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a1f458*, lpNumberOfBytesRead=0x2ae560*=0xcb0a, lpOverlapped=0x0) returned 1 [0079.559] CloseHandle (hObject=0x154) returned 1 [0079.573] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", lpFilePart=0x0) returned 0x3f [0079.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.574] GetFileType (hFile=0x154) returned 0x1 [0079.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.574] GetFileType (hFile=0x154) returned 0x1 [0079.574] WriteFile (in: hFile=0x154, lpBuffer=0x1a92388*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a92388*, lpNumberOfBytesWritten=0x2ae554*=0xcb10, lpOverlapped=0x0) returned 1 [0079.576] CloseHandle (hObject=0x154) returned 1 [0079.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", lpFilePart=0x0) returned 0x3f [0079.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.577] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce5e44b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcb10)) returned 1 [0079.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.anonymous")) returned 1 [0079.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", lpFilePart=0x0) returned 0x3f [0079.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.578] GetFileType (hFile=0x154) returned 0x1 [0079.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.578] GetFileType (hFile=0x154) returned 0x1 [0079.578] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6cec [0079.578] ReadFile (in: hFile=0x154, lpBuffer=0x1a9f2a4, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a9f2a4*, lpNumberOfBytesRead=0x2ae560*=0x6cec, lpOverlapped=0x0) returned 1 [0079.580] CloseHandle (hObject=0x154) returned 1 [0079.592] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", lpFilePart=0x0) returned 0x3f [0079.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.594] GetFileType (hFile=0x154) returned 0x1 [0079.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.594] GetFileType (hFile=0x154) returned 0x1 [0079.594] WriteFile (in: hFile=0x154, lpBuffer=0x1b0e13c*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b0e13c*, lpNumberOfBytesWritten=0x2ae554*=0x6cf0, lpOverlapped=0x0) returned 1 [0079.595] CloseHandle (hObject=0x154) returned 1 [0079.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", lpFilePart=0x0) returned 0x3f [0079.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.595] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce60a610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6cf0)) returned 1 [0079.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.anonymous")) returned 1 [0079.596] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", lpFilePart=0x0) returned 0x3f [0079.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.596] GetFileType (hFile=0x154) returned 0x1 [0079.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.596] GetFileType (hFile=0x154) returned 0x1 [0079.596] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x98c7 [0079.596] ReadFile (in: hFile=0x154, lpBuffer=0x1b15238, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b15238*, lpNumberOfBytesRead=0x2ae560*=0x98c7, lpOverlapped=0x0) returned 1 [0079.598] CloseHandle (hObject=0x154) returned 1 [0079.610] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", lpFilePart=0x0) returned 0x3f [0079.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.612] GetFileType (hFile=0x154) returned 0x1 [0079.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.612] GetFileType (hFile=0x154) returned 0x1 [0079.612] WriteFile (in: hFile=0x154, lpBuffer=0x1b91c34*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b91c34*, lpNumberOfBytesWritten=0x2ae554*=0x98d0, lpOverlapped=0x0) returned 1 [0079.614] CloseHandle (hObject=0x154) returned 1 [0079.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", lpFilePart=0x0) returned 0x3f [0079.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.616] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce6568d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x98d0)) returned 1 [0079.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.anonymous")) returned 1 [0079.617] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", lpFilePart=0x0) returned 0x3f [0079.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.618] GetFileType (hFile=0x154) returned 0x1 [0079.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.618] GetFileType (hFile=0x154) returned 0x1 [0079.618] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb9bf [0079.618] ReadFile (in: hFile=0x154, lpBuffer=0x1b9b910, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b9b910*, lpNumberOfBytesRead=0x2ae560*=0xb9bf, lpOverlapped=0x0) returned 1 [0079.621] CloseHandle (hObject=0x154) returned 1 [0079.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", lpFilePart=0x0) returned 0x3f [0079.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.661] GetFileType (hFile=0x154) returned 0x1 [0079.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.661] GetFileType (hFile=0x154) returned 0x1 [0079.661] WriteFile (in: hFile=0x154, lpBuffer=0x1a17048*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a17048*, lpNumberOfBytesWritten=0x2ae554*=0xb9c0, lpOverlapped=0x0) returned 1 [0079.663] CloseHandle (hObject=0x154) returned 1 [0079.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", lpFilePart=0x0) returned 0x3f [0079.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.663] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8bd9ebf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce6c8cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb9c0)) returned 1 [0079.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.anonymous")) returned 1 [0079.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", lpFilePart=0x0) returned 0x3f [0079.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.664] GetFileType (hFile=0x154) returned 0x1 [0079.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.664] GetFileType (hFile=0x154) returned 0x1 [0079.664] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x98ec [0079.664] ReadFile (in: hFile=0x154, lpBuffer=0x1a22e14, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a22e14*, lpNumberOfBytesRead=0x2ae560*=0x98ec, lpOverlapped=0x0) returned 1 [0079.670] CloseHandle (hObject=0x154) returned 1 [0079.682] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", lpFilePart=0x0) returned 0x3f [0079.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.684] GetFileType (hFile=0x154) returned 0x1 [0079.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.684] GetFileType (hFile=0x154) returned 0x1 [0079.684] WriteFile (in: hFile=0x154, lpBuffer=0x1a9fa08*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a9fa08*, lpNumberOfBytesWritten=0x2ae554*=0x98f0, lpOverlapped=0x0) returned 1 [0079.686] CloseHandle (hObject=0x154) returned 1 [0079.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", lpFilePart=0x0) returned 0x3f [0079.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce6eee50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x98f0)) returned 1 [0079.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.anonymous")) returned 1 [0079.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", lpFilePart=0x0) returned 0x3f [0079.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.687] GetFileType (hFile=0x154) returned 0x1 [0079.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.687] GetFileType (hFile=0x154) returned 0x1 [0079.687] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7df3 [0079.687] ReadFile (in: hFile=0x154, lpBuffer=0x1aa9704, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aa9704*, lpNumberOfBytesRead=0x2ae560*=0x7df3, lpOverlapped=0x0) returned 1 [0079.689] CloseHandle (hObject=0x154) returned 1 [0079.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", lpFilePart=0x0) returned 0x3f [0079.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.702] GetFileType (hFile=0x154) returned 0x1 [0079.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.702] GetFileType (hFile=0x154) returned 0x1 [0079.703] WriteFile (in: hFile=0x154, lpBuffer=0x1b1daf0*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b1daf0*, lpNumberOfBytesWritten=0x2ae554*=0x7e00, lpOverlapped=0x0) returned 1 [0079.704] CloseHandle (hObject=0x154) returned 1 [0079.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", lpFilePart=0x0) returned 0x3f [0079.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.704] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce714fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7e00)) returned 1 [0079.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.anonymous")) returned 1 [0079.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", lpFilePart=0x0) returned 0x3f [0079.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.705] GetFileType (hFile=0x154) returned 0x1 [0079.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.705] GetFileType (hFile=0x154) returned 0x1 [0079.705] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x351c [0079.705] ReadFile (in: hFile=0x154, lpBuffer=0x1b25cfc, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b25cfc*, lpNumberOfBytesRead=0x2ae560*=0x351c, lpOverlapped=0x0) returned 1 [0079.707] CloseHandle (hObject=0x154) returned 1 [0079.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", lpFilePart=0x0) returned 0x3f [0079.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.720] GetFileType (hFile=0x154) returned 0x1 [0079.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.720] GetFileType (hFile=0x154) returned 0x1 [0079.720] WriteFile (in: hFile=0x154, lpBuffer=0x1b83484*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b83484*, lpNumberOfBytesWritten=0x2ae554*=0x3520, lpOverlapped=0x0) returned 1 [0079.722] CloseHandle (hObject=0x154) returned 1 [0079.722] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", lpFilePart=0x0) returned 0x3f [0079.722] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.722] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed91300, ftCreationTime.dwHighDateTime=0x1c97c19, ftLastAccessTime.dwLowDateTime=0x7b9445b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce73b110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3520)) returned 1 [0079.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.anonymous")) returned 1 [0079.723] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", lpFilePart=0x0) returned 0x3f [0079.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.724] GetFileType (hFile=0x154) returned 0x1 [0079.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.724] GetFileType (hFile=0x154) returned 0x1 [0079.724] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x211bb [0079.724] ReadFile (in: hFile=0x154, lpBuffer=0x115284e0, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x115284e0*, lpNumberOfBytesRead=0x2ae560*=0x211bb, lpOverlapped=0x0) returned 1 [0079.744] CloseHandle (hObject=0x154) returned 1 [0079.790] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", lpFilePart=0x0) returned 0x3f [0079.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.792] GetFileType (hFile=0x154) returned 0x1 [0079.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.793] GetFileType (hFile=0x154) returned 0x1 [0079.793] WriteFile (in: hFile=0x154, lpBuffer=0x115cddd8*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x115cddd8*, lpNumberOfBytesWritten=0x2ae554*=0x211c0, lpOverlapped=0x0) returned 1 [0079.796] CloseHandle (hObject=0x154) returned 1 [0079.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", lpFilePart=0x0) returned 0x3f [0079.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.796] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8fbceab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce7f97f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x211c0)) returned 1 [0079.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.anonymous")) returned 1 [0079.797] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", lpFilePart=0x0) returned 0x3f [0079.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.797] GetFileType (hFile=0x154) returned 0x1 [0079.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.797] GetFileType (hFile=0x154) returned 0x1 [0079.797] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa202 [0079.798] ReadFile (in: hFile=0x154, lpBuffer=0x19c9af8, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c9af8*, lpNumberOfBytesRead=0x2ae560*=0xa202, lpOverlapped=0x0) returned 1 [0079.827] CloseHandle (hObject=0x154) returned 1 [0079.840] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", lpFilePart=0x0) returned 0x3f [0079.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.842] GetFileType (hFile=0x154) returned 0x1 [0079.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.842] GetFileType (hFile=0x154) returned 0x1 [0079.842] WriteFile (in: hFile=0x154, lpBuffer=0x1a49490*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a49490*, lpNumberOfBytesWritten=0x2ae554*=0xa210, lpOverlapped=0x0) returned 1 [0079.843] CloseHandle (hObject=0x154) returned 1 [0079.843] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", lpFilePart=0x0) returned 0x3f [0079.843] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.844] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x627f1a00, ftCreationTime.dwHighDateTime=0x1bd5112, ftLastAccessTime.dwLowDateTime=0x81f79650, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce86bc10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa210)) returned 1 [0079.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.anonymous")) returned 1 [0079.844] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", lpFilePart=0x0) returned 0x3f [0079.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.844] GetFileType (hFile=0x154) returned 0x1 [0079.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.845] GetFileType (hFile=0x154) returned 0x1 [0079.845] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x18be [0079.845] ReadFile (in: hFile=0x154, lpBuffer=0x1a53aac, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a53aac*, lpNumberOfBytesRead=0x2ae560*=0x18be, lpOverlapped=0x0) returned 1 [0079.918] CloseHandle (hObject=0x154) returned 1 [0079.931] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", lpFilePart=0x0) returned 0x3f [0079.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.933] GetFileType (hFile=0x154) returned 0x1 [0079.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.933] GetFileType (hFile=0x154) returned 0x1 [0079.933] WriteFile (in: hFile=0x154, lpBuffer=0x1aa8458*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aa8458*, lpNumberOfBytesWritten=0x2ae554*=0x18c0, lpOverlapped=0x0) returned 1 [0079.934] CloseHandle (hObject=0x154) returned 1 [0079.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", lpFilePart=0x0) returned 0x3f [0079.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.934] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8fbceab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce950450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18c0)) returned 1 [0079.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.anonymous")) returned 1 [0079.935] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", lpFilePart=0x0) returned 0x3f [0079.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.935] GetFileType (hFile=0x154) returned 0x1 [0079.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.935] GetFileType (hFile=0x154) returned 0x1 [0079.935] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1c94 [0079.935] ReadFile (in: hFile=0x154, lpBuffer=0x1aaa124, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aaa124*, lpNumberOfBytesRead=0x2ae560*=0x1c94, lpOverlapped=0x0) returned 1 [0079.939] CloseHandle (hObject=0x154) returned 1 [0079.951] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", lpFilePart=0x0) returned 0x3f [0079.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.952] GetFileType (hFile=0x154) returned 0x1 [0079.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.952] GetFileType (hFile=0x154) returned 0x1 [0079.952] WriteFile (in: hFile=0x154, lpBuffer=0x1affe2c*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1affe2c*, lpNumberOfBytesWritten=0x2ae554*=0x1ca0, lpOverlapped=0x0) returned 1 [0079.953] CloseHandle (hObject=0x154) returned 1 [0079.954] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", lpFilePart=0x0) returned 0x3f [0079.954] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.954] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81f79650, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce9765b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0)) returned 1 [0079.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.anonymous")) returned 1 [0079.955] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", lpFilePart=0x0) returned 0x3f [0079.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.955] GetFileType (hFile=0x154) returned 0x1 [0079.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.955] GetFileType (hFile=0x154) returned 0x1 [0079.955] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1764 [0079.955] ReadFile (in: hFile=0x154, lpBuffer=0x1b01f08, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b01f08*, lpNumberOfBytesRead=0x2ae560*=0x1764, lpOverlapped=0x0) returned 1 [0079.957] CloseHandle (hObject=0x154) returned 1 [0079.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", lpFilePart=0x0) returned 0x3f [0079.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0079.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.970] GetFileType (hFile=0x154) returned 0x1 [0079.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0079.970] GetFileType (hFile=0x154) returned 0x1 [0079.970] WriteFile (in: hFile=0x154, lpBuffer=0x1b56220*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b56220*, lpNumberOfBytesWritten=0x2ae554*=0x1770, lpOverlapped=0x0) returned 1 [0079.971] CloseHandle (hObject=0x154) returned 1 [0079.971] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", lpFilePart=0x0) returned 0x3f [0079.971] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0079.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0079.972] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81f79650, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xce99c710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1770)) returned 1 [0079.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0079.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.anonymous")) returned 1 [0079.972] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", lpFilePart=0x0) returned 0x3f [0079.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0079.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0079.973] GetFileType (hFile=0x154) returned 0x1 [0079.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0079.973] GetFileType (hFile=0x154) returned 0x1 [0079.973] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9abe [0079.973] ReadFile (in: hFile=0x154, lpBuffer=0x1b57e44, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b57e44*, lpNumberOfBytesRead=0x2ae560*=0x9abe, lpOverlapped=0x0) returned 1 [0079.975] CloseHandle (hObject=0x154) returned 1 [0080.013] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", lpFilePart=0x0) returned 0x3f [0080.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.014] GetFileType (hFile=0x154) returned 0x1 [0080.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.014] GetFileType (hFile=0x154) returned 0x1 [0080.014] WriteFile (in: hFile=0x154, lpBuffer=0x19ded1c*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19ded1c*, lpNumberOfBytesWritten=0x2ae554*=0x9ac0, lpOverlapped=0x0) returned 1 [0080.016] CloseHandle (hObject=0x154) returned 1 [0080.016] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", lpFilePart=0x0) returned 0x3f [0080.016] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.016] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad8bc00, ftCreationTime.dwHighDateTime=0x1bd4ec4, ftLastAccessTime.dwLowDateTime=0x8fbceab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcea0eb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9ac0)) returned 1 [0080.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.anonymous")) returned 1 [0080.017] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", lpFilePart=0x0) returned 0x3f [0080.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.018] GetFileType (hFile=0x154) returned 0x1 [0080.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.018] GetFileType (hFile=0x154) returned 0x1 [0080.018] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x451e [0080.018] ReadFile (in: hFile=0x154, lpBuffer=0x19e8be8, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e8be8*, lpNumberOfBytesRead=0x2ae560*=0x451e, lpOverlapped=0x0) returned 1 [0080.046] CloseHandle (hObject=0x154) returned 1 [0080.058] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", lpFilePart=0x0) returned 0x3f [0080.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.059] GetFileType (hFile=0x154) returned 0x1 [0080.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.059] GetFileType (hFile=0x154) returned 0x1 [0080.060] WriteFile (in: hFile=0x154, lpBuffer=0x1a4b4d0*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a4b4d0*, lpNumberOfBytesWritten=0x2ae554*=0x4520, lpOverlapped=0x0) returned 1 [0080.061] CloseHandle (hObject=0x154) returned 1 [0080.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", lpFilePart=0x0) returned 0x3f [0080.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.061] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81f79650, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcea80f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4520)) returned 1 [0080.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.anonymous")) returned 1 [0080.062] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", lpFilePart=0x0) returned 0x3f [0080.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.062] GetFileType (hFile=0x154) returned 0x1 [0080.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.062] GetFileType (hFile=0x154) returned 0x1 [0080.062] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x6afc [0080.063] ReadFile (in: hFile=0x154, lpBuffer=0x1a4fe2c, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a4fe2c*, lpNumberOfBytesRead=0x2ae560*=0x6afc, lpOverlapped=0x0) returned 1 [0080.064] CloseHandle (hObject=0x154) returned 1 [0080.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", lpFilePart=0x0) returned 0x3f [0080.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.078] GetFileType (hFile=0x154) returned 0x1 [0080.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.078] GetFileType (hFile=0x154) returned 0x1 [0080.078] WriteFile (in: hFile=0x154, lpBuffer=0x1abe314*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1abe314*, lpNumberOfBytesWritten=0x2ae554*=0x6b00, lpOverlapped=0x0) returned 1 [0080.079] CloseHandle (hObject=0x154) returned 1 [0080.079] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", lpFilePart=0x0) returned 0x3f [0080.079] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.079] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8861b000, ftCreationTime.dwHighDateTime=0x1bd4ec1, ftLastAccessTime.dwLowDateTime=0x8fbceab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xceaa70b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6b00)) returned 1 [0080.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.anonymous")) returned 1 [0080.080] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", lpFilePart=0x0) returned 0x3f [0080.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.080] GetFileType (hFile=0x154) returned 0x1 [0080.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.080] GetFileType (hFile=0x154) returned 0x1 [0080.080] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7297 [0080.080] ReadFile (in: hFile=0x154, lpBuffer=0x1ac5250, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ac5250*, lpNumberOfBytesRead=0x2ae560*=0x7297, lpOverlapped=0x0) returned 1 [0080.088] CloseHandle (hObject=0x154) returned 1 [0080.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", lpFilePart=0x0) returned 0x3f [0080.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.102] GetFileType (hFile=0x154) returned 0x1 [0080.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.102] GetFileType (hFile=0x154) returned 0x1 [0080.102] WriteFile (in: hFile=0x154, lpBuffer=0x1b35d5c*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b35d5c*, lpNumberOfBytesWritten=0x2ae554*=0x72a0, lpOverlapped=0x0) returned 1 [0080.104] CloseHandle (hObject=0x154) returned 1 [0080.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", lpFilePart=0x0) returned 0x3f [0080.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.104] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e78ca00, ftCreationTime.dwHighDateTime=0x1bd4ec1, ftLastAccessTime.dwLowDateTime=0x8fbf4c10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xceaf3370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x72a0)) returned 1 [0080.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.anonymous")) returned 1 [0080.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", lpFilePart=0x0) returned 0x3f [0080.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.105] GetFileType (hFile=0x154) returned 0x1 [0080.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.105] GetFileType (hFile=0x154) returned 0x1 [0080.105] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdd5 [0080.105] ReadFile (in: hFile=0x154, lpBuffer=0x1b3e27c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b3e27c*, lpNumberOfBytesRead=0x2ae560*=0xdd5, lpOverlapped=0x0) returned 1 [0080.107] CloseHandle (hObject=0x154) returned 1 [0080.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", lpFilePart=0x0) returned 0x3f [0080.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.120] GetFileType (hFile=0x154) returned 0x1 [0080.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.120] GetFileType (hFile=0x154) returned 0x1 [0080.120] WriteFile (in: hFile=0x154, lpBuffer=0x1b906ec*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b906ec*, lpNumberOfBytesWritten=0x2ae528*=0xde0, lpOverlapped=0x0) returned 1 [0080.121] CloseHandle (hObject=0x154) returned 1 [0080.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", lpFilePart=0x0) returned 0x3f [0080.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81f9f7b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xceb194d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xde0)) returned 1 [0080.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.anonymous")) returned 1 [0080.122] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", lpFilePart=0x0) returned 0x3f [0080.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.123] GetFileType (hFile=0x154) returned 0x1 [0080.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.123] GetFileType (hFile=0x154) returned 0x1 [0080.123] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8499 [0080.123] ReadFile (in: hFile=0x154, lpBuffer=0x1b91a48, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b91a48*, lpNumberOfBytesRead=0x2ae560*=0x8499, lpOverlapped=0x0) returned 1 [0080.146] CloseHandle (hObject=0x154) returned 1 [0080.184] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", lpFilePart=0x0) returned 0x3f [0080.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.185] GetFileType (hFile=0x154) returned 0x1 [0080.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.185] GetFileType (hFile=0x154) returned 0x1 [0080.186] WriteFile (in: hFile=0x154, lpBuffer=0x1a068d0*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a068d0*, lpNumberOfBytesWritten=0x2ae554*=0x84a0, lpOverlapped=0x0) returned 1 [0080.187] CloseHandle (hObject=0x154) returned 1 [0080.187] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", lpFilePart=0x0) returned 0x3f [0080.187] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e6c300, ftCreationTime.dwHighDateTime=0x1bd4eb7, ftLastAccessTime.dwLowDateTime=0x8fbf4c10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcebb1a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x84a0)) returned 1 [0080.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.anonymous")) returned 1 [0080.188] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpFilePart=0x0) returned 0x3f [0080.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.192] GetFileType (hFile=0x154) returned 0x1 [0080.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.192] GetFileType (hFile=0x154) returned 0x1 [0080.192] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa0d2 [0080.192] ReadFile (in: hFile=0x154, lpBuffer=0x1a0f3bc, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0f3bc*, lpNumberOfBytesRead=0x2ae560*=0xa0d2, lpOverlapped=0x0) returned 1 [0080.218] CloseHandle (hObject=0x154) returned 1 [0080.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpFilePart=0x0) returned 0x3f [0080.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.232] GetFileType (hFile=0x154) returned 0x1 [0080.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.232] GetFileType (hFile=0x154) returned 0x1 [0080.232] WriteFile (in: hFile=0x154, lpBuffer=0x1a8e764*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a8e764*, lpNumberOfBytesWritten=0x2ae554*=0xa0e0, lpOverlapped=0x0) returned 1 [0080.233] CloseHandle (hObject=0x154) returned 1 [0080.234] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", lpFilePart=0x0) returned 0x3f [0080.234] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.234] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8578600, ftCreationTime.dwHighDateTime=0x1bd4eb6, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcec23e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0e0)) returned 1 [0080.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.anonymous")) returned 1 [0080.235] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpFilePart=0x0) returned 0x3f [0080.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.235] GetFileType (hFile=0x154) returned 0x1 [0080.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.235] GetFileType (hFile=0x154) returned 0x1 [0080.235] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc5d7 [0080.235] ReadFile (in: hFile=0x154, lpBuffer=0x1a98c50, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a98c50*, lpNumberOfBytesRead=0x2ae560*=0xc5d7, lpOverlapped=0x0) returned 1 [0080.237] CloseHandle (hObject=0x154) returned 1 [0080.250] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpFilePart=0x0) returned 0x3f [0080.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.252] GetFileType (hFile=0x154) returned 0x1 [0080.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.252] GetFileType (hFile=0x154) returned 0x1 [0080.252] WriteFile (in: hFile=0x154, lpBuffer=0x1b0abf0*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b0abf0*, lpNumberOfBytesWritten=0x2ae554*=0xc5e0, lpOverlapped=0x0) returned 1 [0080.254] CloseHandle (hObject=0x154) returned 1 [0080.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", lpFilePart=0x0) returned 0x3f [0080.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.254] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e51b00, ftCreationTime.dwHighDateTime=0x1bd4eb5, ftLastAccessTime.dwLowDateTime=0x8fc40ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcec70130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc5e0)) returned 1 [0080.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.anonymous")) returned 1 [0080.255] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpFilePart=0x0) returned 0x3f [0080.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.255] GetFileType (hFile=0x154) returned 0x1 [0080.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.255] GetFileType (hFile=0x154) returned 0x1 [0080.255] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf438 [0080.255] ReadFile (in: hFile=0x154, lpBuffer=0x1b175dc, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b175dc*, lpNumberOfBytesRead=0x2ae560*=0xf438, lpOverlapped=0x0) returned 1 [0080.303] CloseHandle (hObject=0x154) returned 1 [0080.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpFilePart=0x0) returned 0x3f [0080.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.320] GetFileType (hFile=0x154) returned 0x1 [0080.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.320] GetFileType (hFile=0x154) returned 0x1 [0080.320] WriteFile (in: hFile=0x154, lpBuffer=0x1b92098*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b92098*, lpNumberOfBytesWritten=0x2ae554*=0xf440, lpOverlapped=0x0) returned 1 [0080.322] CloseHandle (hObject=0x154) returned 1 [0080.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", lpFilePart=0x0) returned 0x3f [0080.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.322] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164d5900, ftCreationTime.dwHighDateTime=0x1bd4c7e, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xced086b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf440)) returned 1 [0080.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.anonymous")) returned 1 [0080.323] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", lpFilePart=0x0) returned 0x3f [0080.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.324] GetFileType (hFile=0x154) returned 0x1 [0080.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.324] GetFileType (hFile=0x154) returned 0x1 [0080.324] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c45 [0080.324] ReadFile (in: hFile=0x154, lpBuffer=0x1ba18fc, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ba18fc*, lpNumberOfBytesRead=0x2ae560*=0x3c45, lpOverlapped=0x0) returned 1 [0080.325] CloseHandle (hObject=0x154) returned 1 [0080.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", lpFilePart=0x0) returned 0x3f [0080.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.364] GetFileType (hFile=0x154) returned 0x1 [0080.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.364] GetFileType (hFile=0x154) returned 0x1 [0080.364] WriteFile (in: hFile=0x154, lpBuffer=0x19fcbe8*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19fcbe8*, lpNumberOfBytesWritten=0x2ae554*=0x3c50, lpOverlapped=0x0) returned 1 [0080.365] CloseHandle (hObject=0x154) returned 1 [0080.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", lpFilePart=0x0) returned 0x3f [0080.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.365] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xced7aad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c50)) returned 1 [0080.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.anonymous")) returned 1 [0080.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", lpFilePart=0x0) returned 0x3f [0080.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.367] GetFileType (hFile=0x154) returned 0x1 [0080.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.367] GetFileType (hFile=0x154) returned 0x1 [0080.367] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x78af [0080.367] ReadFile (in: hFile=0x154, lpBuffer=0x1a00c8c, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a00c8c*, lpNumberOfBytesRead=0x2ae560*=0x78af, lpOverlapped=0x0) returned 1 [0080.368] CloseHandle (hObject=0x154) returned 1 [0080.381] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", lpFilePart=0x0) returned 0x3f [0080.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.382] GetFileType (hFile=0x154) returned 0x1 [0080.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.382] GetFileType (hFile=0x154) returned 0x1 [0080.382] WriteFile (in: hFile=0x154, lpBuffer=0x1a73744*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a73744*, lpNumberOfBytesWritten=0x2ae554*=0x78b0, lpOverlapped=0x0) returned 1 [0080.384] CloseHandle (hObject=0x154) returned 1 [0080.384] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", lpFilePart=0x0) returned 0x3f [0080.384] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.385] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8fc40ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xceda0c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x78b0)) returned 1 [0080.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.anonymous")) returned 1 [0080.385] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", lpFilePart=0x0) returned 0x3f [0080.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.386] GetFileType (hFile=0x154) returned 0x1 [0080.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.386] GetFileType (hFile=0x154) returned 0x1 [0080.386] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7450 [0080.386] ReadFile (in: hFile=0x154, lpBuffer=0x1a7b400, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a7b400*, lpNumberOfBytesRead=0x2ae560*=0x7450, lpOverlapped=0x0) returned 1 [0080.388] CloseHandle (hObject=0x154) returned 1 [0080.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", lpFilePart=0x0) returned 0x3f [0080.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.403] GetFileType (hFile=0x154) returned 0x1 [0080.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.403] GetFileType (hFile=0x154) returned 0x1 [0080.403] WriteFile (in: hFile=0x154, lpBuffer=0x1aec7c8*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aec7c8*, lpNumberOfBytesWritten=0x2ae554*=0x7460, lpOverlapped=0x0) returned 1 [0080.404] CloseHandle (hObject=0x154) returned 1 [0080.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", lpFilePart=0x0) returned 0x3f [0080.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.405] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8fc40ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcedc6d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7460)) returned 1 [0080.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.anonymous")) returned 1 [0080.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", lpFilePart=0x0) returned 0x3f [0080.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.406] GetFileType (hFile=0x154) returned 0x1 [0080.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.406] GetFileType (hFile=0x154) returned 0x1 [0080.406] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa343 [0080.406] ReadFile (in: hFile=0x154, lpBuffer=0x1af4034, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af4034*, lpNumberOfBytesRead=0x2ae560*=0xa343, lpOverlapped=0x0) returned 1 [0080.408] CloseHandle (hObject=0x154) returned 1 [0080.421] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", lpFilePart=0x0) returned 0x3f [0080.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.422] GetFileType (hFile=0x154) returned 0x1 [0080.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.423] GetFileType (hFile=0x154) returned 0x1 [0080.423] WriteFile (in: hFile=0x154, lpBuffer=0x1b73eb0*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b73eb0*, lpNumberOfBytesWritten=0x2ae554*=0xa350, lpOverlapped=0x0) returned 1 [0080.424] CloseHandle (hObject=0x154) returned 1 [0080.424] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", lpFilePart=0x0) returned 0x3f [0080.425] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.425] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8fc40ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcee13050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa350)) returned 1 [0080.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.anonymous")) returned 1 [0080.425] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpFilePart=0x0) returned 0x3f [0080.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.426] GetFileType (hFile=0x154) returned 0x1 [0080.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.426] GetFileType (hFile=0x154) returned 0x1 [0080.426] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa445 [0080.426] ReadFile (in: hFile=0x154, lpBuffer=0x1b7e60c, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b7e60c*, lpNumberOfBytesRead=0x2ae560*=0xa445, lpOverlapped=0x0) returned 1 [0080.429] CloseHandle (hObject=0x154) returned 1 [0080.468] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpFilePart=0x0) returned 0x3f [0080.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.471] GetFileType (hFile=0x154) returned 0x1 [0080.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.471] GetFileType (hFile=0x154) returned 0x1 [0080.471] WriteFile (in: hFile=0x154, lpBuffer=0x1a05180*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a05180*, lpNumberOfBytesWritten=0x2ae554*=0xa450, lpOverlapped=0x0) returned 1 [0080.474] CloseHandle (hObject=0x154) returned 1 [0080.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", lpFilePart=0x0) returned 0x3f [0080.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.474] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcee85470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa450)) returned 1 [0080.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.anonymous")) returned 1 [0080.475] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpFilePart=0x0) returned 0x3f [0080.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.476] GetFileType (hFile=0x154) returned 0x1 [0080.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.476] GetFileType (hFile=0x154) returned 0x1 [0080.476] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2ba2 [0080.476] ReadFile (in: hFile=0x154, lpBuffer=0x1a0f9dc, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0f9dc*, lpNumberOfBytesRead=0x2ae560*=0x2ba2, lpOverlapped=0x0) returned 1 [0080.478] CloseHandle (hObject=0x154) returned 1 [0080.491] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpFilePart=0x0) returned 0x3f [0080.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.492] GetFileType (hFile=0x154) returned 0x1 [0080.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.493] GetFileType (hFile=0x154) returned 0x1 [0080.493] WriteFile (in: hFile=0x154, lpBuffer=0x1a6a394*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a6a394*, lpNumberOfBytesWritten=0x2ae554*=0x2bb0, lpOverlapped=0x0) returned 1 [0080.494] CloseHandle (hObject=0x154) returned 1 [0080.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", lpFilePart=0x0) returned 0x3f [0080.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.494] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xceeab5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2bb0)) returned 1 [0080.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.anonymous")) returned 1 [0080.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpFilePart=0x0) returned 0x3f [0080.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.495] GetFileType (hFile=0x154) returned 0x1 [0080.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.495] GetFileType (hFile=0x154) returned 0x1 [0080.495] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x321f [0080.495] ReadFile (in: hFile=0x154, lpBuffer=0x1a6d350, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a6d350*, lpNumberOfBytesRead=0x2ae560*=0x321f, lpOverlapped=0x0) returned 1 [0080.497] CloseHandle (hObject=0x154) returned 1 [0080.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpFilePart=0x0) returned 0x3f [0080.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.510] GetFileType (hFile=0x154) returned 0x1 [0080.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.510] GetFileType (hFile=0x154) returned 0x1 [0080.511] WriteFile (in: hFile=0x154, lpBuffer=0x1ac9bdc*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ac9bdc*, lpNumberOfBytesWritten=0x2ae554*=0x3220, lpOverlapped=0x0) returned 1 [0080.512] CloseHandle (hObject=0x154) returned 1 [0080.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", lpFilePart=0x0) returned 0x3f [0080.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x8fc67030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xceed1730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3220)) returned 1 [0080.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.anonymous")) returned 1 [0080.513] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpFilePart=0x0) returned 0x3f [0080.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.513] GetFileType (hFile=0x154) returned 0x1 [0080.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.513] GetFileType (hFile=0x154) returned 0x1 [0080.513] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xbdae [0080.513] ReadFile (in: hFile=0x154, lpBuffer=0x1acd208, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1acd208*, lpNumberOfBytesRead=0x2ae560*=0xbdae, lpOverlapped=0x0) returned 1 [0080.536] CloseHandle (hObject=0x154) returned 1 [0080.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpFilePart=0x0) returned 0x3f [0080.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.552] GetFileType (hFile=0x154) returned 0x1 [0080.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.552] GetFileType (hFile=0x154) returned 0x1 [0080.552] WriteFile (in: hFile=0x154, lpBuffer=0x1b3d918*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b3d918*, lpNumberOfBytesWritten=0x2ae554*=0xbdb0, lpOverlapped=0x0) returned 1 [0080.553] CloseHandle (hObject=0x154) returned 1 [0080.554] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", lpFilePart=0x0) returned 0x3f [0080.554] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.anonymous", lpFilePart=0x0) returned 0x49 [0080.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.554] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcb2d00, ftCreationTime.dwHighDateTime=0x1c7a7ca, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcef43b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbdb0)) returned 1 [0080.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.anonymous")) returned 1 [0080.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0080.554] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\Publisher", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher", lpFilePart=0x0) returned 0x33 [0080.555] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\", lpFilePart=0x0) returned 0x34 [0080.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0080.555] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.556] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.556] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0080.556] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0080.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0080.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0080.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\Publisher", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher", lpFilePart=0x0) returned 0x33 [0080.556] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\", lpFilePart=0x0) returned 0x34 [0080.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0080.556] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.556] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.556] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0080.557] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0080.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0080.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0080.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds", lpFilePart=0x0) returned 0x3f [0080.557] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpFilePart=0x0) returned 0x40 [0080.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0080.571] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.572] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.573] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.574] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.575] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.575] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.575] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0080.575] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0080.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0080.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds", lpFilePart=0x0) returned 0x3f [0080.576] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\", lpFilePart=0x0) returned 0x40 [0080.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0080.577] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.577] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.577] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.577] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.578] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.579] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.580] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.580] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.580] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.580] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.580] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.580] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.581] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.581] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.581] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.581] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.581] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.581] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.582] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.582] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.582] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.582] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.582] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0080.582] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0080.582] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0080.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0080.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14", lpFilePart=0x0) returned 0x34 [0080.583] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpFilePart=0x0) returned 0x35 [0080.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0080.607] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.609] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.609] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.609] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.609] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.609] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.609] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.610] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.611] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.612] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.613] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0080.614] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0080.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0080.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0080.615] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14", lpFilePart=0x0) returned 0x34 [0080.615] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", lpFilePart=0x0) returned 0x35 [0080.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.616] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.617] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0080.618] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0080.618] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0080.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0080.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0080.619] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors", lpFilePart=0x0) returned 0x41 [0080.619] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpFilePart=0x0) returned 0x42 [0080.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0080.621] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.622] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.623] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0080.623] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0080.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0080.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0080.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors", lpFilePart=0x0) returned 0x41 [0080.624] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", lpFilePart=0x0) returned 0x42 [0080.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.625] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.626] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0080.627] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0080.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0080.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0080.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", lpFilePart=0x0) returned 0x4f [0080.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.654] GetFileType (hFile=0x154) returned 0x1 [0080.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.654] GetFileType (hFile=0x154) returned 0x1 [0080.654] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3a0 [0080.667] CloseHandle (hObject=0x154) returned 1 [0080.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", lpFilePart=0x0) returned 0x4f [0080.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.706] GetFileType (hFile=0x154) returned 0x1 [0080.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.706] GetFileType (hFile=0x154) returned 0x1 [0080.707] CloseHandle (hObject=0x154) returned 1 [0080.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", lpFilePart=0x0) returned 0x4f [0080.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.anonymous", lpFilePart=0x0) returned 0x59 [0080.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.707] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ad9900, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c3dbd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf0c0910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0080.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.anonymous")) returned 1 [0080.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", lpFilePart=0x0) returned 0x4c [0080.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.711] GetFileType (hFile=0x154) returned 0x1 [0080.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.711] GetFileType (hFile=0x154) returned 0x1 [0080.711] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x39d [0080.713] CloseHandle (hObject=0x154) returned 1 [0080.724] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", lpFilePart=0x0) returned 0x4c [0080.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.725] GetFileType (hFile=0x154) returned 0x1 [0080.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.725] GetFileType (hFile=0x154) returned 0x1 [0080.725] WriteFile (in: hFile=0x154, lpBuffer=0x1a026dc*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a026dc*, lpNumberOfBytesWritten=0x2ae528*=0x3a0, lpOverlapped=0x0) returned 1 [0080.726] CloseHandle (hObject=0x154) returned 1 [0080.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", lpFilePart=0x0) returned 0x4c [0080.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.anonymous", lpFilePart=0x0) returned 0x56 [0080.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.727] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9412000, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c3dbd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf0e6a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0080.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.anonymous")) returned 1 [0080.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", lpFilePart=0x0) returned 0x4a [0080.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.728] GetFileType (hFile=0x154) returned 0x1 [0080.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.728] GetFileType (hFile=0x154) returned 0x1 [0080.728] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3bf [0080.731] CloseHandle (hObject=0x154) returned 1 [0080.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", lpFilePart=0x0) returned 0x4a [0080.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.745] GetFileType (hFile=0x154) returned 0x1 [0080.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.745] GetFileType (hFile=0x154) returned 0x1 [0080.745] WriteFile (in: hFile=0x154, lpBuffer=0x1a52fe0*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a52fe0*, lpNumberOfBytesWritten=0x2ae528*=0x3c0, lpOverlapped=0x0) returned 1 [0080.748] CloseHandle (hObject=0x154) returned 1 [0080.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", lpFilePart=0x0) returned 0x4a [0080.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.anonymous", lpFilePart=0x0) returned 0x54 [0080.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.748] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x564f8900, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf10cbd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0080.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.anonymous")) returned 1 [0080.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", lpFilePart=0x0) returned 0x50 [0080.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.749] GetFileType (hFile=0x154) returned 0x1 [0080.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.749] GetFileType (hFile=0x154) returned 0x1 [0080.749] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c5 [0080.759] CloseHandle (hObject=0x154) returned 1 [0080.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", lpFilePart=0x0) returned 0x50 [0080.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.772] GetFileType (hFile=0x154) returned 0x1 [0080.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.773] GetFileType (hFile=0x154) returned 0x1 [0080.774] CloseHandle (hObject=0x154) returned 1 [0080.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", lpFilePart=0x0) returned 0x50 [0080.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.anonymous", lpFilePart=0x0) returned 0x5a [0080.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.774] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x944cad00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f53a50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf158e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.anonymous")) returned 1 [0080.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", lpFilePart=0x0) returned 0x4c [0080.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.775] GetFileType (hFile=0x154) returned 0x1 [0080.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.775] GetFileType (hFile=0x154) returned 0x1 [0080.775] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0080.777] CloseHandle (hObject=0x154) returned 1 [0080.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", lpFilePart=0x0) returned 0x4c [0080.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.790] GetFileType (hFile=0x154) returned 0x1 [0080.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.790] GetFileType (hFile=0x154) returned 0x1 [0080.791] CloseHandle (hObject=0x154) returned 1 [0080.791] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", lpFilePart=0x0) returned 0x4c [0080.791] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.anonymous", lpFilePart=0x0) returned 0x56 [0080.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.791] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e31000, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f53a50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf17eff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.anonymous")) returned 1 [0080.792] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", lpFilePart=0x0) returned 0x4c [0080.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.792] GetFileType (hFile=0x154) returned 0x1 [0080.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.792] GetFileType (hFile=0x154) returned 0x1 [0080.792] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0080.794] CloseHandle (hObject=0x154) returned 1 [0080.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", lpFilePart=0x0) returned 0x4c [0080.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.807] GetFileType (hFile=0x154) returned 0x1 [0080.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.807] GetFileType (hFile=0x154) returned 0x1 [0080.807] WriteFile (in: hFile=0x154, lpBuffer=0x1b44c68*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b44c68*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0080.808] CloseHandle (hObject=0x154) returned 1 [0080.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", lpFilePart=0x0) returned 0x4c [0080.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.anonymous", lpFilePart=0x0) returned 0x56 [0080.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.808] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e03400, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf1a5150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.anonymous")) returned 1 [0080.816] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", lpFilePart=0x0) returned 0x4f [0080.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.816] GetFileType (hFile=0x154) returned 0x1 [0080.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.816] GetFileType (hFile=0x154) returned 0x1 [0080.816] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x39f [0080.818] CloseHandle (hObject=0x154) returned 1 [0080.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", lpFilePart=0x0) returned 0x4f [0080.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.831] GetFileType (hFile=0x154) returned 0x1 [0080.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.831] GetFileType (hFile=0x154) returned 0x1 [0080.832] CloseHandle (hObject=0x154) returned 1 [0080.832] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", lpFilePart=0x0) returned 0x4f [0080.832] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.anonymous", lpFilePart=0x0) returned 0x59 [0080.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.832] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcd4a700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f53a50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf1f1410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0080.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.anonymous")) returned 1 [0080.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", lpFilePart=0x0) returned 0x4b [0080.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.833] GetFileType (hFile=0x154) returned 0x1 [0080.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.833] GetFileType (hFile=0x154) returned 0x1 [0080.833] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c0 [0080.835] CloseHandle (hObject=0x154) returned 1 [0080.851] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", lpFilePart=0x0) returned 0x4b [0080.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.852] GetFileType (hFile=0x154) returned 0x1 [0080.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.852] GetFileType (hFile=0x154) returned 0x1 [0080.853] CloseHandle (hObject=0x154) returned 1 [0080.853] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", lpFilePart=0x0) returned 0x4b [0080.853] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.anonymous", lpFilePart=0x0) returned 0x55 [0080.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.854] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d769700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf217570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.anonymous")) returned 1 [0080.854] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", lpFilePart=0x0) returned 0x4d [0080.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.854] GetFileType (hFile=0x154) returned 0x1 [0080.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.854] GetFileType (hFile=0x154) returned 0x1 [0080.854] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x39e [0080.856] CloseHandle (hObject=0x154) returned 1 [0080.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", lpFilePart=0x0) returned 0x4d [0080.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.869] GetFileType (hFile=0x154) returned 0x1 [0080.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.869] GetFileType (hFile=0x154) returned 0x1 [0080.869] WriteFile (in: hFile=0x154, lpBuffer=0x1a36810*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a36810*, lpNumberOfBytesWritten=0x2ae528*=0x3a0, lpOverlapped=0x0) returned 1 [0080.870] CloseHandle (hObject=0x154) returned 1 [0080.870] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", lpFilePart=0x0) returned 0x4d [0080.870] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.anonymous", lpFilePart=0x0) returned 0x57 [0080.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.870] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b73bb00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f79bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf23d6d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0080.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.anonymous")) returned 1 [0080.871] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", lpFilePart=0x0) returned 0x4f [0080.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.871] GetFileType (hFile=0x154) returned 0x1 [0080.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.871] GetFileType (hFile=0x154) returned 0x1 [0080.871] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c4 [0080.873] CloseHandle (hObject=0x154) returned 1 [0080.896] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", lpFilePart=0x0) returned 0x4f [0080.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.897] GetFileType (hFile=0x154) returned 0x1 [0080.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.897] GetFileType (hFile=0x154) returned 0x1 [0080.898] WriteFile (in: hFile=0x154, lpBuffer=0x1a87190*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a87190*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0080.899] CloseHandle (hObject=0x154) returned 1 [0080.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", lpFilePart=0x0) returned 0x4f [0080.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.anonymous", lpFilePart=0x0) returned 0x59 [0080.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0682e00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f79bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf289990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.anonymous")) returned 1 [0080.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", lpFilePart=0x0) returned 0x4f [0080.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.901] GetFileType (hFile=0x154) returned 0x1 [0080.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.901] GetFileType (hFile=0x154) returned 0x1 [0080.901] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c4 [0080.903] CloseHandle (hObject=0x154) returned 1 [0080.917] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", lpFilePart=0x0) returned 0x4f [0080.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.919] GetFileType (hFile=0x154) returned 0x1 [0080.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.919] GetFileType (hFile=0x154) returned 0x1 [0080.921] CloseHandle (hObject=0x154) returned 1 [0080.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", lpFilePart=0x0) returned 0x4f [0080.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.anonymous", lpFilePart=0x0) returned 0x59 [0080.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610a1e00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf2afaf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.anonymous")) returned 1 [0080.922] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", lpFilePart=0x0) returned 0x4d [0080.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.922] GetFileType (hFile=0x154) returned 0x1 [0080.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.922] GetFileType (hFile=0x154) returned 0x1 [0080.922] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c2 [0080.923] ReadFile (in: hFile=0x154, lpBuffer=0x1ad9260, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ad9260*, lpNumberOfBytesRead=0x2ae560*=0x3c2, lpOverlapped=0x0) returned 1 [0080.925] CloseHandle (hObject=0x154) returned 1 [0080.937] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", lpFilePart=0x0) returned 0x4d [0080.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.940] GetFileType (hFile=0x154) returned 0x1 [0080.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.940] GetFileType (hFile=0x154) returned 0x1 [0080.940] WriteFile (in: hFile=0x154, lpBuffer=0x1b2849c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b2849c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0080.942] CloseHandle (hObject=0x154) returned 1 [0080.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", lpFilePart=0x0) returned 0x4d [0080.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.anonymous", lpFilePart=0x0) returned 0x57 [0080.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.942] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3fbb500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf2fbdb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.anonymous")) returned 1 [0080.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", lpFilePart=0x0) returned 0x4f [0080.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.943] GetFileType (hFile=0x154) returned 0x1 [0080.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.944] GetFileType (hFile=0x154) returned 0x1 [0080.944] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c4 [0080.944] ReadFile (in: hFile=0x154, lpBuffer=0x1b29bdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b29bdc*, lpNumberOfBytesRead=0x2ae560*=0x3c4, lpOverlapped=0x0) returned 1 [0080.945] CloseHandle (hObject=0x154) returned 1 [0080.980] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", lpFilePart=0x0) returned 0x4f [0080.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0080.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.981] GetFileType (hFile=0x154) returned 0x1 [0080.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0080.981] GetFileType (hFile=0x154) returned 0x1 [0080.981] WriteFile (in: hFile=0x154, lpBuffer=0x1b78e1c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b78e1c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0080.982] CloseHandle (hObject=0x154) returned 1 [0080.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", lpFilePart=0x0) returned 0x4f [0080.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.anonymous", lpFilePart=0x0) returned 0x59 [0080.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0080.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c06900, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f79bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf348070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0080.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0080.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.anonymous")) returned 1 [0080.983] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", lpFilePart=0x0) returned 0x4c [0080.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0080.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0080.983] GetFileType (hFile=0x154) returned 0x1 [0080.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0080.983] GetFileType (hFile=0x154) returned 0x1 [0080.983] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0080.983] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a560, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b7a560*, lpNumberOfBytesRead=0x2ae560*=0x3c1, lpOverlapped=0x0) returned 1 [0080.986] CloseHandle (hObject=0x154) returned 1 [0081.023] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", lpFilePart=0x0) returned 0x4c [0081.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.024] GetFileType (hFile=0x154) returned 0x1 [0081.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.024] GetFileType (hFile=0x154) returned 0x1 [0081.024] WriteFile (in: hFile=0x154, lpBuffer=0x19c9774*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19c9774*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.025] CloseHandle (hObject=0x154) returned 1 [0081.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", lpFilePart=0x0) returned 0x4c [0081.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.anonymous", lpFilePart=0x0) returned 0x56 [0081.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.026] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c7800, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf3ba490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.anonymous")) returned 1 [0081.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", lpFilePart=0x0) returned 0x4f [0081.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.027] GetFileType (hFile=0x154) returned 0x1 [0081.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.027] GetFileType (hFile=0x154) returned 0x1 [0081.027] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3a0 [0081.027] ReadFile (in: hFile=0x154, lpBuffer=0x19cae90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19cae90*, lpNumberOfBytesRead=0x2ae560*=0x3a0, lpOverlapped=0x0) returned 1 [0081.029] CloseHandle (hObject=0x154) returned 1 [0081.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", lpFilePart=0x0) returned 0x4f [0081.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.042] GetFileType (hFile=0x154) returned 0x1 [0081.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.042] GetFileType (hFile=0x154) returned 0x1 [0081.042] WriteFile (in: hFile=0x154, lpBuffer=0x1a1a190*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a1a190*, lpNumberOfBytesWritten=0x2ae528*=0x3b0, lpOverlapped=0x0) returned 1 [0081.043] CloseHandle (hObject=0x154) returned 1 [0081.043] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", lpFilePart=0x0) returned 0x4f [0081.043] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.anonymous", lpFilePart=0x0) returned 0x59 [0081.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.043] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd61500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f79bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf3e05f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0081.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.anonymous")) returned 1 [0081.044] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", lpFilePart=0x0) returned 0x4f [0081.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.044] GetFileType (hFile=0x154) returned 0x1 [0081.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.044] GetFileType (hFile=0x154) returned 0x1 [0081.044] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c4 [0081.044] ReadFile (in: hFile=0x154, lpBuffer=0x1a1b8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a1b8dc*, lpNumberOfBytesRead=0x2ae560*=0x3c4, lpOverlapped=0x0) returned 1 [0081.046] CloseHandle (hObject=0x154) returned 1 [0081.058] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", lpFilePart=0x0) returned 0x4f [0081.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.059] GetFileType (hFile=0x154) returned 0x1 [0081.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.059] GetFileType (hFile=0x154) returned 0x1 [0081.059] WriteFile (in: hFile=0x154, lpBuffer=0x1a6ab1c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a6ab1c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.060] CloseHandle (hObject=0x154) returned 1 [0081.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", lpFilePart=0x0) returned 0x4f [0081.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.anonymous", lpFilePart=0x0) returned 0x59 [0081.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc53f000, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf406750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.anonymous")) returned 1 [0081.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", lpFilePart=0x0) returned 0x4a [0081.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.061] GetFileType (hFile=0x154) returned 0x1 [0081.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.061] GetFileType (hFile=0x154) returned 0x1 [0081.061] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3bf [0081.061] ReadFile (in: hFile=0x154, lpBuffer=0x1a6c254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a6c254*, lpNumberOfBytesRead=0x2ae560*=0x3bf, lpOverlapped=0x0) returned 1 [0081.063] CloseHandle (hObject=0x154) returned 1 [0081.074] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", lpFilePart=0x0) returned 0x4a [0081.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.076] GetFileType (hFile=0x154) returned 0x1 [0081.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.076] GetFileType (hFile=0x154) returned 0x1 [0081.076] WriteFile (in: hFile=0x154, lpBuffer=0x1abb42c*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1abb42c*, lpNumberOfBytesWritten=0x2ae528*=0x3c0, lpOverlapped=0x0) returned 1 [0081.077] CloseHandle (hObject=0x154) returned 1 [0081.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", lpFilePart=0x0) returned 0x4a [0081.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.anonymous", lpFilePart=0x0) returned 0x54 [0081.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.077] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a938600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f79bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf42c8b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0081.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.anonymous")) returned 1 [0081.078] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", lpFilePart=0x0) returned 0x4d [0081.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.079] GetFileType (hFile=0x154) returned 0x1 [0081.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.079] GetFileType (hFile=0x154) returned 0x1 [0081.079] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c2 [0081.079] ReadFile (in: hFile=0x154, lpBuffer=0x1abcb58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1abcb58*, lpNumberOfBytesRead=0x2ae560*=0x3c2, lpOverlapped=0x0) returned 1 [0081.080] CloseHandle (hObject=0x154) returned 1 [0081.092] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", lpFilePart=0x0) returned 0x4d [0081.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.093] GetFileType (hFile=0x154) returned 0x1 [0081.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.093] GetFileType (hFile=0x154) returned 0x1 [0081.093] WriteFile (in: hFile=0x154, lpBuffer=0x1b0bd94*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b0bd94*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.095] CloseHandle (hObject=0x154) returned 1 [0081.095] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", lpFilePart=0x0) returned 0x4d [0081.095] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.anonymous", lpFilePart=0x0) returned 0x57 [0081.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.095] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ffff00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf478b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.anonymous")) returned 1 [0081.095] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", lpFilePart=0x0) returned 0x4f [0081.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.096] GetFileType (hFile=0x154) returned 0x1 [0081.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.096] GetFileType (hFile=0x154) returned 0x1 [0081.096] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3a0 [0081.096] ReadFile (in: hFile=0x154, lpBuffer=0x1b0d4b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0d4b0*, lpNumberOfBytesRead=0x2ae560*=0x3a0, lpOverlapped=0x0) returned 1 [0081.103] CloseHandle (hObject=0x154) returned 1 [0081.115] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", lpFilePart=0x0) returned 0x4f [0081.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.117] GetFileType (hFile=0x154) returned 0x1 [0081.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.117] GetFileType (hFile=0x154) returned 0x1 [0081.117] WriteFile (in: hFile=0x154, lpBuffer=0x1b5c654*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b5c654*, lpNumberOfBytesWritten=0x2ae528*=0x3b0, lpOverlapped=0x0) returned 1 [0081.118] CloseHandle (hObject=0x154) returned 1 [0081.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", lpFilePart=0x0) returned 0x4f [0081.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.anonymous", lpFilePart=0x0) returned 0x59 [0081.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.118] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e662000, ftCreationTime.dwHighDateTime=0x1c6baf0, ftLastAccessTime.dwLowDateTime=0x76f79bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf49ecd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0081.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.anonymous")) returned 1 [0081.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", lpFilePart=0x0) returned 0x4a [0081.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.119] GetFileType (hFile=0x154) returned 0x1 [0081.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.119] GetFileType (hFile=0x154) returned 0x1 [0081.119] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3bf [0081.119] ReadFile (in: hFile=0x154, lpBuffer=0x1b5dd8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b5dd8c*, lpNumberOfBytesRead=0x2ae560*=0x3bf, lpOverlapped=0x0) returned 1 [0081.122] CloseHandle (hObject=0x154) returned 1 [0081.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", lpFilePart=0x0) returned 0x4a [0081.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.136] GetFileType (hFile=0x154) returned 0x1 [0081.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.136] GetFileType (hFile=0x154) returned 0x1 [0081.136] WriteFile (in: hFile=0x154, lpBuffer=0x1bacf64*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1bacf64*, lpNumberOfBytesWritten=0x2ae528*=0x3c0, lpOverlapped=0x0) returned 1 [0081.139] CloseHandle (hObject=0x154) returned 1 [0081.139] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", lpFilePart=0x0) returned 0x4a [0081.139] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.anonymous", lpFilePart=0x0) returned 0x54 [0081.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1699c00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf4c4e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0081.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.anonymous")) returned 1 [0081.140] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", lpFilePart=0x0) returned 0x4f [0081.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.140] GetFileType (hFile=0x154) returned 0x1 [0081.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.140] GetFileType (hFile=0x154) returned 0x1 [0081.140] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c4 [0081.144] ReadFile (in: hFile=0x154, lpBuffer=0x19ae21c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19ae21c*, lpNumberOfBytesRead=0x2ae560*=0x3c4, lpOverlapped=0x0) returned 1 [0081.145] CloseHandle (hObject=0x154) returned 1 [0081.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", lpFilePart=0x0) returned 0x4f [0081.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.181] GetFileType (hFile=0x154) returned 0x1 [0081.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.181] GetFileType (hFile=0x154) returned 0x1 [0081.181] WriteFile (in: hFile=0x154, lpBuffer=0x19fd5b8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19fd5b8*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.182] CloseHandle (hObject=0x154) returned 1 [0081.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", lpFilePart=0x0) returned 0x4f [0081.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.anonymous", lpFilePart=0x0) returned 0x59 [0081.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.182] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fd2300, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf537250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.anonymous")) returned 1 [0081.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", lpFilePart=0x0) returned 0x4d [0081.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.183] GetFileType (hFile=0x154) returned 0x1 [0081.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.183] GetFileType (hFile=0x154) returned 0x1 [0081.183] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x39e [0081.183] ReadFile (in: hFile=0x154, lpBuffer=0x19fecd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19fecd8*, lpNumberOfBytesRead=0x2ae560*=0x39e, lpOverlapped=0x0) returned 1 [0081.185] CloseHandle (hObject=0x154) returned 1 [0081.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", lpFilePart=0x0) returned 0x4d [0081.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.198] GetFileType (hFile=0x154) returned 0x1 [0081.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.198] GetFileType (hFile=0x154) returned 0x1 [0081.198] WriteFile (in: hFile=0x154, lpBuffer=0x1a4de18*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a4de18*, lpNumberOfBytesWritten=0x2ae528*=0x3a0, lpOverlapped=0x0) returned 1 [0081.199] CloseHandle (hObject=0x154) returned 1 [0081.199] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", lpFilePart=0x0) returned 0x4d [0081.199] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.anonymous", lpFilePart=0x0) returned 0x57 [0081.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.199] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe77700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf55d3b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0081.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.anonymous")) returned 1 [0081.200] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", lpFilePart=0x0) returned 0x4c [0081.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.200] GetFileType (hFile=0x154) returned 0x1 [0081.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.200] GetFileType (hFile=0x154) returned 0x1 [0081.200] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0081.200] ReadFile (in: hFile=0x154, lpBuffer=0x1a4f550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a4f550*, lpNumberOfBytesRead=0x2ae560*=0x3c1, lpOverlapped=0x0) returned 1 [0081.216] CloseHandle (hObject=0x154) returned 1 [0081.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", lpFilePart=0x0) returned 0x4c [0081.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.229] GetFileType (hFile=0x154) returned 0x1 [0081.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.229] GetFileType (hFile=0x154) returned 0x1 [0081.229] WriteFile (in: hFile=0x154, lpBuffer=0x1a9e78c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a9e78c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.230] CloseHandle (hObject=0x154) returned 1 [0081.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", lpFilePart=0x0) returned 0x4c [0081.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.anonymous", lpFilePart=0x0) returned 0x56 [0081.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.230] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf5e000, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf5a9670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.anonymous")) returned 1 [0081.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", lpFilePart=0x0) returned 0x4b [0081.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.231] GetFileType (hFile=0x154) returned 0x1 [0081.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.232] GetFileType (hFile=0x154) returned 0x1 [0081.232] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c0 [0081.232] ReadFile (in: hFile=0x154, lpBuffer=0x1a9feb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a9feb8*, lpNumberOfBytesRead=0x2ae560*=0x3c0, lpOverlapped=0x0) returned 1 [0081.250] CloseHandle (hObject=0x154) returned 1 [0081.262] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", lpFilePart=0x0) returned 0x4b [0081.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.263] GetFileType (hFile=0x154) returned 0x1 [0081.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.263] GetFileType (hFile=0x154) returned 0x1 [0081.263] WriteFile (in: hFile=0x154, lpBuffer=0x1aef0ec*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1aef0ec*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.264] CloseHandle (hObject=0x154) returned 1 [0081.265] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", lpFilePart=0x0) returned 0x4b [0081.265] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.265] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70896700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf5f5930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.anonymous")) returned 1 [0081.265] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", lpFilePart=0x0) returned 0x4c [0081.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.266] GetFileType (hFile=0x154) returned 0x1 [0081.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.266] GetFileType (hFile=0x154) returned 0x1 [0081.266] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0081.266] ReadFile (in: hFile=0x154, lpBuffer=0x1af0818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af0818*, lpNumberOfBytesRead=0x2ae560*=0x3c1, lpOverlapped=0x0) returned 1 [0081.275] CloseHandle (hObject=0x154) returned 1 [0081.286] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", lpFilePart=0x0) returned 0x4c [0081.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.288] GetFileType (hFile=0x154) returned 0x1 [0081.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.288] GetFileType (hFile=0x154) returned 0x1 [0081.288] WriteFile (in: hFile=0x154, lpBuffer=0x1b3fa54*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b3fa54*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.289] CloseHandle (hObject=0x154) returned 1 [0081.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", lpFilePart=0x0) returned 0x4c [0081.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.anonymous", lpFilePart=0x0) returned 0x56 [0081.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741cee00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf641bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.anonymous")) returned 1 [0081.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", lpFilePart=0x0) returned 0x4f [0081.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.290] GetFileType (hFile=0x154) returned 0x1 [0081.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.290] GetFileType (hFile=0x154) returned 0x1 [0081.290] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c4 [0081.290] ReadFile (in: hFile=0x154, lpBuffer=0x1b41194, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b41194*, lpNumberOfBytesRead=0x2ae560*=0x3c4, lpOverlapped=0x0) returned 1 [0081.292] CloseHandle (hObject=0x154) returned 1 [0081.305] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", lpFilePart=0x0) returned 0x4f [0081.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.306] GetFileType (hFile=0x154) returned 0x1 [0081.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.306] GetFileType (hFile=0x154) returned 0x1 [0081.307] WriteFile (in: hFile=0x154, lpBuffer=0x1b903d4*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b903d4*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.308] CloseHandle (hObject=0x154) returned 1 [0081.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", lpFilePart=0x0) returned 0x4f [0081.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.anonymous", lpFilePart=0x0) returned 0x59 [0081.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd249d100, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf667d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.anonymous")) returned 1 [0081.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", lpFilePart=0x0) returned 0x4d [0081.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.309] GetFileType (hFile=0x154) returned 0x1 [0081.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.309] GetFileType (hFile=0x154) returned 0x1 [0081.309] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c2 [0081.309] ReadFile (in: hFile=0x154, lpBuffer=0x1b91b18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b91b18*, lpNumberOfBytesRead=0x2ae560*=0x3c2, lpOverlapped=0x0) returned 1 [0081.316] CloseHandle (hObject=0x154) returned 1 [0081.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", lpFilePart=0x0) returned 0x4d [0081.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.355] GetFileType (hFile=0x154) returned 0x1 [0081.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.355] GetFileType (hFile=0x154) returned 0x1 [0081.355] WriteFile (in: hFile=0x154, lpBuffer=0x19e0f50*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19e0f50*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.356] CloseHandle (hObject=0x154) returned 1 [0081.356] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", lpFilePart=0x0) returned 0x4d [0081.356] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.anonymous", lpFilePart=0x0) returned 0x57 [0081.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b07500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf6da170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.anonymous")) returned 1 [0081.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", lpFilePart=0x0) returned 0x4b [0081.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.358] GetFileType (hFile=0x154) returned 0x1 [0081.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.358] GetFileType (hFile=0x154) returned 0x1 [0081.358] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c0 [0081.358] ReadFile (in: hFile=0x154, lpBuffer=0x19e267c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e267c*, lpNumberOfBytesRead=0x2ae560*=0x3c0, lpOverlapped=0x0) returned 1 [0081.363] CloseHandle (hObject=0x154) returned 1 [0081.375] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", lpFilePart=0x0) returned 0x4b [0081.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.377] GetFileType (hFile=0x154) returned 0x1 [0081.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.377] GetFileType (hFile=0x154) returned 0x1 [0081.377] WriteFile (in: hFile=0x154, lpBuffer=0x1a31a0c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a31a0c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.380] CloseHandle (hObject=0x154) returned 1 [0081.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", lpFilePart=0x0) returned 0x4b [0081.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.380] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a12cf00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf726430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.anonymous")) returned 1 [0081.381] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", lpFilePart=0x0) returned 0x4c [0081.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.381] GetFileType (hFile=0x154) returned 0x1 [0081.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.382] GetFileType (hFile=0x154) returned 0x1 [0081.382] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0081.382] ReadFile (in: hFile=0x154, lpBuffer=0x1a33138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a33138*, lpNumberOfBytesRead=0x2ae560*=0x3c1, lpOverlapped=0x0) returned 1 [0081.383] CloseHandle (hObject=0x154) returned 1 [0081.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", lpFilePart=0x0) returned 0x4c [0081.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.396] GetFileType (hFile=0x154) returned 0x1 [0081.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.396] GetFileType (hFile=0x154) returned 0x1 [0081.396] WriteFile (in: hFile=0x154, lpBuffer=0x1a82374*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a82374*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.397] CloseHandle (hObject=0x154) returned 1 [0081.397] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", lpFilePart=0x0) returned 0x4c [0081.397] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.anonymous", lpFilePart=0x0) returned 0x56 [0081.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.397] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da65600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf74c590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.anonymous")) returned 1 [0081.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", lpFilePart=0x0) returned 0x4b [0081.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.398] GetFileType (hFile=0x154) returned 0x1 [0081.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.398] GetFileType (hFile=0x154) returned 0x1 [0081.398] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c0 [0081.398] ReadFile (in: hFile=0x154, lpBuffer=0x1a83aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a83aa0*, lpNumberOfBytesRead=0x2ae560*=0x3c0, lpOverlapped=0x0) returned 1 [0081.400] CloseHandle (hObject=0x154) returned 1 [0081.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", lpFilePart=0x0) returned 0x4b [0081.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.412] GetFileType (hFile=0x154) returned 0x1 [0081.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.412] GetFileType (hFile=0x154) returned 0x1 [0081.412] WriteFile (in: hFile=0x154, lpBuffer=0x1ad2cd4*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ad2cd4*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.413] CloseHandle (hObject=0x154) returned 1 [0081.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", lpFilePart=0x0) returned 0x4b [0081.413] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.413] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8139dd00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf7726f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.anonymous")) returned 1 [0081.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", lpFilePart=0x0) returned 0x51 [0081.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.414] GetFileType (hFile=0x154) returned 0x1 [0081.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.414] GetFileType (hFile=0x154) returned 0x1 [0081.414] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c6 [0081.414] ReadFile (in: hFile=0x154, lpBuffer=0x1ad4414, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ad4414*, lpNumberOfBytesRead=0x2ae560*=0x3c6, lpOverlapped=0x0) returned 1 [0081.416] CloseHandle (hObject=0x154) returned 1 [0081.429] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", lpFilePart=0x0) returned 0x51 [0081.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.430] GetFileType (hFile=0x154) returned 0x1 [0081.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.430] GetFileType (hFile=0x154) returned 0x1 [0081.431] WriteFile (in: hFile=0x154, lpBuffer=0x1b2365c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b2365c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.432] CloseHandle (hObject=0x154) returned 1 [0081.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", lpFilePart=0x0) returned 0x51 [0081.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.anonymous", lpFilePart=0x0) returned 0x5b [0081.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.432] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75f7d00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf798850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.anonymous")) returned 1 [0081.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", lpFilePart=0x0) returned 0x4d [0081.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.433] GetFileType (hFile=0x154) returned 0x1 [0081.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.433] GetFileType (hFile=0x154) returned 0x1 [0081.433] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c2 [0081.433] ReadFile (in: hFile=0x154, lpBuffer=0x1b24dac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b24dac*, lpNumberOfBytesRead=0x2ae560*=0x3c2, lpOverlapped=0x0) returned 1 [0081.434] CloseHandle (hObject=0x154) returned 1 [0081.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", lpFilePart=0x0) returned 0x4d [0081.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.447] GetFileType (hFile=0x154) returned 0x1 [0081.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.448] GetFileType (hFile=0x154) returned 0x1 [0081.448] WriteFile (in: hFile=0x154, lpBuffer=0x1b73fe8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b73fe8*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.449] CloseHandle (hObject=0x154) returned 1 [0081.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", lpFilePart=0x0) returned 0x4d [0081.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.anonymous", lpFilePart=0x0) returned 0x57 [0081.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.449] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf30400, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf7be9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.anonymous")) returned 1 [0081.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", lpFilePart=0x0) returned 0x50 [0081.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.450] GetFileType (hFile=0x154) returned 0x1 [0081.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.450] GetFileType (hFile=0x154) returned 0x1 [0081.450] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c5 [0081.450] ReadFile (in: hFile=0x154, lpBuffer=0x1b75734, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b75734*, lpNumberOfBytesRead=0x2ae560*=0x3c5, lpOverlapped=0x0) returned 1 [0081.452] CloseHandle (hObject=0x154) returned 1 [0081.490] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", lpFilePart=0x0) returned 0x50 [0081.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.492] GetFileType (hFile=0x154) returned 0x1 [0081.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.492] GetFileType (hFile=0x154) returned 0x1 [0081.492] WriteFile (in: hFile=0x154, lpBuffer=0x19c49b8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19c49b8*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.494] CloseHandle (hObject=0x154) returned 1 [0081.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", lpFilePart=0x0) returned 0x50 [0081.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.anonymous", lpFilePart=0x0) returned 0x5a [0081.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.494] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5dd5800, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf830dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.anonymous")) returned 1 [0081.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", lpFilePart=0x0) returned 0x4e [0081.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.495] GetFileType (hFile=0x154) returned 0x1 [0081.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.495] GetFileType (hFile=0x154) returned 0x1 [0081.495] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c3 [0081.495] ReadFile (in: hFile=0x154, lpBuffer=0x19c6110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c6110*, lpNumberOfBytesRead=0x2ae560*=0x3c3, lpOverlapped=0x0) returned 1 [0081.496] CloseHandle (hObject=0x154) returned 1 [0081.508] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", lpFilePart=0x0) returned 0x4e [0081.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.510] GetFileType (hFile=0x154) returned 0x1 [0081.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.510] GetFileType (hFile=0x154) returned 0x1 [0081.510] WriteFile (in: hFile=0x154, lpBuffer=0x1a154b0*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a154b0*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.511] CloseHandle (hObject=0x154) returned 1 [0081.511] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", lpFilePart=0x0) returned 0x4e [0081.511] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.anonymous", lpFilePart=0x0) returned 0x58 [0081.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.511] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x839c3700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf856f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.anonymous")) returned 1 [0081.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", lpFilePart=0x0) returned 0x4d [0081.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.513] GetFileType (hFile=0x154) returned 0x1 [0081.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.513] GetFileType (hFile=0x154) returned 0x1 [0081.513] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c2 [0081.513] ReadFile (in: hFile=0x154, lpBuffer=0x1a16bf4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a16bf4*, lpNumberOfBytesRead=0x2ae560*=0x3c2, lpOverlapped=0x0) returned 1 [0081.514] CloseHandle (hObject=0x154) returned 1 [0081.526] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", lpFilePart=0x0) returned 0x4d [0081.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.527] GetFileType (hFile=0x154) returned 0x1 [0081.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.527] GetFileType (hFile=0x154) returned 0x1 [0081.527] WriteFile (in: hFile=0x154, lpBuffer=0x1a65e30*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a65e30*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.528] CloseHandle (hObject=0x154) returned 1 [0081.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", lpFilePart=0x0) returned 0x4d [0081.528] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.anonymous", lpFilePart=0x0) returned 0x57 [0081.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.529] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872fbe00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf87d090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.anonymous")) returned 1 [0081.529] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", lpFilePart=0x0) returned 0x4c [0081.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.529] GetFileType (hFile=0x154) returned 0x1 [0081.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.529] GetFileType (hFile=0x154) returned 0x1 [0081.529] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c1 [0081.530] ReadFile (in: hFile=0x154, lpBuffer=0x1a67568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a67568*, lpNumberOfBytesRead=0x2ae560*=0x3c1, lpOverlapped=0x0) returned 1 [0081.532] CloseHandle (hObject=0x154) returned 1 [0081.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", lpFilePart=0x0) returned 0x4c [0081.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.547] GetFileType (hFile=0x154) returned 0x1 [0081.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.547] GetFileType (hFile=0x154) returned 0x1 [0081.547] WriteFile (in: hFile=0x154, lpBuffer=0x1ab67a4*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ab67a4*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.549] CloseHandle (hObject=0x154) returned 1 [0081.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", lpFilePart=0x0) returned 0x4c [0081.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.anonymous", lpFilePart=0x0) returned 0x56 [0081.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafb7b800, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf8c9350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.anonymous")) returned 1 [0081.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", lpFilePart=0x0) returned 0x4a [0081.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.550] GetFileType (hFile=0x154) returned 0x1 [0081.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.551] GetFileType (hFile=0x154) returned 0x1 [0081.551] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3bf [0081.551] ReadFile (in: hFile=0x154, lpBuffer=0x1ab7ed0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab7ed0*, lpNumberOfBytesRead=0x2ae560*=0x3bf, lpOverlapped=0x0) returned 1 [0081.552] CloseHandle (hObject=0x154) returned 1 [0081.564] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", lpFilePart=0x0) returned 0x4a [0081.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.565] GetFileType (hFile=0x154) returned 0x1 [0081.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.565] GetFileType (hFile=0x154) returned 0x1 [0081.565] WriteFile (in: hFile=0x154, lpBuffer=0x1b070a8*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b070a8*, lpNumberOfBytesWritten=0x2ae528*=0x3c0, lpOverlapped=0x0) returned 1 [0081.566] CloseHandle (hObject=0x154) returned 1 [0081.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", lpFilePart=0x0) returned 0x4a [0081.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.anonymous", lpFilePart=0x0) returned 0x54 [0081.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac34500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf8ef4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0081.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.anonymous")) returned 1 [0081.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", lpFilePart=0x0) returned 0x4b [0081.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.568] GetFileType (hFile=0x154) returned 0x1 [0081.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.568] GetFileType (hFile=0x154) returned 0x1 [0081.568] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c0 [0081.568] ReadFile (in: hFile=0x154, lpBuffer=0x1b087c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b087c8*, lpNumberOfBytesRead=0x2ae560*=0x3c0, lpOverlapped=0x0) returned 1 [0081.570] CloseHandle (hObject=0x154) returned 1 [0081.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", lpFilePart=0x0) returned 0x4b [0081.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.584] GetFileType (hFile=0x154) returned 0x1 [0081.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.584] GetFileType (hFile=0x154) returned 0x1 [0081.584] WriteFile (in: hFile=0x154, lpBuffer=0x1b579fc*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b579fc*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.585] CloseHandle (hObject=0x154) returned 1 [0081.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", lpFilePart=0x0) returned 0x4b [0081.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.586] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e56cc00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf915610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.anonymous")) returned 1 [0081.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", lpFilePart=0x0) returned 0x4b [0081.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.587] GetFileType (hFile=0x154) returned 0x1 [0081.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.587] GetFileType (hFile=0x154) returned 0x1 [0081.587] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c0 [0081.587] ReadFile (in: hFile=0x154, lpBuffer=0x1b5911c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b5911c*, lpNumberOfBytesRead=0x2ae560*=0x3c0, lpOverlapped=0x0) returned 1 [0081.588] CloseHandle (hObject=0x154) returned 1 [0081.600] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", lpFilePart=0x0) returned 0x4b [0081.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.601] GetFileType (hFile=0x154) returned 0x1 [0081.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.601] GetFileType (hFile=0x154) returned 0x1 [0081.601] WriteFile (in: hFile=0x154, lpBuffer=0x1ba8350*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ba8350*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.602] CloseHandle (hObject=0x154) returned 1 [0081.602] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", lpFilePart=0x0) returned 0x4b [0081.602] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.602] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b92600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf93b770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.anonymous")) returned 1 [0081.603] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", lpFilePart=0x0) returned 0x4e [0081.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.603] GetFileType (hFile=0x154) returned 0x1 [0081.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.603] GetFileType (hFile=0x154) returned 0x1 [0081.603] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3c3 [0081.603] ReadFile (in: hFile=0x154, lpBuffer=0x1ba9a84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ba9a84*, lpNumberOfBytesRead=0x2ae560*=0x3c3, lpOverlapped=0x0) returned 1 [0081.605] CloseHandle (hObject=0x154) returned 1 [0081.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", lpFilePart=0x0) returned 0x4e [0081.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.643] GetFileType (hFile=0x154) returned 0x1 [0081.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.643] GetFileType (hFile=0x154) returned 0x1 [0081.643] WriteFile (in: hFile=0x154, lpBuffer=0x19f8c8c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19f8c8c*, lpNumberOfBytesWritten=0x2ae528*=0x3d0, lpOverlapped=0x0) returned 1 [0081.644] CloseHandle (hObject=0x154) returned 1 [0081.644] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", lpFilePart=0x0) returned 0x4e [0081.644] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.anonymous", lpFilePart=0x0) returned 0x58 [0081.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.644] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21a1200, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x86c63d30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcf9adb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0081.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.anonymous")) returned 1 [0081.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0081.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects", lpFilePart=0x0) returned 0x42 [0081.645] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpFilePart=0x0) returned 0x43 [0081.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0081.656] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.667] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.668] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.669] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.670] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.671] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0081.671] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0081.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0081.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0081.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0081.673] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects", lpFilePart=0x0) returned 0x42 [0081.673] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", lpFilePart=0x0) returned 0x43 [0081.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0081.674] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.674] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.674] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.674] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.674] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.675] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.676] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.677] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.678] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0081.679] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0081.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0081.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0081.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0081.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts", lpFilePart=0x0) returned 0x40 [0081.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpFilePart=0x0) returned 0x41 [0081.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0081.682] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.684] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.685] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.686] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.687] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0081.688] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0081.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0081.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0081.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0081.689] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts", lpFilePart=0x0) returned 0x40 [0081.689] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", lpFilePart=0x0) returned 0x41 [0081.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbebd8 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.690] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.691] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0081.692] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0081.692] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0081.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0081.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0081.693] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", lpFilePart=0x0) returned 0x4e [0081.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.694] GetFileType (hFile=0x154) returned 0x1 [0081.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.694] GetFileType (hFile=0x154) returned 0x1 [0081.694] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe19 [0081.695] ReadFile (in: hFile=0x154, lpBuffer=0x1a0fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0fea0*, lpNumberOfBytesRead=0x2ae560*=0xe19, lpOverlapped=0x0) returned 1 [0081.704] CloseHandle (hObject=0x154) returned 1 [0081.715] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", lpFilePart=0x0) returned 0x4e [0081.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.717] GetFileType (hFile=0x154) returned 0x1 [0081.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.717] GetFileType (hFile=0x154) returned 0x1 [0081.717] WriteFile (in: hFile=0x154, lpBuffer=0x1a625c8*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a625c8*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0081.718] CloseHandle (hObject=0x154) returned 1 [0081.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", lpFilePart=0x0) returned 0x4e [0081.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.anonymous", lpFilePart=0x0) returned 0x58 [0081.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.718] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6dec600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfa46110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0081.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.anonymous")) returned 1 [0081.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", lpFilePart=0x0) returned 0x4b [0081.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.719] GetFileType (hFile=0x154) returned 0x1 [0081.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.720] GetFileType (hFile=0x154) returned 0x1 [0081.720] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe2a [0081.720] ReadFile (in: hFile=0x154, lpBuffer=0x1a64770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a64770*, lpNumberOfBytesRead=0x2ae560*=0xe2a, lpOverlapped=0x0) returned 1 [0081.745] CloseHandle (hObject=0x154) returned 1 [0081.757] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", lpFilePart=0x0) returned 0x4b [0081.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.760] GetFileType (hFile=0x154) returned 0x1 [0081.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.760] GetFileType (hFile=0x154) returned 0x1 [0081.760] WriteFile (in: hFile=0x154, lpBuffer=0x1ab6d80*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ab6d80*, lpNumberOfBytesWritten=0x2ae528*=0xe30, lpOverlapped=0x0) returned 1 [0081.763] CloseHandle (hObject=0x154) returned 1 [0081.763] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", lpFilePart=0x0) returned 0x4b [0081.763] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.763] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9412000, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfab8530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0081.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.anonymous")) returned 1 [0081.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", lpFilePart=0x0) returned 0x49 [0081.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.764] GetFileType (hFile=0x154) returned 0x1 [0081.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.764] GetFileType (hFile=0x154) returned 0x1 [0081.764] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xeee [0081.764] ReadFile (in: hFile=0x154, lpBuffer=0x1ab8fcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab8fcc*, lpNumberOfBytesRead=0x2ae560*=0xeee, lpOverlapped=0x0) returned 1 [0081.804] CloseHandle (hObject=0x154) returned 1 [0081.815] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", lpFilePart=0x0) returned 0x49 [0081.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.816] GetFileType (hFile=0x154) returned 0x1 [0081.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.816] GetFileType (hFile=0x154) returned 0x1 [0081.818] CloseHandle (hObject=0x154) returned 1 [0081.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", lpFilePart=0x0) returned 0x49 [0081.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.anonymous", lpFilePart=0x0) returned 0x53 [0081.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.819] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5780b600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfb50ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xef0)) returned 1 [0081.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.anonymous")) returned 1 [0081.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", lpFilePart=0x0) returned 0x4f [0081.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.819] GetFileType (hFile=0x154) returned 0x1 [0081.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.820] GetFileType (hFile=0x154) returned 0x1 [0081.820] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe1f [0081.820] ReadFile (in: hFile=0x154, lpBuffer=0x1b0db18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0db18*, lpNumberOfBytesRead=0x2ae560*=0xe1f, lpOverlapped=0x0) returned 1 [0081.821] CloseHandle (hObject=0x154) returned 1 [0081.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", lpFilePart=0x0) returned 0x4f [0081.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.834] GetFileType (hFile=0x154) returned 0x1 [0081.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.834] GetFileType (hFile=0x154) returned 0x1 [0081.835] CloseHandle (hObject=0x154) returned 1 [0081.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", lpFilePart=0x0) returned 0x4f [0081.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.anonymous", lpFilePart=0x0) returned 0x59 [0081.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.836] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957dda00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfb76c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0081.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.anonymous")) returned 1 [0081.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", lpFilePart=0x0) returned 0x4b [0081.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.837] GetFileType (hFile=0x154) returned 0x1 [0081.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.837] GetFileType (hFile=0x154) returned 0x1 [0081.837] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe0b [0081.837] ReadFile (in: hFile=0x154, lpBuffer=0x1b6226c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b6226c*, lpNumberOfBytesRead=0x2ae560*=0xe0b, lpOverlapped=0x0) returned 1 [0081.854] CloseHandle (hObject=0x154) returned 1 [0081.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", lpFilePart=0x0) returned 0x4b [0081.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.900] GetFileType (hFile=0x154) returned 0x1 [0081.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.900] GetFileType (hFile=0x154) returned 0x1 [0081.900] WriteFile (in: hFile=0x154, lpBuffer=0x19b5324*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19b5324*, lpNumberOfBytesWritten=0x2ae528*=0xe10, lpOverlapped=0x0) returned 1 [0081.901] CloseHandle (hObject=0x154) returned 1 [0081.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", lpFilePart=0x0) returned 0x4b [0081.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.901] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b143d00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfc0f190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe10)) returned 1 [0081.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.anonymous")) returned 1 [0081.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", lpFilePart=0x0) returned 0x4b [0081.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.902] GetFileType (hFile=0x154) returned 0x1 [0081.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.902] GetFileType (hFile=0x154) returned 0x1 [0081.903] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe16 [0081.903] ReadFile (in: hFile=0x154, lpBuffer=0x19b74a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19b74a0*, lpNumberOfBytesRead=0x2ae560*=0xe16, lpOverlapped=0x0) returned 1 [0081.904] CloseHandle (hObject=0x154) returned 1 [0081.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", lpFilePart=0x0) returned 0x4b [0081.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.922] GetFileType (hFile=0x154) returned 0x1 [0081.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.922] GetFileType (hFile=0x154) returned 0x1 [0081.922] WriteFile (in: hFile=0x154, lpBuffer=0x1a09bc0*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a09bc0*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0081.923] CloseHandle (hObject=0x154) returned 1 [0081.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", lpFilePart=0x0) returned 0x4b [0081.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.anonymous", lpFilePart=0x0) returned 0x55 [0081.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e03400, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfc5b450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0081.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.anonymous")) returned 1 [0081.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", lpFilePart=0x0) returned 0x4e [0081.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.925] GetFileType (hFile=0x154) returned 0x1 [0081.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.925] GetFileType (hFile=0x154) returned 0x1 [0081.925] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xefb [0081.925] ReadFile (in: hFile=0x154, lpBuffer=0x1a0be2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0be2c*, lpNumberOfBytesRead=0x2ae560*=0xefb, lpOverlapped=0x0) returned 1 [0081.926] CloseHandle (hObject=0x154) returned 1 [0081.938] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", lpFilePart=0x0) returned 0x4e [0081.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.940] GetFileType (hFile=0x154) returned 0x1 [0081.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.940] GetFileType (hFile=0x154) returned 0x1 [0081.940] WriteFile (in: hFile=0x154, lpBuffer=0x1a5e858*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a5e858*, lpNumberOfBytesWritten=0x2ae528*=0xf00, lpOverlapped=0x0) returned 1 [0081.941] CloseHandle (hObject=0x154) returned 1 [0081.941] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", lpFilePart=0x0) returned 0x4e [0081.941] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.anonymous", lpFilePart=0x0) returned 0x58 [0081.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.941] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcd4a700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfc815b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf00)) returned 1 [0081.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.anonymous")) returned 1 [0081.942] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", lpFilePart=0x0) returned 0x4a [0081.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.942] GetFileType (hFile=0x154) returned 0x1 [0081.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.942] GetFileType (hFile=0x154) returned 0x1 [0081.942] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe1f [0081.942] ReadFile (in: hFile=0x154, lpBuffer=0x1a609f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a609f0*, lpNumberOfBytesRead=0x2ae560*=0xe1f, lpOverlapped=0x0) returned 1 [0081.944] CloseHandle (hObject=0x154) returned 1 [0081.956] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", lpFilePart=0x0) returned 0x4a [0081.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.957] GetFileType (hFile=0x154) returned 0x1 [0081.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.957] GetFileType (hFile=0x154) returned 0x1 [0081.957] WriteFile (in: hFile=0x154, lpBuffer=0x1ab2fa8*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ab2fa8*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0081.958] CloseHandle (hObject=0x154) returned 1 [0081.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", lpFilePart=0x0) returned 0x4a [0081.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.anonymous", lpFilePart=0x0) returned 0x54 [0081.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.959] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d769700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfca7710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0081.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.anonymous")) returned 1 [0081.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", lpFilePart=0x0) returned 0x4c [0081.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.959] GetFileType (hFile=0x154) returned 0x1 [0081.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.959] GetFileType (hFile=0x154) returned 0x1 [0081.960] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe0f [0081.960] ReadFile (in: hFile=0x154, lpBuffer=0x1ab5120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab5120*, lpNumberOfBytesRead=0x2ae560*=0xe0f, lpOverlapped=0x0) returned 1 [0081.973] CloseHandle (hObject=0x154) returned 1 [0081.984] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", lpFilePart=0x0) returned 0x4c [0081.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0081.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.985] GetFileType (hFile=0x154) returned 0x1 [0081.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0081.985] GetFileType (hFile=0x154) returned 0x1 [0081.985] WriteFile (in: hFile=0x154, lpBuffer=0x1b07690*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b07690*, lpNumberOfBytesWritten=0x2ae528*=0xe10, lpOverlapped=0x0) returned 1 [0081.986] CloseHandle (hObject=0x154) returned 1 [0081.986] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", lpFilePart=0x0) returned 0x4c [0081.986] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.anonymous", lpFilePart=0x0) returned 0x56 [0081.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0081.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b73bb00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfcf39d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe10)) returned 1 [0081.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0081.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.anonymous")) returned 1 [0081.987] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", lpFilePart=0x0) returned 0x4e [0081.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0081.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0081.988] GetFileType (hFile=0x154) returned 0x1 [0081.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0081.988] GetFileType (hFile=0x154) returned 0x1 [0081.988] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe0e [0081.988] ReadFile (in: hFile=0x154, lpBuffer=0x1b0981c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0981c*, lpNumberOfBytesRead=0x2ae560*=0xe0e, lpOverlapped=0x0) returned 1 [0081.992] CloseHandle (hObject=0x154) returned 1 [0082.003] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", lpFilePart=0x0) returned 0x4e [0082.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.006] GetFileType (hFile=0x154) returned 0x1 [0082.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.006] GetFileType (hFile=0x154) returned 0x1 [0082.006] WriteFile (in: hFile=0x154, lpBuffer=0x1b5bd94*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b5bd94*, lpNumberOfBytesWritten=0x2ae528*=0xe10, lpOverlapped=0x0) returned 1 [0082.008] CloseHandle (hObject=0x154) returned 1 [0082.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", lpFilePart=0x0) returned 0x4e [0082.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0682e00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfd19b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe10)) returned 1 [0082.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.anonymous")) returned 1 [0082.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", lpFilePart=0x0) returned 0x4e [0082.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.010] GetFileType (hFile=0x154) returned 0x1 [0082.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.010] GetFileType (hFile=0x154) returned 0x1 [0082.010] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdc6 [0082.010] ReadFile (in: hFile=0x154, lpBuffer=0x1b5dee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b5dee4*, lpNumberOfBytesRead=0x2ae560*=0xdc6, lpOverlapped=0x0) returned 1 [0082.023] CloseHandle (hObject=0x154) returned 1 [0082.034] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", lpFilePart=0x0) returned 0x4e [0082.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.036] GetFileType (hFile=0x154) returned 0x1 [0082.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.036] GetFileType (hFile=0x154) returned 0x1 [0082.039] WriteFile (in: hFile=0x154, lpBuffer=0x19afb5c*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19afb5c*, lpNumberOfBytesWritten=0x2ae528*=0xdd0, lpOverlapped=0x0) returned 1 [0082.040] CloseHandle (hObject=0x154) returned 1 [0082.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", lpFilePart=0x0) returned 0x4e [0082.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.040] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610a1e00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfd65df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdd0)) returned 1 [0082.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.anonymous")) returned 1 [0082.041] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", lpFilePart=0x0) returned 0x4c [0082.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.041] GetFileType (hFile=0x154) returned 0x1 [0082.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.041] GetFileType (hFile=0x154) returned 0x1 [0082.041] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xefc [0082.041] ReadFile (in: hFile=0x154, lpBuffer=0x19b1dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19b1dd8*, lpNumberOfBytesRead=0x2ae560*=0xefc, lpOverlapped=0x0) returned 1 [0082.042] CloseHandle (hObject=0x154) returned 1 [0082.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", lpFilePart=0x0) returned 0x4c [0082.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.077] GetFileType (hFile=0x154) returned 0x1 [0082.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.078] GetFileType (hFile=0x154) returned 0x1 [0082.078] WriteFile (in: hFile=0x154, lpBuffer=0x1a04954*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a04954*, lpNumberOfBytesWritten=0x2ae528*=0xf00, lpOverlapped=0x0) returned 1 [0082.079] CloseHandle (hObject=0x154) returned 1 [0082.079] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", lpFilePart=0x0) returned 0x4c [0082.079] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.anonymous", lpFilePart=0x0) returned 0x56 [0082.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.079] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52ce200, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfdd8210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf00)) returned 1 [0082.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.anonymous")) returned 1 [0082.080] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", lpFilePart=0x0) returned 0x4e [0082.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.080] GetFileType (hFile=0x154) returned 0x1 [0082.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.081] GetFileType (hFile=0x154) returned 0x1 [0082.081] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe48 [0082.081] ReadFile (in: hFile=0x154, lpBuffer=0x1a06b18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a06b18*, lpNumberOfBytesRead=0x2ae560*=0xe48, lpOverlapped=0x0) returned 1 [0082.082] CloseHandle (hObject=0x154) returned 1 [0082.094] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", lpFilePart=0x0) returned 0x4e [0082.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.095] GetFileType (hFile=0x154) returned 0x1 [0082.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.096] GetFileType (hFile=0x154) returned 0x1 [0082.096] WriteFile (in: hFile=0x154, lpBuffer=0x1a591d4*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a591d4*, lpNumberOfBytesWritten=0x2ae528*=0xe50, lpOverlapped=0x0) returned 1 [0082.097] CloseHandle (hObject=0x154) returned 1 [0082.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", lpFilePart=0x0) returned 0x4e [0082.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.097] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9f19600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfdfe370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe50)) returned 1 [0082.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.anonymous")) returned 1 [0082.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", lpFilePart=0x0) returned 0x4b [0082.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.104] GetFileType (hFile=0x154) returned 0x1 [0082.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.104] GetFileType (hFile=0x154) returned 0x1 [0082.104] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xef5 [0082.104] ReadFile (in: hFile=0x154, lpBuffer=0x1a5b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a5b448*, lpNumberOfBytesRead=0x2ae560*=0xef5, lpOverlapped=0x0) returned 1 [0082.105] CloseHandle (hObject=0x154) returned 1 [0082.117] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", lpFilePart=0x0) returned 0x4b [0082.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.118] GetFileType (hFile=0x154) returned 0x1 [0082.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.119] GetFileType (hFile=0x154) returned 0x1 [0082.119] WriteFile (in: hFile=0x154, lpBuffer=0x1aade6c*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1aade6c*, lpNumberOfBytesWritten=0x2ae528*=0xf00, lpOverlapped=0x0) returned 1 [0082.120] CloseHandle (hObject=0x154) returned 1 [0082.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", lpFilePart=0x0) returned 0x4b [0082.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.anonymous", lpFilePart=0x0) returned 0x55 [0082.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.120] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x649da500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfe244d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf00)) returned 1 [0082.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.anonymous")) returned 1 [0082.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", lpFilePart=0x0) returned 0x4e [0082.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.121] GetFileType (hFile=0x154) returned 0x1 [0082.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.121] GetFileType (hFile=0x154) returned 0x1 [0082.121] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe16 [0082.121] ReadFile (in: hFile=0x154, lpBuffer=0x1aafff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aafff4*, lpNumberOfBytesRead=0x2ae560*=0xe16, lpOverlapped=0x0) returned 1 [0082.122] CloseHandle (hObject=0x154) returned 1 [0082.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", lpFilePart=0x0) returned 0x4e [0082.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.135] GetFileType (hFile=0x154) returned 0x1 [0082.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.135] GetFileType (hFile=0x154) returned 0x1 [0082.136] WriteFile (in: hFile=0x154, lpBuffer=0x1b025c4*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b025c4*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.137] CloseHandle (hObject=0x154) returned 1 [0082.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", lpFilePart=0x0) returned 0x4e [0082.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.137] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f074200, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfe4a630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.anonymous")) returned 1 [0082.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", lpFilePart=0x0) returned 0x4e [0082.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.138] GetFileType (hFile=0x154) returned 0x1 [0082.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.138] GetFileType (hFile=0x154) returned 0x1 [0082.138] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe2f [0082.138] ReadFile (in: hFile=0x154, lpBuffer=0x1b0477c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0477c*, lpNumberOfBytesRead=0x2ae560*=0xe2f, lpOverlapped=0x0) returned 1 [0082.139] CloseHandle (hObject=0x154) returned 1 [0082.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", lpFilePart=0x0) returned 0x4e [0082.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.153] GetFileType (hFile=0x154) returned 0x1 [0082.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.153] GetFileType (hFile=0x154) returned 0x1 [0082.153] WriteFile (in: hFile=0x154, lpBuffer=0x1b56d94*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b56d94*, lpNumberOfBytesWritten=0x2ae528*=0xe30, lpOverlapped=0x0) returned 1 [0082.154] CloseHandle (hObject=0x154) returned 1 [0082.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", lpFilePart=0x0) returned 0x4e [0082.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.154] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc53f000, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d4fb90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfe70790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0082.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.anonymous")) returned 1 [0082.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", lpFilePart=0x0) returned 0x49 [0082.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.155] GetFileType (hFile=0x154) returned 0x1 [0082.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.155] GetFileType (hFile=0x154) returned 0x1 [0082.155] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdb5 [0082.155] ReadFile (in: hFile=0x154, lpBuffer=0x1b58ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b58ec0*, lpNumberOfBytesRead=0x2ae560*=0xdb5, lpOverlapped=0x0) returned 1 [0082.157] CloseHandle (hObject=0x154) returned 1 [0082.169] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", lpFilePart=0x0) returned 0x49 [0082.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.170] GetFileType (hFile=0x154) returned 0x1 [0082.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.170] GetFileType (hFile=0x154) returned 0x1 [0082.171] WriteFile (in: hFile=0x154, lpBuffer=0x1bab29c*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1bab29c*, lpNumberOfBytesWritten=0x2ae528*=0xdc0, lpOverlapped=0x0) returned 1 [0082.172] CloseHandle (hObject=0x154) returned 1 [0082.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", lpFilePart=0x0) returned 0x49 [0082.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.anonymous", lpFilePart=0x0) returned 0x53 [0082.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.172] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a938600, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcfebca50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdc0)) returned 1 [0082.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.anonymous")) returned 1 [0082.173] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", lpFilePart=0x0) returned 0x4c [0082.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.173] GetFileType (hFile=0x154) returned 0x1 [0082.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.173] GetFileType (hFile=0x154) returned 0x1 [0082.173] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xed4 [0082.173] ReadFile (in: hFile=0x154, lpBuffer=0x1bad4cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1bad4cc*, lpNumberOfBytesRead=0x2ae560*=0xed4, lpOverlapped=0x0) returned 1 [0082.176] CloseHandle (hObject=0x154) returned 1 [0082.213] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", lpFilePart=0x0) returned 0x4c [0082.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.216] GetFileType (hFile=0x154) returned 0x1 [0082.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.216] GetFileType (hFile=0x154) returned 0x1 [0082.216] WriteFile (in: hFile=0x154, lpBuffer=0x19ff340*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19ff340*, lpNumberOfBytesWritten=0x2ae528*=0xee0, lpOverlapped=0x0) returned 1 [0082.218] CloseHandle (hObject=0x154) returned 1 [0082.218] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", lpFilePart=0x0) returned 0x4c [0082.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.anonymous", lpFilePart=0x0) returned 0x56 [0082.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68312c00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcff2ee70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xee0)) returned 1 [0082.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.anonymous")) returned 1 [0082.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", lpFilePart=0x0) returned 0x49 [0082.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.219] GetFileType (hFile=0x154) returned 0x1 [0082.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.220] GetFileType (hFile=0x154) returned 0x1 [0082.220] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe59 [0082.220] ReadFile (in: hFile=0x154, lpBuffer=0x1a01504, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a01504*, lpNumberOfBytesRead=0x2ae560*=0xe59, lpOverlapped=0x0) returned 1 [0082.221] CloseHandle (hObject=0x154) returned 1 [0082.233] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", lpFilePart=0x0) returned 0x49 [0082.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.234] GetFileType (hFile=0x154) returned 0x1 [0082.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.234] GetFileType (hFile=0x154) returned 0x1 [0082.234] WriteFile (in: hFile=0x154, lpBuffer=0x1a53d58*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a53d58*, lpNumberOfBytesWritten=0x2ae528*=0xe60, lpOverlapped=0x0) returned 1 [0082.235] CloseHandle (hObject=0x154) returned 1 [0082.235] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", lpFilePart=0x0) returned 0x49 [0082.236] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.anonymous", lpFilePart=0x0) returned 0x53 [0082.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.236] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa29ac900, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcff54fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0082.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.anonymous")) returned 1 [0082.236] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", lpFilePart=0x0) returned 0x4e [0082.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.237] GetFileType (hFile=0x154) returned 0x1 [0082.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.237] GetFileType (hFile=0x154) returned 0x1 [0082.237] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf09 [0082.237] ReadFile (in: hFile=0x154, lpBuffer=0x1a55fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a55fc8*, lpNumberOfBytesRead=0x2ae560*=0xf09, lpOverlapped=0x0) returned 1 [0082.238] CloseHandle (hObject=0x154) returned 1 [0082.250] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", lpFilePart=0x0) returned 0x4e [0082.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.252] GetFileType (hFile=0x154) returned 0x1 [0082.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.252] GetFileType (hFile=0x154) returned 0x1 [0082.252] WriteFile (in: hFile=0x154, lpBuffer=0x1aa8a44*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1aa8a44*, lpNumberOfBytesWritten=0x2ae528*=0xf10, lpOverlapped=0x0) returned 1 [0082.253] CloseHandle (hObject=0x154) returned 1 [0082.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", lpFilePart=0x0) returned 0x4e [0082.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.253] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fd2300, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcff7b130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf10)) returned 1 [0082.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.anonymous")) returned 1 [0082.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", lpFilePart=0x0) returned 0x4c [0082.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.254] GetFileType (hFile=0x154) returned 0x1 [0082.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.254] GetFileType (hFile=0x154) returned 0x1 [0082.254] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe2a [0082.254] ReadFile (in: hFile=0x154, lpBuffer=0x1aaabf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aaabf0*, lpNumberOfBytesRead=0x2ae560*=0xe2a, lpOverlapped=0x0) returned 1 [0082.255] CloseHandle (hObject=0x154) returned 1 [0082.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", lpFilePart=0x0) returned 0x4c [0082.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.268] GetFileType (hFile=0x154) returned 0x1 [0082.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.268] GetFileType (hFile=0x154) returned 0x1 [0082.268] WriteFile (in: hFile=0x154, lpBuffer=0x1afd204*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1afd204*, lpNumberOfBytesWritten=0x2ae528*=0xe30, lpOverlapped=0x0) returned 1 [0082.269] CloseHandle (hObject=0x154) returned 1 [0082.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", lpFilePart=0x0) returned 0x4c [0082.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.anonymous", lpFilePart=0x0) returned 0x56 [0082.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe77700, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcffa1290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0082.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.anonymous")) returned 1 [0082.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", lpFilePart=0x0) returned 0x4b [0082.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.270] GetFileType (hFile=0x154) returned 0x1 [0082.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.270] GetFileType (hFile=0x154) returned 0x1 [0082.271] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xeed [0082.271] ReadFile (in: hFile=0x154, lpBuffer=0x1aff464, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aff464*, lpNumberOfBytesRead=0x2ae560*=0xeed, lpOverlapped=0x0) returned 1 [0082.272] CloseHandle (hObject=0x154) returned 1 [0082.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", lpFilePart=0x0) returned 0x4b [0082.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.286] GetFileType (hFile=0x154) returned 0x1 [0082.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.286] GetFileType (hFile=0x154) returned 0x1 [0082.286] WriteFile (in: hFile=0x154, lpBuffer=0x1b51e30*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b51e30*, lpNumberOfBytesWritten=0x2ae528*=0xef0, lpOverlapped=0x0) returned 1 [0082.287] CloseHandle (hObject=0x154) returned 1 [0082.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", lpFilePart=0x0) returned 0x4b [0082.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.anonymous", lpFilePart=0x0) returned 0x55 [0082.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.287] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e270d00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcffc73f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xef0)) returned 1 [0082.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.anonymous")) returned 1 [0082.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", lpFilePart=0x0) returned 0x4a [0082.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.288] GetFileType (hFile=0x154) returned 0x1 [0082.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.288] GetFileType (hFile=0x154) returned 0x1 [0082.288] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe13 [0082.288] ReadFile (in: hFile=0x154, lpBuffer=0x1b53fa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b53fa4*, lpNumberOfBytesRead=0x2ae560*=0xe13, lpOverlapped=0x0) returned 1 [0082.290] CloseHandle (hObject=0x154) returned 1 [0082.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", lpFilePart=0x0) returned 0x4a [0082.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.302] GetFileType (hFile=0x154) returned 0x1 [0082.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.303] GetFileType (hFile=0x154) returned 0x1 [0082.303] WriteFile (in: hFile=0x154, lpBuffer=0x1ba6568*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ba6568*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.304] CloseHandle (hObject=0x154) returned 1 [0082.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", lpFilePart=0x0) returned 0x4a [0082.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.anonymous", lpFilePart=0x0) returned 0x54 [0082.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.304] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ba9400, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xcffed550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.anonymous")) returned 1 [0082.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", lpFilePart=0x0) returned 0x4b [0082.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.305] GetFileType (hFile=0x154) returned 0x1 [0082.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.305] GetFileType (hFile=0x154) returned 0x1 [0082.305] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe05 [0082.305] ReadFile (in: hFile=0x154, lpBuffer=0x1ba86d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ba86d4*, lpNumberOfBytesRead=0x2ae560*=0xe05, lpOverlapped=0x0) returned 1 [0082.316] CloseHandle (hObject=0x154) returned 1 [0082.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", lpFilePart=0x0) returned 0x4b [0082.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.355] GetFileType (hFile=0x154) returned 0x1 [0082.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.355] GetFileType (hFile=0x154) returned 0x1 [0082.355] WriteFile (in: hFile=0x154, lpBuffer=0x19fab78*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19fab78*, lpNumberOfBytesWritten=0x2ae528*=0xe10, lpOverlapped=0x0) returned 1 [0082.356] CloseHandle (hObject=0x154) returned 1 [0082.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", lpFilePart=0x0) returned 0x4b [0082.357] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.anonymous", lpFilePart=0x0) returned 0x55 [0082.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.357] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741cee00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd005f970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe10)) returned 1 [0082.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.anonymous")) returned 1 [0082.358] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", lpFilePart=0x0) returned 0x4e [0082.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.358] GetFileType (hFile=0x154) returned 0x1 [0082.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.358] GetFileType (hFile=0x154) returned 0x1 [0082.359] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe39 [0082.359] ReadFile (in: hFile=0x154, lpBuffer=0x19fcd24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19fcd24*, lpNumberOfBytesRead=0x2ae560*=0xe39, lpOverlapped=0x0) returned 1 [0082.360] CloseHandle (hObject=0x154) returned 1 [0082.371] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", lpFilePart=0x0) returned 0x4e [0082.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.373] GetFileType (hFile=0x154) returned 0x1 [0082.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.373] GetFileType (hFile=0x154) returned 0x1 [0082.373] WriteFile (in: hFile=0x154, lpBuffer=0x1a4f4ec*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a4f4ec*, lpNumberOfBytesWritten=0x2ae528*=0xe40, lpOverlapped=0x0) returned 1 [0082.374] CloseHandle (hObject=0x154) returned 1 [0082.374] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", lpFilePart=0x0) returned 0x4e [0082.374] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.anonymous", lpFilePart=0x0) returned 0x58 [0082.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.374] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37afe00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd00abc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe40)) returned 1 [0082.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.anonymous")) returned 1 [0082.375] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", lpFilePart=0x0) returned 0x4d [0082.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.375] GetFileType (hFile=0x154) returned 0x1 [0082.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.375] GetFileType (hFile=0x154) returned 0x1 [0082.375] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe15 [0082.376] ReadFile (in: hFile=0x154, lpBuffer=0x1a51688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a51688*, lpNumberOfBytesRead=0x2ae560*=0xe15, lpOverlapped=0x0) returned 1 [0082.379] CloseHandle (hObject=0x154) returned 1 [0082.390] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", lpFilePart=0x0) returned 0x4d [0082.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.393] GetFileType (hFile=0x154) returned 0x1 [0082.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.393] GetFileType (hFile=0x154) returned 0x1 [0082.393] WriteFile (in: hFile=0x154, lpBuffer=0x1aa3c54*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1aa3c54*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.395] CloseHandle (hObject=0x154) returned 1 [0082.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", lpFilePart=0x0) returned 0x4d [0082.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.anonymous", lpFilePart=0x0) returned 0x57 [0082.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851bed00, ftCreationTime.dwHighDateTime=0x1c9b889, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd00d1d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.anonymous")) returned 1 [0082.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", lpFilePart=0x0) returned 0x55 [0082.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.396] GetFileType (hFile=0x154) returned 0x1 [0082.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.397] GetFileType (hFile=0x154) returned 0x1 [0082.397] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe01 [0082.397] ReadFile (in: hFile=0x154, lpBuffer=0x1aa5df0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aa5df0*, lpNumberOfBytesRead=0x2ae560*=0xe01, lpOverlapped=0x0) returned 1 [0082.398] CloseHandle (hObject=0x154) returned 1 [0082.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", lpFilePart=0x0) returned 0x55 [0082.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.412] GetFileType (hFile=0x154) returned 0x1 [0082.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.412] GetFileType (hFile=0x154) returned 0x1 [0082.412] WriteFile (in: hFile=0x154, lpBuffer=0x1af8390*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1af8390*, lpNumberOfBytesWritten=0x2ae528*=0xe10, lpOverlapped=0x0) returned 1 [0082.413] CloseHandle (hObject=0x154) returned 1 [0082.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", lpFilePart=0x0) returned 0x55 [0082.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.anonymous", lpFilePart=0x0) returned 0x5f [0082.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.414] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851bed00, ftCreationTime.dwHighDateTime=0x1c9b889, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd00f7ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe10)) returned 1 [0082.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.anonymous")) returned 1 [0082.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", lpFilePart=0x0) returned 0x53 [0082.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.415] GetFileType (hFile=0x154) returned 0x1 [0082.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.415] GetFileType (hFile=0x154) returned 0x1 [0082.415] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe20 [0082.415] ReadFile (in: hFile=0x154, lpBuffer=0x1afa570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1afa570*, lpNumberOfBytesRead=0x2ae560*=0xe20, lpOverlapped=0x0) returned 1 [0082.416] CloseHandle (hObject=0x154) returned 1 [0082.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", lpFilePart=0x0) returned 0x53 [0082.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.429] GetFileType (hFile=0x154) returned 0x1 [0082.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.429] GetFileType (hFile=0x154) returned 0x1 [0082.429] WriteFile (in: hFile=0x154, lpBuffer=0x1b4cba8*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b4cba8*, lpNumberOfBytesWritten=0x2ae528*=0xe30, lpOverlapped=0x0) returned 1 [0082.430] CloseHandle (hObject=0x154) returned 1 [0082.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", lpFilePart=0x0) returned 0x53 [0082.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.anonymous", lpFilePart=0x0) returned 0x5d [0082.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.431] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851bed00, ftCreationTime.dwHighDateTime=0x1c9b889, ftLastAccessTime.dwLowDateTime=0x883bf510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd011e050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0082.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.anonymous")) returned 1 [0082.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", lpFilePart=0x0) returned 0x4c [0082.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.431] GetFileType (hFile=0x154) returned 0x1 [0082.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.432] GetFileType (hFile=0x154) returned 0x1 [0082.432] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe1d [0082.432] ReadFile (in: hFile=0x154, lpBuffer=0x1b4ed60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b4ed60*, lpNumberOfBytesRead=0x2ae560*=0xe1d, lpOverlapped=0x0) returned 1 [0082.433] CloseHandle (hObject=0x154) returned 1 [0082.444] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", lpFilePart=0x0) returned 0x4c [0082.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.446] GetFileType (hFile=0x154) returned 0x1 [0082.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.446] GetFileType (hFile=0x154) returned 0x1 [0082.446] WriteFile (in: hFile=0x154, lpBuffer=0x1ba1320*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ba1320*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.447] CloseHandle (hObject=0x154) returned 1 [0082.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", lpFilePart=0x0) returned 0x4c [0082.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.anonymous", lpFilePart=0x0) returned 0x56 [0082.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.447] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b07500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd01441b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.anonymous")) returned 1 [0082.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpFilePart=0x0) returned 0x4a [0082.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.450] GetFileType (hFile=0x154) returned 0x1 [0082.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.450] GetFileType (hFile=0x154) returned 0x1 [0082.450] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe5a [0082.450] ReadFile (in: hFile=0x154, lpBuffer=0x1ba34e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ba34e8*, lpNumberOfBytesRead=0x2ae560*=0xe5a, lpOverlapped=0x0) returned 1 [0082.452] CloseHandle (hObject=0x154) returned 1 [0082.489] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpFilePart=0x0) returned 0x4a [0082.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.490] GetFileType (hFile=0x154) returned 0x1 [0082.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.490] GetFileType (hFile=0x154) returned 0x1 [0082.490] WriteFile (in: hFile=0x154, lpBuffer=0x19f5c34*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19f5c34*, lpNumberOfBytesWritten=0x2ae528*=0xe60, lpOverlapped=0x0) returned 1 [0082.491] CloseHandle (hObject=0x154) returned 1 [0082.491] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", lpFilePart=0x0) returned 0x4a [0082.492] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.anonymous", lpFilePart=0x0) returned 0x54 [0082.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.492] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b43fc00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd01b65d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0082.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.anonymous")) returned 1 [0082.492] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", lpFilePart=0x0) returned 0x4b [0082.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.493] GetFileType (hFile=0x154) returned 0x1 [0082.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.493] GetFileType (hFile=0x154) returned 0x1 [0082.493] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xeed [0082.493] ReadFile (in: hFile=0x154, lpBuffer=0x19f7e88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19f7e88*, lpNumberOfBytesRead=0x2ae560*=0xeed, lpOverlapped=0x0) returned 1 [0082.494] CloseHandle (hObject=0x154) returned 1 [0082.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", lpFilePart=0x0) returned 0x4b [0082.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.507] GetFileType (hFile=0x154) returned 0x1 [0082.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.507] GetFileType (hFile=0x154) returned 0x1 [0082.507] WriteFile (in: hFile=0x154, lpBuffer=0x1a4a9b0*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a4a9b0*, lpNumberOfBytesWritten=0x2ae528*=0xef0, lpOverlapped=0x0) returned 1 [0082.508] CloseHandle (hObject=0x154) returned 1 [0082.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", lpFilePart=0x0) returned 0x4b [0082.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.anonymous", lpFilePart=0x0) returned 0x55 [0082.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.510] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed78300, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd01dc730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xef0)) returned 1 [0082.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.anonymous")) returned 1 [0082.510] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", lpFilePart=0x0) returned 0x4a [0082.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.510] GetFileType (hFile=0x154) returned 0x1 [0082.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.511] GetFileType (hFile=0x154) returned 0x1 [0082.511] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe2c [0082.511] ReadFile (in: hFile=0x154, lpBuffer=0x1a4cb3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a4cb3c*, lpNumberOfBytesRead=0x2ae560*=0xe2c, lpOverlapped=0x0) returned 1 [0082.513] CloseHandle (hObject=0x154) returned 1 [0082.525] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", lpFilePart=0x0) returned 0x4a [0082.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.528] GetFileType (hFile=0x154) returned 0x1 [0082.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.528] GetFileType (hFile=0x154) returned 0x1 [0082.528] WriteFile (in: hFile=0x154, lpBuffer=0x1a9f144*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a9f144*, lpNumberOfBytesWritten=0x2ae528*=0xe30, lpOverlapped=0x0) returned 1 [0082.530] CloseHandle (hObject=0x154) returned 1 [0082.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", lpFilePart=0x0) returned 0x4a [0082.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.anonymous", lpFilePart=0x0) returned 0x54 [0082.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.530] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8139dd00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd02289f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0082.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.anonymous")) returned 1 [0082.531] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", lpFilePart=0x0) returned 0x50 [0082.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.531] GetFileType (hFile=0x154) returned 0x1 [0082.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.531] GetFileType (hFile=0x154) returned 0x1 [0082.531] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe0f [0082.531] ReadFile (in: hFile=0x154, lpBuffer=0x1aa12cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aa12cc*, lpNumberOfBytesRead=0x2ae560*=0xe0f, lpOverlapped=0x0) returned 1 [0082.535] CloseHandle (hObject=0x154) returned 1 [0082.547] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", lpFilePart=0x0) returned 0x50 [0082.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.548] GetFileType (hFile=0x154) returned 0x1 [0082.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.548] GetFileType (hFile=0x154) returned 0x1 [0082.548] WriteFile (in: hFile=0x154, lpBuffer=0x1af384c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1af384c*, lpNumberOfBytesWritten=0x2ae528*=0xe10, lpOverlapped=0x0) returned 1 [0082.549] CloseHandle (hObject=0x154) returned 1 [0082.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", lpFilePart=0x0) returned 0x50 [0082.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.anonymous", lpFilePart=0x0) returned 0x5a [0082.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa890aa00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd024eb50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe10)) returned 1 [0082.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.anonymous")) returned 1 [0082.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", lpFilePart=0x0) returned 0x4c [0082.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.550] GetFileType (hFile=0x154) returned 0x1 [0082.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.550] GetFileType (hFile=0x154) returned 0x1 [0082.550] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe7f [0082.550] ReadFile (in: hFile=0x154, lpBuffer=0x1af5a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af5a58*, lpNumberOfBytesRead=0x2ae560*=0xe7f, lpOverlapped=0x0) returned 1 [0082.552] CloseHandle (hObject=0x154) returned 1 [0082.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", lpFilePart=0x0) returned 0x4c [0082.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.565] GetFileType (hFile=0x154) returned 0x1 [0082.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.565] GetFileType (hFile=0x154) returned 0x1 [0082.565] WriteFile (in: hFile=0x154, lpBuffer=0x1b481f8*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b481f8*, lpNumberOfBytesWritten=0x2ae528*=0xe80, lpOverlapped=0x0) returned 1 [0082.566] CloseHandle (hObject=0x154) returned 1 [0082.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", lpFilePart=0x0) returned 0x4c [0082.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.anonymous", lpFilePart=0x0) returned 0x56 [0082.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac243100, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0274cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe80)) returned 1 [0082.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.anonymous")) returned 1 [0082.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", lpFilePart=0x0) returned 0x4f [0082.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.567] GetFileType (hFile=0x154) returned 0x1 [0082.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.567] GetFileType (hFile=0x154) returned 0x1 [0082.567] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe18 [0082.567] ReadFile (in: hFile=0x154, lpBuffer=0x1b4a390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b4a390*, lpNumberOfBytesRead=0x2ae560*=0xe18, lpOverlapped=0x0) returned 1 [0082.568] CloseHandle (hObject=0x154) returned 1 [0082.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", lpFilePart=0x0) returned 0x4f [0082.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.584] GetFileType (hFile=0x154) returned 0x1 [0082.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.584] GetFileType (hFile=0x154) returned 0x1 [0082.584] WriteFile (in: hFile=0x154, lpBuffer=0x1b9c960*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b9c960*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.585] CloseHandle (hObject=0x154) returned 1 [0082.585] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", lpFilePart=0x0) returned 0x4f [0082.585] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.anonymous", lpFilePart=0x0) returned 0x59 [0082.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.585] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd70e8500, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd029ae10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.anonymous")) returned 1 [0082.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", lpFilePart=0x0) returned 0x4d [0082.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.586] GetFileType (hFile=0x154) returned 0x1 [0082.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.586] GetFileType (hFile=0x154) returned 0x1 [0082.586] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xee9 [0082.586] ReadFile (in: hFile=0x154, lpBuffer=0x1b9ebd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b9ebd0*, lpNumberOfBytesRead=0x2ae560*=0xee9, lpOverlapped=0x0) returned 1 [0082.588] CloseHandle (hObject=0x154) returned 1 [0082.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", lpFilePart=0x0) returned 0x4d [0082.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.626] GetFileType (hFile=0x154) returned 0x1 [0082.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.626] GetFileType (hFile=0x154) returned 0x1 [0082.626] WriteFile (in: hFile=0x154, lpBuffer=0x19f1618*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19f1618*, lpNumberOfBytesWritten=0x2ae528*=0xef0, lpOverlapped=0x0) returned 1 [0082.627] CloseHandle (hObject=0x154) returned 1 [0082.627] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", lpFilePart=0x0) returned 0x4d [0082.627] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.anonymous", lpFilePart=0x0) returned 0x57 [0082.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.627] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cd6400, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd030d230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xef0)) returned 1 [0082.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.anonymous")) returned 1 [0082.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", lpFilePart=0x0) returned 0x4c [0082.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.629] GetFileType (hFile=0x154) returned 0x1 [0082.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.629] GetFileType (hFile=0x154) returned 0x1 [0082.629] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe13 [0082.629] ReadFile (in: hFile=0x154, lpBuffer=0x19f37a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19f37a0*, lpNumberOfBytesRead=0x2ae560*=0xe13, lpOverlapped=0x0) returned 1 [0082.630] CloseHandle (hObject=0x154) returned 1 [0082.642] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", lpFilePart=0x0) returned 0x4c [0082.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.643] GetFileType (hFile=0x154) returned 0x1 [0082.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.643] GetFileType (hFile=0x154) returned 0x1 [0082.643] WriteFile (in: hFile=0x154, lpBuffer=0x1a45ec8*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a45ec8*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.644] CloseHandle (hObject=0x154) returned 1 [0082.644] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", lpFilePart=0x0) returned 0x4c [0082.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.anonymous", lpFilePart=0x0) returned 0x56 [0082.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.645] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8860eb00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0333390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.anonymous")) returned 1 [0082.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", lpFilePart=0x0) returned 0x4b [0082.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.646] GetFileType (hFile=0x154) returned 0x1 [0082.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.646] GetFileType (hFile=0x154) returned 0x1 [0082.646] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xeff [0082.646] ReadFile (in: hFile=0x154, lpBuffer=0x1a48138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a48138*, lpNumberOfBytesRead=0x2ae560*=0xeff, lpOverlapped=0x0) returned 1 [0082.647] CloseHandle (hObject=0x154) returned 1 [0082.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", lpFilePart=0x0) returned 0x4b [0082.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.660] GetFileType (hFile=0x154) returned 0x1 [0082.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.660] GetFileType (hFile=0x154) returned 0x1 [0082.660] WriteFile (in: hFile=0x154, lpBuffer=0x1a9ab54*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a9ab54*, lpNumberOfBytesWritten=0x2ae528*=0xf00, lpOverlapped=0x0) returned 1 [0082.661] CloseHandle (hObject=0x154) returned 1 [0082.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", lpFilePart=0x0) returned 0x4b [0082.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.anonymous", lpFilePart=0x0) returned 0x55 [0082.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.662] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafb7b800, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x77d75cf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd03594f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf00)) returned 1 [0082.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.anonymous")) returned 1 [0082.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", lpFilePart=0x0) returned 0x49 [0082.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.663] GetFileType (hFile=0x154) returned 0x1 [0082.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.663] GetFileType (hFile=0x154) returned 0x1 [0082.663] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe20 [0082.663] ReadFile (in: hFile=0x154, lpBuffer=0x1a9ccd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a9ccd0*, lpNumberOfBytesRead=0x2ae560*=0xe20, lpOverlapped=0x0) returned 1 [0082.666] CloseHandle (hObject=0x154) returned 1 [0082.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", lpFilePart=0x0) returned 0x49 [0082.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.681] GetFileType (hFile=0x154) returned 0x1 [0082.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.681] GetFileType (hFile=0x154) returned 0x1 [0082.681] WriteFile (in: hFile=0x154, lpBuffer=0x1aef2e0*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1aef2e0*, lpNumberOfBytesWritten=0x2ae528*=0xe30, lpOverlapped=0x0) returned 1 [0082.682] CloseHandle (hObject=0x154) returned 1 [0082.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", lpFilePart=0x0) returned 0x49 [0082.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.anonymous", lpFilePart=0x0) returned 0x53 [0082.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.683] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf47200, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd037f650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0082.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.anonymous")) returned 1 [0082.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", lpFilePart=0x0) returned 0x4a [0082.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.683] GetFileType (hFile=0x154) returned 0x1 [0082.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.684] GetFileType (hFile=0x154) returned 0x1 [0082.684] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe19 [0082.684] ReadFile (in: hFile=0x154, lpBuffer=0x1af1450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af1450*, lpNumberOfBytesRead=0x2ae560*=0xe19, lpOverlapped=0x0) returned 1 [0082.687] CloseHandle (hObject=0x154) returned 1 [0082.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", lpFilePart=0x0) returned 0x4a [0082.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.701] GetFileType (hFile=0x154) returned 0x1 [0082.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.701] GetFileType (hFile=0x154) returned 0x1 [0082.701] WriteFile (in: hFile=0x154, lpBuffer=0x1b43a0c*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b43a0c*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.704] CloseHandle (hObject=0x154) returned 1 [0082.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", lpFilePart=0x0) returned 0x4a [0082.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.anonymous", lpFilePart=0x0) returned 0x54 [0082.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.704] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e56cc00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd03cb910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.anonymous")) returned 1 [0082.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", lpFilePart=0x0) returned 0x4a [0082.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.705] GetFileType (hFile=0x154) returned 0x1 [0082.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.705] GetFileType (hFile=0x154) returned 0x1 [0082.705] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xe14 [0082.705] ReadFile (in: hFile=0x154, lpBuffer=0x1b45b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b45b80*, lpNumberOfBytesRead=0x2ae560*=0xe14, lpOverlapped=0x0) returned 1 [0082.706] CloseHandle (hObject=0x154) returned 1 [0082.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", lpFilePart=0x0) returned 0x4a [0082.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.719] GetFileType (hFile=0x154) returned 0x1 [0082.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.719] GetFileType (hFile=0x154) returned 0x1 [0082.719] WriteFile (in: hFile=0x154, lpBuffer=0x1b98140*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b98140*, lpNumberOfBytesWritten=0x2ae528*=0xe20, lpOverlapped=0x0) returned 1 [0082.720] CloseHandle (hObject=0x154) returned 1 [0082.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", lpFilePart=0x0) returned 0x4a [0082.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.anonymous", lpFilePart=0x0) returned 0x54 [0082.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.721] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ea5300, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd03f1a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0082.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.anonymous")) returned 1 [0082.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", lpFilePart=0x0) returned 0x4d [0082.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.722] GetFileType (hFile=0x154) returned 0x1 [0082.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.722] GetFileType (hFile=0x154) returned 0x1 [0082.722] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdf9 [0082.722] ReadFile (in: hFile=0x154, lpBuffer=0x1b9a2a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b9a2a8*, lpNumberOfBytesRead=0x2ae560*=0xdf9, lpOverlapped=0x0) returned 1 [0082.724] CloseHandle (hObject=0x154) returned 1 [0082.761] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", lpFilePart=0x0) returned 0x4d [0082.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.762] GetFileType (hFile=0x154) returned 0x1 [0082.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.762] GetFileType (hFile=0x154) returned 0x1 [0082.762] WriteFile (in: hFile=0x154, lpBuffer=0x19ec6d0*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19ec6d0*, lpNumberOfBytesWritten=0x2ae528*=0xe00, lpOverlapped=0x0) returned 1 [0082.763] CloseHandle (hObject=0x154) returned 1 [0082.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", lpFilePart=0x0) returned 0x4d [0082.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.anonymous", lpFilePart=0x0) returned 0x57 [0082.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.764] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb34b3f00, ftCreationTime.dwHighDateTime=0x1cac247, ftLastAccessTime.dwLowDateTime=0x883e5670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd043dd30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.anonymous")) returned 1 [0082.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0082.765] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA", lpFilePart=0x0) returned 0x27 [0082.765] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\", lpFilePart=0x0) returned 0x28 [0082.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0082.765] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0082.765] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0082.765] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0082.765] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0082.765] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0082.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0082.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0082.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0082.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA", lpFilePart=0x0) returned 0x27 [0082.766] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\", lpFilePart=0x0) returned 0x28 [0082.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0082.766] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0082.766] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0082.766] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0082.766] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0082.766] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0082.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0082.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0082.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0082.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10", lpFilePart=0x0) returned 0x30 [0082.766] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpFilePart=0x0) returned 0x31 [0082.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0082.769] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.769] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.770] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.771] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.772] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.773] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.773] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.773] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.773] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.773] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.773] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.774] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.775] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.776] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.777] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.778] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.779] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.782] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.783] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.784] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0082.784] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0082.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0082.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0082.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0082.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10", lpFilePart=0x0) returned 0x30 [0082.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpFilePart=0x0) returned 0x31 [0082.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0082.786] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.786] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.786] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.786] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.786] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.787] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.788] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.789] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.790] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0082.791] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0082.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0082.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0082.792] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", lpFilePart=0x0) returned 0x3d [0082.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.808] GetFileType (hFile=0x154) returned 0x1 [0082.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.809] GetFileType (hFile=0x154) returned 0x1 [0082.809] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x62e3 [0082.843] CloseHandle (hObject=0x154) returned 1 [0082.855] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", lpFilePart=0x0) returned 0x3d [0082.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.857] GetFileType (hFile=0x154) returned 0x1 [0082.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.857] GetFileType (hFile=0x154) returned 0x1 [0082.857] WriteFile (in: hFile=0x154, lpBuffer=0x1a72844*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a72844*, lpNumberOfBytesWritten=0x2ae554*=0x62f0, lpOverlapped=0x0) returned 1 [0082.859] CloseHandle (hObject=0x154) returned 1 [0082.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", lpFilePart=0x0) returned 0x3d [0082.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.anonymous", lpFilePart=0x0) returned 0x47 [0082.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.859] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ce31400, ftCreationTime.dwHighDateTime=0x1bea231, ftLastAccessTime.dwLowDateTime=0xbe203b70, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xd05486d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x62f0)) returned 1 [0082.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.anonymous")) returned 1 [0082.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", lpFilePart=0x0) returned 0x3d [0082.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.860] GetFileType (hFile=0x154) returned 0x1 [0082.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.860] GetFileType (hFile=0x154) returned 0x1 [0082.860] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5a2b [0082.884] CloseHandle (hObject=0x154) returned 1 [0082.896] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", lpFilePart=0x0) returned 0x3d [0082.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.898] GetFileType (hFile=0x154) returned 0x1 [0082.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.898] GetFileType (hFile=0x154) returned 0x1 [0082.898] WriteFile (in: hFile=0x154, lpBuffer=0x1ae23b0*, nNumberOfBytesToWrite=0x5a30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ae23b0*, lpNumberOfBytesWritten=0x2ae554*=0x5a30, lpOverlapped=0x0) returned 1 [0082.899] CloseHandle (hObject=0x154) returned 1 [0082.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", lpFilePart=0x0) returned 0x3d [0082.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.anonymous", lpFilePart=0x0) returned 0x47 [0082.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x640a1d00, ftCreationTime.dwHighDateTime=0x1bf4b04, ftLastAccessTime.dwLowDateTime=0xbe2e83b0, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xd0594990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5a30)) returned 1 [0082.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.anonymous")) returned 1 [0082.900] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", lpFilePart=0x0) returned 0x3d [0082.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.900] GetFileType (hFile=0x154) returned 0x1 [0082.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.900] GetFileType (hFile=0x154) returned 0x1 [0082.900] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x25c1 [0082.907] CloseHandle (hObject=0x154) returned 1 [0082.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", lpFilePart=0x0) returned 0x3d [0082.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.922] GetFileType (hFile=0x154) returned 0x1 [0082.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.923] GetFileType (hFile=0x154) returned 0x1 [0082.923] WriteFile (in: hFile=0x154, lpBuffer=0x1b40cd4*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b40cd4*, lpNumberOfBytesWritten=0x2ae554*=0x25d0, lpOverlapped=0x0) returned 1 [0082.925] CloseHandle (hObject=0x154) returned 1 [0082.925] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", lpFilePart=0x0) returned 0x3d [0082.925] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.anonymous", lpFilePart=0x0) returned 0x47 [0082.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.925] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8db7b00, ftCreationTime.dwHighDateTime=0x1bf4bc9, ftLastAccessTime.dwLowDateTime=0xbe2e83b0, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xd05e0c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25d0)) returned 1 [0082.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.anonymous")) returned 1 [0082.926] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", lpFilePart=0x0) returned 0x3d [0082.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0082.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.926] GetFileType (hFile=0x154) returned 0x1 [0082.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0082.927] GetFileType (hFile=0x154) returned 0x1 [0082.927] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x60e4 [0082.937] CloseHandle (hObject=0x154) returned 1 [0082.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", lpFilePart=0x0) returned 0x3d [0082.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0082.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0082.954] GetFileType (hFile=0x154) returned 0x1 [0082.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0082.954] GetFileType (hFile=0x154) returned 0x1 [0082.954] WriteFile (in: hFile=0x154, lpBuffer=0x19c1788*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c1788*, lpNumberOfBytesWritten=0x2ae554*=0x60f0, lpOverlapped=0x0) returned 1 [0082.955] CloseHandle (hObject=0x154) returned 1 [0082.955] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", lpFilePart=0x0) returned 0x3d [0082.955] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.anonymous", lpFilePart=0x0) returned 0x47 [0082.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0082.955] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d8e6100, ftCreationTime.dwHighDateTime=0x1bf722b, ftLastAccessTime.dwLowDateTime=0xbe2e83b0, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xd062cf10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60f0)) returned 1 [0082.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.anonymous")) returned 1 [0082.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.956] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033", lpFilePart=0x0) returned 0x35 [0082.956] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", lpFilePart=0x0) returned 0x36 [0082.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.956] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.956] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033", lpFilePart=0x0) returned 0x35 [0082.957] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", lpFilePart=0x0) returned 0x36 [0082.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.957] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0082.957] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14", lpFilePart=0x0) returned 0x30 [0082.957] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpFilePart=0x0) returned 0x31 [0082.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0082.958] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0082.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14", lpFilePart=0x0) returned 0x30 [0082.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpFilePart=0x0) returned 0x31 [0082.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0082.958] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033", lpFilePart=0x0) returned 0x35 [0082.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpFilePart=0x0) returned 0x36 [0082.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.959] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033", lpFilePart=0x0) returned 0x35 [0082.959] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpFilePart=0x0) returned 0x36 [0082.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.959] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP", lpFilePart=0x0) returned 0x39 [0082.959] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpFilePart=0x0) returned 0x3a [0082.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.975] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP", lpFilePart=0x0) returned 0x39 [0082.977] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpFilePart=0x0) returned 0x3a [0082.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.980] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.983] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS", lpFilePart=0x0) returned 0x38 [0082.983] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpFilePart=0x0) returned 0x39 [0082.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.990] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.993] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS", lpFilePart=0x0) returned 0x38 [0082.993] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpFilePart=0x0) returned 0x39 [0082.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0082.996] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0082.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0082.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0082.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0082.998] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES", lpFilePart=0x0) returned 0x36 [0082.998] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpFilePart=0x0) returned 0x37 [0082.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0083.057] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0083.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES", lpFilePart=0x0) returned 0x36 [0083.060] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpFilePart=0x0) returned 0x37 [0083.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0083.063] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0083.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0083.065] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14", lpFilePart=0x0) returned 0x2a [0083.065] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\", lpFilePart=0x0) returned 0x2b [0083.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0083.075] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0083.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0083.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0083.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0083.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14", lpFilePart=0x0) returned 0x2a [0083.076] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\", lpFilePart=0x0) returned 0x2b [0083.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0083.078] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0083.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0083.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0083.078] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpFilePart=0x0) returned 0x45 [0083.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.079] GetFileType (hFile=0x154) returned 0x1 [0083.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.079] GetFileType (hFile=0x154) returned 0x1 [0083.079] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x5a768 [0083.081] ReadFile (in: hFile=0x154, lpBuffer=0x1163df58, nNumberOfBytesToRead=0x5a768, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1163df58*, lpNumberOfBytesRead=0x2ae5d4*=0x5a768, lpOverlapped=0x0) returned 1 [0083.126] CloseHandle (hObject=0x154) returned 1 [0083.202] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpFilePart=0x0) returned 0x45 [0083.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.210] GetFileType (hFile=0x154) returned 0x1 [0083.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.210] GetFileType (hFile=0x154) returned 0x1 [0083.210] WriteFile (in: hFile=0x154, lpBuffer=0x1493fa38*, nNumberOfBytesToWrite=0x5a770, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1493fa38*, lpNumberOfBytesWritten=0x2ae5c8*=0x5a770, lpOverlapped=0x0) returned 1 [0083.222] CloseHandle (hObject=0x154) returned 1 [0083.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", lpFilePart=0x0) returned 0x45 [0083.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.anonymous", lpFilePart=0x0) returned 0x4f [0083.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.222] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf54100, ftCreationTime.dwHighDateTime=0x1ca2511, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd08b4670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5a770)) returned 1 [0083.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.anonymous")) returned 1 [0083.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpFilePart=0x0) returned 0x5c [0083.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.225] GetFileType (hFile=0x154) returned 0x1 [0083.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.225] GetFileType (hFile=0x154) returned 0x1 [0083.225] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x295c [0083.225] ReadFile (in: hFile=0x154, lpBuffer=0x1aa8f58, nNumberOfBytesToRead=0x295c, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1aa8f58*, lpNumberOfBytesRead=0x2ae5d4*=0x295c, lpOverlapped=0x0) returned 1 [0083.243] CloseHandle (hObject=0x154) returned 1 [0083.256] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpFilePart=0x0) returned 0x5c [0083.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.257] GetFileType (hFile=0x154) returned 0x1 [0083.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.257] GetFileType (hFile=0x154) returned 0x1 [0083.257] WriteFile (in: hFile=0x154, lpBuffer=0x1b02c20*, nNumberOfBytesToWrite=0x2960, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b02c20*, lpNumberOfBytesWritten=0x2ae5c8*=0x2960, lpOverlapped=0x0) returned 1 [0083.258] CloseHandle (hObject=0x154) returned 1 [0083.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", lpFilePart=0x0) returned 0x5c [0083.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.anonymous", lpFilePart=0x0) returned 0x66 [0083.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3ba1200, ftCreationTime.dwHighDateTime=0x1ca2512, ftLastAccessTime.dwLowDateTime=0x8be37170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0900930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2960)) returned 1 [0083.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.anonymous")) returned 1 [0083.259] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpFilePart=0x0) returned 0x5e [0083.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.259] GetFileType (hFile=0x154) returned 0x1 [0083.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.260] GetFileType (hFile=0x154) returned 0x1 [0083.260] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xb2 [0083.260] ReadFile (in: hFile=0x154, lpBuffer=0x1b05c28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b05c28*, lpNumberOfBytesRead=0x2ae5d4*=0xb2, lpOverlapped=0x0) returned 1 [0083.261] CloseHandle (hObject=0x154) returned 1 [0083.272] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpFilePart=0x0) returned 0x5e [0083.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.273] GetFileType (hFile=0x154) returned 0x1 [0083.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.273] GetFileType (hFile=0x154) returned 0x1 [0083.273] WriteFile (in: hFile=0x154, lpBuffer=0x1b53e6c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1b53e6c*, lpNumberOfBytesWritten=0x2ae59c*=0xc0, lpOverlapped=0x0) returned 1 [0083.274] CloseHandle (hObject=0x154) returned 1 [0083.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpFilePart=0x0) returned 0x5e [0083.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.anonymous", lpFilePart=0x0) returned 0x68 [0083.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.275] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68711f00, ftCreationTime.dwHighDateTime=0x1ca25b6, ftLastAccessTime.dwLowDateTime=0x7d2b50d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0926a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0083.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.anonymous")) returned 1 [0083.276] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpFilePart=0x0) returned 0x4c [0083.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.276] GetFileType (hFile=0x154) returned 0x1 [0083.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.276] GetFileType (hFile=0x154) returned 0x1 [0083.276] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x33737 [0083.277] ReadFile (in: hFile=0x154, lpBuffer=0x1499a1c8, nNumberOfBytesToRead=0x33737, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1499a1c8*, lpNumberOfBytesRead=0x2ae5d4*=0x33737, lpOverlapped=0x0) returned 1 [0083.296] CloseHandle (hObject=0x154) returned 1 [0083.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpFilePart=0x0) returned 0x4c [0083.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.325] GetFileType (hFile=0x154) returned 0x1 [0083.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.325] GetFileType (hFile=0x154) returned 0x1 [0083.325] WriteFile (in: hFile=0x154, lpBuffer=0x14a9b640*, nNumberOfBytesToWrite=0x33740, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x14a9b640*, lpNumberOfBytesWritten=0x2ae5c8*=0x33740, lpOverlapped=0x0) returned 1 [0083.329] CloseHandle (hObject=0x154) returned 1 [0083.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", lpFilePart=0x0) returned 0x4c [0083.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.anonymous", lpFilePart=0x0) returned 0x56 [0083.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.329] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3ba1200, ftCreationTime.dwHighDateTime=0x1ca2512, ftLastAccessTime.dwLowDateTime=0x8d11c010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd09bf010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x33740)) returned 1 [0083.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.anonymous")) returned 1 [0083.330] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpFilePart=0x0) returned 0x5a [0083.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.330] GetFileType (hFile=0x154) returned 0x1 [0083.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.330] GetFileType (hFile=0x154) returned 0x1 [0083.330] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xc5265 [0083.333] ReadFile (in: hFile=0x154, lpBuffer=0x14aceda0, nNumberOfBytesToRead=0xc5265, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x14aceda0*, lpNumberOfBytesRead=0x2ae5d4*=0xc5265, lpOverlapped=0x0) returned 1 [0083.366] CloseHandle (hObject=0x154) returned 1 [0083.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpFilePart=0x0) returned 0x5a [0083.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.463] GetFileType (hFile=0x154) returned 0x1 [0083.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.463] GetFileType (hFile=0x154) returned 0x1 [0083.463] WriteFile (in: hFile=0x154, lpBuffer=0x14ea8a08*, nNumberOfBytesToWrite=0xc5270, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x14ea8a08*, lpNumberOfBytesWritten=0x2ae5c8*=0xc5270, lpOverlapped=0x0) returned 1 [0083.479] CloseHandle (hObject=0x154) returned 1 [0083.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpFilePart=0x0) returned 0x5a [0083.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.anonymous", lpFilePart=0x0) returned 0x64 [0083.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.479] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225b3900, ftCreationTime.dwHighDateTime=0x1ca5695, ftLastAccessTime.dwLowDateTime=0x891230d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0b15c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc5270)) returned 1 [0083.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.anonymous")) returned 1 [0083.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpFilePart=0x0) returned 0x54 [0083.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.480] GetFileType (hFile=0x154) returned 0x1 [0083.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.481] GetFileType (hFile=0x154) returned 0x1 [0083.481] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x837d7 [0083.482] ReadFile (in: hFile=0x154, lpBuffer=0x14f6dc98, nNumberOfBytesToRead=0x837d7, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x14f6dc98*, lpNumberOfBytesRead=0x2ae5d4*=0x837d7, lpOverlapped=0x0) returned 1 [0083.510] CloseHandle (hObject=0x154) returned 1 [0083.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpFilePart=0x0) returned 0x54 [0083.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.561] GetFileType (hFile=0x154) returned 0x1 [0083.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.561] GetFileType (hFile=0x154) returned 0x1 [0083.561] WriteFile (in: hFile=0x154, lpBuffer=0x151ff430*, nNumberOfBytesToWrite=0x837e0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x151ff430*, lpNumberOfBytesWritten=0x2ae5c8*=0x837e0, lpOverlapped=0x0) returned 1 [0083.571] CloseHandle (hObject=0x154) returned 1 [0083.571] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", lpFilePart=0x0) returned 0x54 [0083.571] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.anonymous", lpFilePart=0x0) returned 0x5e [0083.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.572] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf813d200, ftCreationTime.dwHighDateTime=0x1c9bc94, ftLastAccessTime.dwLowDateTime=0x7b39d170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0bfa4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x837e0)) returned 1 [0083.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.anonymous")) returned 1 [0083.572] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpFilePart=0x0) returned 0x66 [0083.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.573] GetFileType (hFile=0x154) returned 0x1 [0083.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.573] GetFileType (hFile=0x154) returned 0x1 [0083.573] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x311b0 [0083.574] ReadFile (in: hFile=0x154, lpBuffer=0x15282c30, nNumberOfBytesToRead=0x311b0, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x15282c30*, lpNumberOfBytesRead=0x2ae5d4*=0x311b0, lpOverlapped=0x0) returned 1 [0083.594] CloseHandle (hObject=0x154) returned 1 [0083.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpFilePart=0x0) returned 0x66 [0083.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.635] GetFileType (hFile=0x154) returned 0x1 [0083.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.635] GetFileType (hFile=0x154) returned 0x1 [0083.635] WriteFile (in: hFile=0x154, lpBuffer=0x15378520*, nNumberOfBytesToWrite=0x311c0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x15378520*, lpNumberOfBytesWritten=0x2ae5c8*=0x311c0, lpOverlapped=0x0) returned 1 [0083.641] CloseHandle (hObject=0x154) returned 1 [0083.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpFilePart=0x0) returned 0x66 [0083.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.anonymous", lpFilePart=0x0) returned 0x70 [0083.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.642] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3ba1200, ftCreationTime.dwHighDateTime=0x1ca2512, ftLastAccessTime.dwLowDateTime=0x8be37170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0cb8b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x311c0)) returned 1 [0083.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.anonymous")) returned 1 [0083.643] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", lpFilePart=0x0) returned 0x42 [0083.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.644] GetFileType (hFile=0x154) returned 0x1 [0083.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.644] GetFileType (hFile=0x154) returned 0x1 [0083.644] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x67 [0083.644] ReadFile (in: hFile=0x154, lpBuffer=0x1a81ef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a81ef0*, lpNumberOfBytesRead=0x2ae5d4*=0x67, lpOverlapped=0x0) returned 1 [0083.647] CloseHandle (hObject=0x154) returned 1 [0083.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", lpFilePart=0x0) returned 0x42 [0083.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.667] GetFileType (hFile=0x154) returned 0x1 [0083.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.667] GetFileType (hFile=0x154) returned 0x1 [0083.667] WriteFile (in: hFile=0x154, lpBuffer=0x1ad0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ad0020*, lpNumberOfBytesWritten=0x2ae59c*=0x70, lpOverlapped=0x0) returned 1 [0083.668] CloseHandle (hObject=0x154) returned 1 [0083.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", lpFilePart=0x0) returned 0x42 [0083.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.anonymous", lpFilePart=0x0) returned 0x4c [0083.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.669] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7eef00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90507ff0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0d04e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0083.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml.anonymous")) returned 1 [0083.670] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", lpFilePart=0x0) returned 0x3b [0083.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0083.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.671] GetFileType (hFile=0x154) returned 0x1 [0083.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0083.671] GetFileType (hFile=0x154) returned 0x1 [0083.671] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x173e8 [0083.672] ReadFile (in: hFile=0x154, lpBuffer=0x116986e0, nNumberOfBytesToRead=0x173e8, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x116986e0*, lpNumberOfBytesRead=0x2ae5d4*=0x173e8, lpOverlapped=0x0) returned 1 [0083.685] CloseHandle (hObject=0x154) returned 1 [0083.712] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", lpFilePart=0x0) returned 0x3b [0083.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0083.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.714] GetFileType (hFile=0x154) returned 0x1 [0083.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0083.714] GetFileType (hFile=0x154) returned 0x1 [0083.714] WriteFile (in: hFile=0x154, lpBuffer=0x154066e0*, nNumberOfBytesToWrite=0x173f0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x154066e0*, lpNumberOfBytesWritten=0x2ae5c8*=0x173f0, lpOverlapped=0x0) returned 1 [0083.716] CloseHandle (hObject=0x154) returned 1 [0083.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", lpFilePart=0x0) returned 0x3b [0083.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.anonymous", lpFilePart=0x0) returned 0x45 [0083.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0083.717] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4dc200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9065ec50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0d77270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x173f0)) returned 1 [0083.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.anonymous")) returned 1 [0083.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0083.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033", lpFilePart=0x0) returned 0x2f [0083.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpFilePart=0x0) returned 0x30 [0083.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee18 [0083.718] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.719] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.719] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.719] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.720] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.721] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.722] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.724] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.725] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.726] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.727] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.727] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.727] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.727] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.727] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.728] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.728] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.729] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.730] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.731] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.734] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.735] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.736] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.737] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.737] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.737] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.737] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.737] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.737] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.739] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.740] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.777] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.778] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.780] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.780] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.780] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.780] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.781] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.782] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0083.824] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0083.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0083.824] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033", lpFilePart=0x0) returned 0x2f [0083.824] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpFilePart=0x0) returned 0x30 [0083.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee18 [0083.825] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0083.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0083.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography", lpFilePart=0x0) returned 0x3c [0083.826] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", lpFilePart=0x0) returned 0x3d [0083.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee18 [0083.826] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography", lpFilePart=0x0) returned 0x3c [0083.827] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", lpFilePart=0x0) returned 0x3d [0083.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee18 [0083.827] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices", lpFilePart=0x0) returned 0x3c [0083.827] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpFilePart=0x0) returned 0x3d [0083.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee18 [0083.840] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.841] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices", lpFilePart=0x0) returned 0x3c [0083.841] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpFilePart=0x0) returned 0x3d [0083.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee18 [0083.842] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.843] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5", lpFilePart=0x0) returned 0x3c [0083.843] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpFilePart=0x0) returned 0x3d [0083.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee18 [0083.849] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0083.850] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5", lpFilePart=0x0) returned 0x3c [0083.850] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpFilePart=0x0) returned 0x3d [0083.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee18 [0083.851] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0083.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0083.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0083.852] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", lpFilePart=0x0) returned 0x4a [0083.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0083.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.868] GetFileType (hFile=0x154) returned 0x1 [0083.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0083.868] GetFileType (hFile=0x154) returned 0x1 [0083.868] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x161d [0083.883] CloseHandle (hObject=0x154) returned 1 [0083.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", lpFilePart=0x0) returned 0x4a [0083.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0083.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.922] GetFileType (hFile=0x154) returned 0x1 [0083.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0083.922] GetFileType (hFile=0x154) returned 0x1 [0083.922] WriteFile (in: hFile=0x154, lpBuffer=0x19d0614*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19d0614*, lpNumberOfBytesWritten=0x2ae4e0*=0x1620, lpOverlapped=0x0) returned 1 [0083.924] CloseHandle (hObject=0x154) returned 1 [0083.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", lpFilePart=0x0) returned 0x4a [0083.924] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.anonymous", lpFilePart=0x0) returned 0x54 [0083.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0083.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6c1f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0f66450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1620)) returned 1 [0083.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0083.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.anonymous")) returned 1 [0083.925] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", lpFilePart=0x0) returned 0x4b [0083.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0083.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.925] GetFileType (hFile=0x154) returned 0x1 [0083.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0083.925] GetFileType (hFile=0x154) returned 0x1 [0083.925] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x7dd3 [0083.925] ReadFile (in: hFile=0x154, lpBuffer=0x19d20bc, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19d20bc*, lpNumberOfBytesRead=0x2ae4ec*=0x7dd3, lpOverlapped=0x0) returned 1 [0083.938] CloseHandle (hObject=0x154) returned 1 [0083.950] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", lpFilePart=0x0) returned 0x4b [0083.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0083.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.952] GetFileType (hFile=0x154) returned 0x1 [0083.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0083.952] GetFileType (hFile=0x154) returned 0x1 [0083.952] WriteFile (in: hFile=0x154, lpBuffer=0x1a46564*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a46564*, lpNumberOfBytesWritten=0x2ae4e0*=0x7de0, lpOverlapped=0x0) returned 1 [0083.953] CloseHandle (hObject=0x154) returned 1 [0083.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", lpFilePart=0x0) returned 0x4b [0083.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.anonymous", lpFilePart=0x0) returned 0x55 [0083.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0083.954] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd0fb2710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7de0)) returned 1 [0083.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0083.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.anonymous")) returned 1 [0083.954] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", lpFilePart=0x0) returned 0x4a [0083.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0083.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0083.954] GetFileType (hFile=0x154) returned 0x1 [0083.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0083.954] GetFileType (hFile=0x154) returned 0x1 [0083.955] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x132a [0083.955] ReadFile (in: hFile=0x154, lpBuffer=0x1a4e7cc, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a4e7cc*, lpNumberOfBytesRead=0x2ae4ec*=0x132a, lpOverlapped=0x0) returned 1 [0084.014] CloseHandle (hObject=0x154) returned 1 [0084.025] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", lpFilePart=0x0) returned 0x4a [0084.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.027] GetFileType (hFile=0x154) returned 0x1 [0084.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.027] GetFileType (hFile=0x154) returned 0x1 [0084.027] WriteFile (in: hFile=0x154, lpBuffer=0x1aa15a8*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1aa15a8*, lpNumberOfBytesWritten=0x2ae4e0*=0x1330, lpOverlapped=0x0) returned 1 [0084.028] CloseHandle (hObject=0x154) returned 1 [0084.028] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", lpFilePart=0x0) returned 0x4a [0084.028] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.anonymous", lpFilePart=0x0) returned 0x54 [0084.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.028] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1070df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1330)) returned 1 [0084.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.anonymous")) returned 1 [0084.029] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x4c [0084.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.030] GetFileType (hFile=0x154) returned 0x1 [0084.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.030] GetFileType (hFile=0x154) returned 0x1 [0084.030] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5690 [0084.030] ReadFile (in: hFile=0x154, lpBuffer=0x1aa2d64, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aa2d64*, lpNumberOfBytesRead=0x2ae4ec*=0x5690, lpOverlapped=0x0) returned 1 [0084.048] CloseHandle (hObject=0x154) returned 1 [0084.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x4c [0084.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.061] GetFileType (hFile=0x154) returned 0x1 [0084.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.062] GetFileType (hFile=0x154) returned 0x1 [0084.062] WriteFile (in: hFile=0x154, lpBuffer=0x1b0ac6c*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b0ac6c*, lpNumberOfBytesWritten=0x2ae4e0*=0x56a0, lpOverlapped=0x0) returned 1 [0084.063] CloseHandle (hObject=0x154) returned 1 [0084.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x4c [0084.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.anonymous", lpFilePart=0x0) returned 0x56 [0084.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.063] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd10bd0b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x56a0)) returned 1 [0084.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.anonymous")) returned 1 [0084.064] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", lpFilePart=0x0) returned 0x4a [0084.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.064] GetFileType (hFile=0x154) returned 0x1 [0084.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.064] GetFileType (hFile=0x154) returned 0x1 [0084.064] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6a [0084.064] ReadFile (in: hFile=0x154, lpBuffer=0x1b1081c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b1081c*, lpNumberOfBytesRead=0x2ae4ec*=0x6a, lpOverlapped=0x0) returned 1 [0084.065] CloseHandle (hObject=0x154) returned 1 [0084.078] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", lpFilePart=0x0) returned 0x4a [0084.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.079] GetFileType (hFile=0x154) returned 0x1 [0084.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.079] GetFileType (hFile=0x154) returned 0x1 [0084.080] WriteFile (in: hFile=0x154, lpBuffer=0x1b5e944*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b5e944*, lpNumberOfBytesWritten=0x2ae4b4*=0x70, lpOverlapped=0x0) returned 1 [0084.081] CloseHandle (hObject=0x154) returned 1 [0084.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", lpFilePart=0x0) returned 0x4a [0084.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.anonymous", lpFilePart=0x0) returned 0x54 [0084.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.081] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd10e3210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0084.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.anonymous")) returned 1 [0084.084] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x4f [0084.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.084] GetFileType (hFile=0x154) returned 0x1 [0084.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.084] GetFileType (hFile=0x154) returned 0x1 [0084.084] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x21a6 [0084.084] ReadFile (in: hFile=0x154, lpBuffer=0x1b5fcb4, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b5fcb4*, lpNumberOfBytesRead=0x2ae4ec*=0x21a6, lpOverlapped=0x0) returned 1 [0084.098] CloseHandle (hObject=0x154) returned 1 [0084.110] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x4f [0084.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.112] GetFileType (hFile=0x154) returned 0x1 [0084.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.112] GetFileType (hFile=0x154) returned 0x1 [0084.112] WriteFile (in: hFile=0x154, lpBuffer=0x1bb7310*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1bb7310*, lpNumberOfBytesWritten=0x2ae4e0*=0x21b0, lpOverlapped=0x0) returned 1 [0084.113] CloseHandle (hObject=0x154) returned 1 [0084.113] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x4f [0084.113] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.anonymous", lpFilePart=0x0) returned 0x59 [0084.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd112f4d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21b0)) returned 1 [0084.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.anonymous")) returned 1 [0084.114] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x4e [0084.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.114] GetFileType (hFile=0x154) returned 0x1 [0084.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.114] GetFileType (hFile=0x154) returned 0x1 [0084.114] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3d57 [0084.114] ReadFile (in: hFile=0x154, lpBuffer=0x1bb9980, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1bb9980*, lpNumberOfBytesRead=0x2ae4ec*=0x3d57, lpOverlapped=0x0) returned 1 [0084.135] CloseHandle (hObject=0x154) returned 1 [0084.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x4e [0084.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.194] GetFileType (hFile=0x154) returned 0x1 [0084.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.194] GetFileType (hFile=0x154) returned 0x1 [0084.194] WriteFile (in: hFile=0x154, lpBuffer=0x1a1c15c*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a1c15c*, lpNumberOfBytesWritten=0x2ae4e0*=0x3d60, lpOverlapped=0x0) returned 1 [0084.196] CloseHandle (hObject=0x154) returned 1 [0084.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x4e [0084.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.anonymous", lpFilePart=0x0) returned 0x58 [0084.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd11edbb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d60)) returned 1 [0084.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.anonymous")) returned 1 [0084.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", lpFilePart=0x0) returned 0x4b [0084.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.197] GetFileType (hFile=0x154) returned 0x1 [0084.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.197] GetFileType (hFile=0x154) returned 0x1 [0084.197] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1845 [0084.198] ReadFile (in: hFile=0x154, lpBuffer=0x1a2036c, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a2036c*, lpNumberOfBytesRead=0x2ae4ec*=0x1845, lpOverlapped=0x0) returned 1 [0084.210] CloseHandle (hObject=0x154) returned 1 [0084.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", lpFilePart=0x0) returned 0x4b [0084.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.225] GetFileType (hFile=0x154) returned 0x1 [0084.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.225] GetFileType (hFile=0x154) returned 0x1 [0084.225] WriteFile (in: hFile=0x154, lpBuffer=0x1a74c44*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a74c44*, lpNumberOfBytesWritten=0x2ae4e0*=0x1850, lpOverlapped=0x0) returned 1 [0084.228] CloseHandle (hObject=0x154) returned 1 [0084.229] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", lpFilePart=0x0) returned 0x4b [0084.229] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.anonymous", lpFilePart=0x0) returned 0x55 [0084.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.229] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1239e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1850)) returned 1 [0084.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.anonymous")) returned 1 [0084.229] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x4d [0084.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.230] GetFileType (hFile=0x154) returned 0x1 [0084.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.230] GetFileType (hFile=0x154) returned 0x1 [0084.230] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5141 [0084.230] ReadFile (in: hFile=0x154, lpBuffer=0x1a76928, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a76928*, lpNumberOfBytesRead=0x2ae4ec*=0x5141, lpOverlapped=0x0) returned 1 [0084.236] CloseHandle (hObject=0x154) returned 1 [0084.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x4d [0084.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.255] GetFileType (hFile=0x154) returned 0x1 [0084.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.255] GetFileType (hFile=0x154) returned 0x1 [0084.255] WriteFile (in: hFile=0x154, lpBuffer=0x1adcda4*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1adcda4*, lpNumberOfBytesWritten=0x2ae4e0*=0x5150, lpOverlapped=0x0) returned 1 [0084.257] CloseHandle (hObject=0x154) returned 1 [0084.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x4d [0084.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.anonymous", lpFilePart=0x0) returned 0x57 [0084.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f538b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1286130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5150)) returned 1 [0084.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.anonymous")) returned 1 [0084.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x50 [0084.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.258] GetFileType (hFile=0x154) returned 0x1 [0084.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.259] GetFileType (hFile=0x154) returned 0x1 [0084.259] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x193c [0084.259] ReadFile (in: hFile=0x154, lpBuffer=0x1ae23a8, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ae23a8*, lpNumberOfBytesRead=0x2ae4ec*=0x193c, lpOverlapped=0x0) returned 1 [0084.276] CloseHandle (hObject=0x154) returned 1 [0084.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x50 [0084.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.295] GetFileType (hFile=0x154) returned 0x1 [0084.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.295] GetFileType (hFile=0x154) returned 0x1 [0084.295] WriteFile (in: hFile=0x154, lpBuffer=0x1b36fd0*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b36fd0*, lpNumberOfBytesWritten=0x2ae4e0*=0x1940, lpOverlapped=0x0) returned 1 [0084.297] CloseHandle (hObject=0x154) returned 1 [0084.297] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x50 [0084.297] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.anonymous", lpFilePart=0x0) returned 0x5a [0084.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.297] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f79a10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd12f8550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0084.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.anonymous")) returned 1 [0084.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x4e [0084.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0084.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.298] GetFileType (hFile=0x154) returned 0x1 [0084.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0084.298] GetFileType (hFile=0x154) returned 0x1 [0084.298] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3c64 [0084.298] ReadFile (in: hFile=0x154, lpBuffer=0x1b38de0, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b38de0*, lpNumberOfBytesRead=0x2ae4ec*=0x3c64, lpOverlapped=0x0) returned 1 [0084.311] CloseHandle (hObject=0x154) returned 1 [0084.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x4e [0084.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0084.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.330] GetFileType (hFile=0x154) returned 0x1 [0084.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0084.331] GetFileType (hFile=0x154) returned 0x1 [0084.331] WriteFile (in: hFile=0x154, lpBuffer=0x1b989f8*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b989f8*, lpNumberOfBytesWritten=0x2ae4e0*=0x3c70, lpOverlapped=0x0) returned 1 [0084.332] CloseHandle (hObject=0x154) returned 1 [0084.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x4e [0084.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.anonymous", lpFilePart=0x0) returned 0x58 [0084.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0084.332] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9d4c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f79a10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1344810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c70)) returned 1 [0084.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.anonymous")) returned 1 [0084.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0084.333] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles", lpFilePart=0x0) returned 0x48 [0084.333] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpFilePart=0x0) returned 0x49 [0084.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf098 [0084.392] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.443] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.443] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.443] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.444] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.444] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.444] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.444] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.444] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.447] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.447] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.447] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.448] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.448] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.448] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.448] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.448] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.448] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.449] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.449] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.449] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.449] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.449] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.450] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.450] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.450] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.450] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.450] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.450] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.451] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.451] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.451] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.451] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.451] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.451] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.452] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.452] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.452] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.453] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.453] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.453] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.453] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.453] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.454] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.454] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.454] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.454] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.454] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.454] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.455] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0084.456] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0084.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0084.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0084.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles", lpFilePart=0x0) returned 0x48 [0084.457] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpFilePart=0x0) returned 0x49 [0084.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf098 [0084.459] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.459] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.459] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.460] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.460] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.460] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.460] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.460] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.460] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.461] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.461] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.461] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.461] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.461] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.461] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.462] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.462] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.462] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.462] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.462] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.463] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.463] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.463] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.463] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.463] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.463] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.464] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.464] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.464] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.464] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.464] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.465] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.465] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.465] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.465] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.465] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.466] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.467] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.467] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.467] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.467] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.467] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.468] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0084.469] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0084.469] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0084.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0084.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0084.470] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x5b [0084.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0084.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.472] GetFileType (hFile=0x154) returned 0x1 [0084.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0084.473] GetFileType (hFile=0x154) returned 0x1 [0084.473] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x37a [0084.473] ReadFile (in: hFile=0x154, lpBuffer=0x1bab0e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1bab0e4*, lpNumberOfBytesRead=0x2ae478*=0x37a, lpOverlapped=0x0) returned 1 [0084.492] CloseHandle (hObject=0x154) returned 1 [0084.546] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x5b [0084.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0084.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.548] GetFileType (hFile=0x154) returned 0x1 [0084.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0084.548] GetFileType (hFile=0x154) returned 0x1 [0084.548] WriteFile (in: hFile=0x154, lpBuffer=0x19f82f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19f82f8*, lpNumberOfBytesWritten=0x2ae440*=0x380, lpOverlapped=0x0) returned 1 [0084.550] CloseHandle (hObject=0x154) returned 1 [0084.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x5b [0084.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.anonymous", lpFilePart=0x0) returned 0x65 [0084.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0084.550] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe371600, ftCreationTime.dwHighDateTime=0x1ca2bd5, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1559b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0084.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.anonymous")) returned 1 [0084.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", lpFilePart=0x0) returned 0x57 [0084.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0084.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.551] GetFileType (hFile=0x154) returned 0x1 [0084.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0084.551] GetFileType (hFile=0x154) returned 0x1 [0084.551] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x354 [0084.552] ReadFile (in: hFile=0x154, lpBuffer=0x19f9a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19f9a30*, lpNumberOfBytesRead=0x2ae478*=0x354, lpOverlapped=0x0) returned 1 [0084.573] CloseHandle (hObject=0x154) returned 1 [0084.593] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", lpFilePart=0x0) returned 0x57 [0084.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0084.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.595] GetFileType (hFile=0x154) returned 0x1 [0084.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0084.595] GetFileType (hFile=0x154) returned 0x1 [0084.595] WriteFile (in: hFile=0x154, lpBuffer=0x1a48bb0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a48bb0*, lpNumberOfBytesWritten=0x2ae440*=0x360, lpOverlapped=0x0) returned 1 [0084.596] CloseHandle (hObject=0x154) returned 1 [0084.596] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", lpFilePart=0x0) returned 0x57 [0084.597] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.anonymous", lpFilePart=0x0) returned 0x61 [0084.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0084.597] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c45a00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd15cbf70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0084.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.anonymous")) returned 1 [0084.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", lpFilePart=0x0) returned 0x5b [0084.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0084.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.601] GetFileType (hFile=0x154) returned 0x1 [0084.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0084.601] GetFileType (hFile=0x154) returned 0x1 [0084.601] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa0 [0084.601] ReadFile (in: hFile=0x154, lpBuffer=0x1a4a02c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a4a02c*, lpNumberOfBytesRead=0x2ae478*=0xa0, lpOverlapped=0x0) returned 1 [0084.603] CloseHandle (hObject=0x154) returned 1 [0084.620] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", lpFilePart=0x0) returned 0x5b [0084.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0084.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.622] GetFileType (hFile=0x154) returned 0x1 [0084.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0084.622] GetFileType (hFile=0x154) returned 0x1 [0084.622] WriteFile (in: hFile=0x154, lpBuffer=0x1a98208*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a98208*, lpNumberOfBytesWritten=0x2ae440*=0xb0, lpOverlapped=0x0) returned 1 [0084.624] CloseHandle (hObject=0x154) returned 1 [0084.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", lpFilePart=0x0) returned 0x5b [0084.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.anonymous", lpFilePart=0x0) returned 0x65 [0084.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0084.624] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf614c600, ftCreationTime.dwHighDateTime=0x1ca2bd7, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1618230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0084.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.anonymous")) returned 1 [0084.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", lpFilePart=0x0) returned 0x5a [0084.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0084.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.625] GetFileType (hFile=0x154) returned 0x1 [0084.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0084.625] GetFileType (hFile=0x154) returned 0x1 [0084.625] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x35c [0084.626] ReadFile (in: hFile=0x154, lpBuffer=0x1a99954, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a99954*, lpNumberOfBytesRead=0x2ae478*=0x35c, lpOverlapped=0x0) returned 1 [0084.629] CloseHandle (hObject=0x154) returned 1 [0084.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", lpFilePart=0x0) returned 0x5a [0084.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0084.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.650] GetFileType (hFile=0x154) returned 0x1 [0084.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0084.650] GetFileType (hFile=0x154) returned 0x1 [0084.650] WriteFile (in: hFile=0x154, lpBuffer=0x1ae897c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ae897c*, lpNumberOfBytesWritten=0x2ae440*=0x360, lpOverlapped=0x0) returned 1 [0084.654] CloseHandle (hObject=0x154) returned 1 [0084.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", lpFilePart=0x0) returned 0x5a [0084.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.anonymous", lpFilePart=0x0) returned 0x64 [0084.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0084.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c45a00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd16644f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0084.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.anonymous")) returned 1 [0084.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana", lpFilePart=0x0) returned 0x52 [0084.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", lpFilePart=0x0) returned 0x53 [0084.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.657] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.657] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.657] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.657] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana", lpFilePart=0x0) returned 0x52 [0084.657] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", lpFilePart=0x0) returned 0x53 [0084.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.658] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue", lpFilePart=0x0) returned 0x51 [0084.658] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpFilePart=0x0) returned 0x52 [0084.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.660] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue", lpFilePart=0x0) returned 0x51 [0084.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpFilePart=0x0) returned 0x52 [0084.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.662] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.662] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay", lpFilePart=0x0) returned 0x4f [0084.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", lpFilePart=0x0) returned 0x50 [0084.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.663] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay", lpFilePart=0x0) returned 0x4f [0084.664] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", lpFilePart=0x0) returned 0x50 [0084.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.665] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.665] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange", lpFilePart=0x0) returned 0x55 [0084.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpFilePart=0x0) returned 0x56 [0084.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.666] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.666] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.666] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.667] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.667] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.667] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.667] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange", lpFilePart=0x0) returned 0x55 [0084.667] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpFilePart=0x0) returned 0x56 [0084.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee18 [0084.668] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.668] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.668] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.668] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.668] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.669] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.669] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0084.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x64 [0084.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0084.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.669] GetFileType (hFile=0x154) returned 0x1 [0084.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0084.669] GetFileType (hFile=0x154) returned 0x1 [0084.669] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x143 [0084.669] ReadFile (in: hFile=0x154, lpBuffer=0x1af3068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af3068*, lpNumberOfBytesRead=0x2ae404*=0x143, lpOverlapped=0x0) returned 1 [0084.671] CloseHandle (hObject=0x154) returned 1 [0084.710] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x64 [0084.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0084.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.712] GetFileType (hFile=0x154) returned 0x1 [0084.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0084.712] GetFileType (hFile=0x154) returned 0x1 [0084.712] WriteFile (in: hFile=0x154, lpBuffer=0x1b4165c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b4165c*, lpNumberOfBytesWritten=0x2ae3cc*=0x150, lpOverlapped=0x0) returned 1 [0084.714] CloseHandle (hObject=0x154) returned 1 [0084.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x64 [0084.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.anonymous", lpFilePart=0x0) returned 0x6e [0084.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0084.714] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f30d300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45f9fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd16fca70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0084.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0084.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.anonymous")) returned 1 [0084.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow", lpFilePart=0x0) returned 0x55 [0084.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpFilePart=0x0) returned 0x56 [0084.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.718] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.719] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.719] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.719] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.719] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.719] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.722] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow", lpFilePart=0x0) returned 0x55 [0084.722] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpFilePart=0x0) returned 0x56 [0084.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.722] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.723] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.723] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.723] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.723] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.723] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.723] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert", lpFilePart=0x0) returned 0x4f [0084.724] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpFilePart=0x0) returned 0x50 [0084.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.724] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.725] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.725] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.725] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.725] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.725] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.725] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert", lpFilePart=0x0) returned 0x4f [0084.725] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpFilePart=0x0) returned 0x50 [0084.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.726] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.726] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.726] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.726] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.726] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.726] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.726] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck", lpFilePart=0x0) returned 0x52 [0084.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpFilePart=0x0) returned 0x53 [0084.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.727] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.728] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.728] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.728] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.728] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.728] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck", lpFilePart=0x0) returned 0x52 [0084.728] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpFilePart=0x0) returned 0x53 [0084.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.729] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.729] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.729] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.729] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.729] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.729] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime", lpFilePart=0x0) returned 0x4d [0084.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", lpFilePart=0x0) returned 0x4e [0084.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.731] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.731] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.731] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.731] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.731] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.731] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime", lpFilePart=0x0) returned 0x4d [0084.731] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", lpFilePart=0x0) returned 0x4e [0084.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.732] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.732] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.732] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.732] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.732] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.732] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis", lpFilePart=0x0) returned 0x4e [0084.732] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpFilePart=0x0) returned 0x4f [0084.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.733] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.733] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.733] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.734] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.734] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.734] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.734] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis", lpFilePart=0x0) returned 0x4e [0084.734] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpFilePart=0x0) returned 0x4f [0084.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.734] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.734] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.735] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.735] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.735] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.735] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate", lpFilePart=0x0) returned 0x4e [0084.735] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", lpFilePart=0x0) returned 0x4f [0084.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.736] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.736] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.736] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.736] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.737] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.737] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate", lpFilePart=0x0) returned 0x4e [0084.737] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", lpFilePart=0x0) returned 0x4f [0084.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.737] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.737] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.737] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.737] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.738] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue", lpFilePart=0x0) returned 0x51 [0084.738] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpFilePart=0x0) returned 0x52 [0084.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.739] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.739] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.739] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.739] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.739] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.739] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.739] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue", lpFilePart=0x0) returned 0x51 [0084.740] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpFilePart=0x0) returned 0x52 [0084.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0084.740] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.740] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.740] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.740] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.740] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.740] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0084.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.740] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x60 [0084.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0084.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.741] GetFileType (hFile=0x154) returned 0x1 [0084.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0084.741] GetFileType (hFile=0x154) returned 0x1 [0084.741] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1afa [0084.741] ReadFile (in: hFile=0x154, lpBuffer=0x1b51bd4, nNumberOfBytesToRead=0x1afa, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b51bd4*, lpNumberOfBytesRead=0x2ae404*=0x1afa, lpOverlapped=0x0) returned 1 [0084.756] CloseHandle (hObject=0x154) returned 1 [0084.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x60 [0084.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0084.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.776] GetFileType (hFile=0x154) returned 0x1 [0084.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0084.776] GetFileType (hFile=0x154) returned 0x1 [0084.776] WriteFile (in: hFile=0x154, lpBuffer=0x1ba70c0*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ba70c0*, lpNumberOfBytesWritten=0x2ae3f8*=0x1b00, lpOverlapped=0x0) returned 1 [0084.777] CloseHandle (hObject=0x154) returned 1 [0084.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x60 [0084.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.anonymous", lpFilePart=0x0) returned 0x6a [0084.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0084.777] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c45a00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45fc5cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1794ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b00)) returned 1 [0084.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0084.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.anonymous")) returned 1 [0084.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions", lpFilePart=0x0) returned 0x52 [0084.778] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpFilePart=0x0) returned 0x53 [0084.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0084.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.803] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.803] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.803] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.803] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0084.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0084.804] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions", lpFilePart=0x0) returned 0x52 [0084.804] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpFilePart=0x0) returned 0x53 [0084.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0084.805] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.805] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.805] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.805] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.805] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.806] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.806] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.806] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0084.806] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0084.806] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0084.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0084.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0084.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", lpFilePart=0x0) returned 0x5c [0084.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0084.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.809] GetFileType (hFile=0x154) returned 0x1 [0084.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0084.809] GetFileType (hFile=0x154) returned 0x1 [0084.809] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe5 [0084.809] ReadFile (in: hFile=0x154, lpBuffer=0x1bac580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1bac580*, lpNumberOfBytesRead=0x2ae404*=0xe5, lpOverlapped=0x0) returned 1 [0084.811] CloseHandle (hObject=0x154) returned 1 [0084.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", lpFilePart=0x0) returned 0x5c [0084.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0084.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.864] GetFileType (hFile=0x154) returned 0x1 [0084.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0084.864] GetFileType (hFile=0x154) returned 0x1 [0084.864] WriteFile (in: hFile=0x154, lpBuffer=0x19fabc4*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19fabc4*, lpNumberOfBytesWritten=0x2ae3cc*=0xf0, lpOverlapped=0x0) returned 1 [0084.865] CloseHandle (hObject=0x154) returned 1 [0084.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", lpFilePart=0x0) returned 0x5c [0084.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.anonymous", lpFilePart=0x0) returned 0x66 [0084.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0084.866] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd18536d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0084.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0084.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.anonymous")) returned 1 [0084.867] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", lpFilePart=0x0) returned 0x5f [0084.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0084.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.867] GetFileType (hFile=0x154) returned 0x1 [0084.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0084.867] GetFileType (hFile=0x154) returned 0x1 [0084.867] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x931 [0084.867] ReadFile (in: hFile=0x154, lpBuffer=0x19fc8f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fc8f4*, lpNumberOfBytesRead=0x2ae404*=0x931, lpOverlapped=0x0) returned 1 [0084.930] CloseHandle (hObject=0x154) returned 1 [0084.948] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", lpFilePart=0x0) returned 0x5f [0084.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0084.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.950] GetFileType (hFile=0x154) returned 0x1 [0084.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0084.950] GetFileType (hFile=0x154) returned 0x1 [0084.950] WriteFile (in: hFile=0x154, lpBuffer=0x1a4d7e4*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a4d7e4*, lpNumberOfBytesWritten=0x2ae3cc*=0x940, lpOverlapped=0x0) returned 1 [0084.951] CloseHandle (hObject=0x154) returned 1 [0084.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", lpFilePart=0x0) returned 0x5f [0084.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.anonymous", lpFilePart=0x0) returned 0x69 [0084.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0084.952] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1937f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x940)) returned 1 [0084.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0084.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.anonymous")) returned 1 [0084.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", lpFilePart=0x0) returned 0x5e [0084.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0084.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0084.954] GetFileType (hFile=0x154) returned 0x1 [0084.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0084.954] GetFileType (hFile=0x154) returned 0x1 [0084.954] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x832 [0084.954] ReadFile (in: hFile=0x154, lpBuffer=0x1a4f41c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a4f41c*, lpNumberOfBytesRead=0x2ae404*=0x832, lpOverlapped=0x0) returned 1 [0084.995] CloseHandle (hObject=0x154) returned 1 [0085.007] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", lpFilePart=0x0) returned 0x5e [0085.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.009] GetFileType (hFile=0x154) returned 0x1 [0085.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.009] GetFileType (hFile=0x154) returned 0x1 [0085.009] WriteFile (in: hFile=0x154, lpBuffer=0x1a9fcac*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a9fcac*, lpNumberOfBytesWritten=0x2ae3cc*=0x840, lpOverlapped=0x0) returned 1 [0085.011] CloseHandle (hObject=0x154) returned 1 [0085.011] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", lpFilePart=0x0) returned 0x5e [0085.011] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.anonymous", lpFilePart=0x0) returned 0x68 [0085.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd19d0490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0085.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.anonymous")) returned 1 [0085.013] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", lpFilePart=0x0) returned 0x5f [0085.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0085.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.014] GetFileType (hFile=0x154) returned 0x1 [0085.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0085.014] GetFileType (hFile=0x154) returned 0x1 [0085.014] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe2 [0085.014] ReadFile (in: hFile=0x154, lpBuffer=0x1aa1198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa1198*, lpNumberOfBytesRead=0x2ae404*=0xe2, lpOverlapped=0x0) returned 1 [0085.015] CloseHandle (hObject=0x154) returned 1 [0085.028] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", lpFilePart=0x0) returned 0x5f [0085.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.030] GetFileType (hFile=0x154) returned 0x1 [0085.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.030] GetFileType (hFile=0x154) returned 0x1 [0085.030] WriteFile (in: hFile=0x154, lpBuffer=0x1aef3f0*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aef3f0*, lpNumberOfBytesWritten=0x2ae3cc*=0xf0, lpOverlapped=0x0) returned 1 [0085.031] CloseHandle (hObject=0x154) returned 1 [0085.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", lpFilePart=0x0) returned 0x5f [0085.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.anonymous", lpFilePart=0x0) returned 0x69 [0085.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.031] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd19f65f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0085.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.anonymous")) returned 1 [0085.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", lpFilePart=0x0) returned 0x5b [0085.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0085.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.032] GetFileType (hFile=0x154) returned 0x1 [0085.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0085.032] GetFileType (hFile=0x154) returned 0x1 [0085.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x634 [0085.032] ReadFile (in: hFile=0x154, lpBuffer=0x1af0e1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af0e1c*, lpNumberOfBytesRead=0x2ae404*=0x634, lpOverlapped=0x0) returned 1 [0085.034] CloseHandle (hObject=0x154) returned 1 [0085.047] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", lpFilePart=0x0) returned 0x5b [0085.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.048] GetFileType (hFile=0x154) returned 0x1 [0085.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.048] GetFileType (hFile=0x154) returned 0x1 [0085.048] WriteFile (in: hFile=0x154, lpBuffer=0x1b40c9c*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b40c9c*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0085.050] CloseHandle (hObject=0x154) returned 1 [0085.050] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", lpFilePart=0x0) returned 0x5b [0085.050] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.anonymous", lpFilePart=0x0) returned 0x65 [0085.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460d0670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1a1c750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0085.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.anonymous")) returned 1 [0085.050] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", lpFilePart=0x0) returned 0x5d [0085.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0085.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.051] GetFileType (hFile=0x154) returned 0x1 [0085.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0085.051] GetFileType (hFile=0x154) returned 0x1 [0085.051] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x96a [0085.051] ReadFile (in: hFile=0x154, lpBuffer=0x1b429f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b429f0*, lpNumberOfBytesRead=0x2ae404*=0x96a, lpOverlapped=0x0) returned 1 [0085.056] CloseHandle (hObject=0x154) returned 1 [0085.070] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", lpFilePart=0x0) returned 0x5d [0085.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.073] GetFileType (hFile=0x154) returned 0x1 [0085.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.073] GetFileType (hFile=0x154) returned 0x1 [0085.073] WriteFile (in: hFile=0x154, lpBuffer=0x1b93864*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b93864*, lpNumberOfBytesWritten=0x2ae3cc*=0x970, lpOverlapped=0x0) returned 1 [0085.076] CloseHandle (hObject=0x154) returned 1 [0085.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", lpFilePart=0x0) returned 0x5d [0085.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.anonymous", lpFilePart=0x0) returned 0x67 [0085.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.077] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460f67d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1a68a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0085.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.anonymous")) returned 1 [0085.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", lpFilePart=0x0) returned 0x5f [0085.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0085.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.078] GetFileType (hFile=0x154) returned 0x1 [0085.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0085.078] GetFileType (hFile=0x154) returned 0x1 [0085.078] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x68e [0085.078] ReadFile (in: hFile=0x154, lpBuffer=0x1b952f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b952f0*, lpNumberOfBytesRead=0x2ae404*=0x68e, lpOverlapped=0x0) returned 1 [0085.099] CloseHandle (hObject=0x154) returned 1 [0085.145] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", lpFilePart=0x0) returned 0x5f [0085.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.146] GetFileType (hFile=0x154) returned 0x1 [0085.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.146] GetFileType (hFile=0x154) returned 0x1 [0085.146] WriteFile (in: hFile=0x154, lpBuffer=0x19e58a0*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19e58a0*, lpNumberOfBytesWritten=0x2ae3cc*=0x690, lpOverlapped=0x0) returned 1 [0085.147] CloseHandle (hObject=0x154) returned 1 [0085.147] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", lpFilePart=0x0) returned 0x5f [0085.147] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.anonymous", lpFilePart=0x0) returned 0x69 [0085.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.147] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f58700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x460f67d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1b00f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x690)) returned 1 [0085.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.anonymous")) returned 1 [0085.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen", lpFilePart=0x0) returned 0x54 [0085.148] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpFilePart=0x0) returned 0x55 [0085.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf058 [0085.149] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.149] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.149] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.149] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.149] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0085.149] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0085.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.150] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen", lpFilePart=0x0) returned 0x54 [0085.150] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpFilePart=0x0) returned 0x55 [0085.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf058 [0085.150] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.150] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.150] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.150] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.151] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0085.151] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0085.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2", lpFilePart=0x0) returned 0x4d [0085.151] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpFilePart=0x0) returned 0x4e [0085.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf058 [0085.152] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.152] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.152] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.152] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.152] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.152] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0085.152] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0085.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.152] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2", lpFilePart=0x0) returned 0x4d [0085.152] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpFilePart=0x0) returned 0x4e [0085.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf058 [0085.153] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.153] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.153] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.153] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.153] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.154] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0085.154] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0085.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x5c [0085.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0085.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.154] GetFileType (hFile=0x154) returned 0x1 [0085.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0085.154] GetFileType (hFile=0x154) returned 0x1 [0085.154] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe9 [0085.154] ReadFile (in: hFile=0x154, lpBuffer=0x19eb8b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19eb8b4*, lpNumberOfBytesRead=0x2ae404*=0xe9, lpOverlapped=0x0) returned 1 [0085.156] CloseHandle (hObject=0x154) returned 1 [0085.168] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x5c [0085.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.169] GetFileType (hFile=0x154) returned 0x1 [0085.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.169] GetFileType (hFile=0x154) returned 0x1 [0085.169] WriteFile (in: hFile=0x154, lpBuffer=0x1a39c60*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a39c60*, lpNumberOfBytesWritten=0x2ae3cc*=0xf0, lpOverlapped=0x0) returned 1 [0085.170] CloseHandle (hObject=0x154) returned 1 [0085.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x5c [0085.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.anonymous", lpFilePart=0x0) returned 0x66 [0085.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.170] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6526b400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45febe30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1b4d250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0085.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.anonymous")) returned 1 [0085.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.171] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl", lpFilePart=0x0) returned 0x4e [0085.171] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpFilePart=0x0) returned 0x4f [0085.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0085.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0085.173] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0085.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.173] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl", lpFilePart=0x0) returned 0x4e [0085.173] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpFilePart=0x0) returned 0x4f [0085.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0085.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.174] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0085.174] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0085.174] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0085.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.174] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x5d [0085.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0085.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.174] GetFileType (hFile=0x154) returned 0x1 [0085.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0085.174] GetFileType (hFile=0x154) returned 0x1 [0085.174] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x32f [0085.174] ReadFile (in: hFile=0x154, lpBuffer=0x1a3da9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3da9c*, lpNumberOfBytesRead=0x2ae404*=0x32f, lpOverlapped=0x0) returned 1 [0085.182] CloseHandle (hObject=0x154) returned 1 [0085.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x5d [0085.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0085.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.196] GetFileType (hFile=0x154) returned 0x1 [0085.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0085.196] GetFileType (hFile=0x154) returned 0x1 [0085.196] WriteFile (in: hFile=0x154, lpBuffer=0x1a8c9d4*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a8c9d4*, lpNumberOfBytesWritten=0x2ae3cc*=0x330, lpOverlapped=0x0) returned 1 [0085.197] CloseHandle (hObject=0x154) returned 1 [0085.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x5d [0085.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.anonymous", lpFilePart=0x0) returned 0x67 [0085.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0085.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6657e100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x45febe30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd1b733b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0085.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0085.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.anonymous")) returned 1 [0085.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.198] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM", lpFilePart=0x0) returned 0x38 [0085.198] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpFilePart=0x0) returned 0x39 [0085.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.200] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.201] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.202] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.203] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.204] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.204] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.204] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.204] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.204] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.209] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.210] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0085.211] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.212] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM", lpFilePart=0x0) returned 0x38 [0085.212] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpFilePart=0x0) returned 0x39 [0085.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.214] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.214] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.214] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.214] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.214] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.215] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.216] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.217] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.218] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.219] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.219] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.219] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0085.219] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR", lpFilePart=0x0) returned 0x38 [0085.220] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpFilePart=0x0) returned 0x39 [0085.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.256] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.257] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.258] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.259] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.260] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.261] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0085.263] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.264] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR", lpFilePart=0x0) returned 0x38 [0085.264] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpFilePart=0x0) returned 0x39 [0085.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.265] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.267] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles", lpFilePart=0x0) returned 0x3b [0085.267] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpFilePart=0x0) returned 0x3c [0085.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.277] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles", lpFilePart=0x0) returned 0x3b [0085.278] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpFilePart=0x0) returned 0x3c [0085.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.279] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.280] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir", lpFilePart=0x0) returned 0x35 [0085.280] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\", lpFilePart=0x0) returned 0x36 [0085.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.280] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir", lpFilePart=0x0) returned 0x35 [0085.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\", lpFilePart=0x0) returned 0x36 [0085.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.281] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.281] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1036", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1036", lpFilePart=0x0) returned 0x2f [0085.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1036\\", lpFilePart=0x0) returned 0x30 [0085.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.282] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\1036", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1036", lpFilePart=0x0) returned 0x2f [0085.282] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\1036\\", lpFilePart=0x0) returned 0x30 [0085.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.282] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.282] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\3082", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\3082", lpFilePart=0x0) returned 0x2f [0085.282] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\3082\\", lpFilePart=0x0) returned 0x30 [0085.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.283] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\3082", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\3082", lpFilePart=0x0) returned 0x2f [0085.283] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\3082\\", lpFilePart=0x0) returned 0x30 [0085.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.283] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.284] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\AccessWeb", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb", lpFilePart=0x0) returned 0x34 [0085.284] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpFilePart=0x0) returned 0x35 [0085.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.284] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\AccessWeb", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb", lpFilePart=0x0) returned 0x34 [0085.285] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\", lpFilePart=0x0) returned 0x35 [0085.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.285] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\ACCWIZ", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ", lpFilePart=0x0) returned 0x31 [0085.285] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpFilePart=0x0) returned 0x32 [0085.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.331] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\ACCWIZ", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ", lpFilePart=0x0) returned 0x31 [0085.332] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\", lpFilePart=0x0) returned 0x32 [0085.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.333] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\ADDINS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS", lpFilePart=0x0) returned 0x31 [0085.334] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpFilePart=0x0) returned 0x32 [0085.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.335] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.337] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\ADDINS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS", lpFilePart=0x0) returned 0x31 [0085.337] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", lpFilePart=0x0) returned 0x32 [0085.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.338] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.339] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Bibliography", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography", lpFilePart=0x0) returned 0x37 [0085.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpFilePart=0x0) returned 0x38 [0085.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.362] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Bibliography", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography", lpFilePart=0x0) returned 0x37 [0085.363] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", lpFilePart=0x0) returned 0x38 [0085.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.364] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort", lpFilePart=0x0) returned 0x3c [0085.365] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpFilePart=0x0) returned 0x3d [0085.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.367] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.367] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort", lpFilePart=0x0) returned 0x3c [0085.367] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", lpFilePart=0x0) returned 0x3d [0085.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.367] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.367] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style", lpFilePart=0x0) returned 0x3d [0085.367] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpFilePart=0x0) returned 0x3e [0085.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.386] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.387] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style", lpFilePart=0x0) returned 0x3d [0085.387] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", lpFilePart=0x0) returned 0x3e [0085.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.388] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.389] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\BORDERS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS", lpFilePart=0x0) returned 0x32 [0085.389] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpFilePart=0x0) returned 0x33 [0085.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.397] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\BORDERS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS", lpFilePart=0x0) returned 0x32 [0085.398] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", lpFilePart=0x0) returned 0x33 [0085.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.399] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\CONVERT", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT", lpFilePart=0x0) returned 0x32 [0085.400] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpFilePart=0x0) returned 0x33 [0085.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.408] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.409] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\CONVERT", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT", lpFilePart=0x0) returned 0x32 [0085.410] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", lpFilePart=0x0) returned 0x33 [0085.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.411] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.412] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033", lpFilePart=0x0) returned 0x37 [0085.412] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpFilePart=0x0) returned 0x38 [0085.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.432] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.433] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033", lpFilePart=0x0) returned 0x37 [0085.433] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", lpFilePart=0x0) returned 0x38 [0085.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.434] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.435] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Document Parts", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts", lpFilePart=0x0) returned 0x39 [0085.435] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\", lpFilePart=0x0) returned 0x3a [0085.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.436] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.436] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Document Parts", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts", lpFilePart=0x0) returned 0x39 [0085.436] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\", lpFilePart=0x0) returned 0x3a [0085.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.436] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.436] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033", lpFilePart=0x0) returned 0x3e [0085.436] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\", lpFilePart=0x0) returned 0x3f [0085.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.437] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.437] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033", lpFilePart=0x0) returned 0x3e [0085.437] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\", lpFilePart=0x0) returned 0x3f [0085.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.437] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.437] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14", lpFilePart=0x0) returned 0x41 [0085.437] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\", lpFilePart=0x0) returned 0x42 [0085.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.438] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14", lpFilePart=0x0) returned 0x41 [0085.438] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\", lpFilePart=0x0) returned 0x42 [0085.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.438] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.438] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\FORMS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS", lpFilePart=0x0) returned 0x30 [0085.438] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", lpFilePart=0x0) returned 0x31 [0085.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.439] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\FORMS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS", lpFilePart=0x0) returned 0x30 [0085.439] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", lpFilePart=0x0) returned 0x31 [0085.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.439] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033", lpFilePart=0x0) returned 0x35 [0085.439] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpFilePart=0x0) returned 0x36 [0085.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.468] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.470] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033", lpFilePart=0x0) returned 0x35 [0085.470] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", lpFilePart=0x0) returned 0x36 [0085.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.471] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove", lpFilePart=0x0) returned 0x31 [0085.472] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpFilePart=0x0) returned 0x32 [0085.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.474] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0085.475] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove", lpFilePart=0x0) returned 0x31 [0085.475] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpFilePart=0x0) returned 0x32 [0085.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf158 [0085.476] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0085.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0085.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.477] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates", lpFilePart=0x0) returned 0x3e [0085.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", lpFilePart=0x0) returned 0x3f [0085.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.479] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates", lpFilePart=0x0) returned 0x3e [0085.479] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", lpFilePart=0x0) returned 0x3f [0085.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.479] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net", lpFilePart=0x0) returned 0x49 [0085.479] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", lpFilePart=0x0) returned 0x4a [0085.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.480] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net", lpFilePart=0x0) returned 0x49 [0085.480] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", lpFilePart=0x0) returned 0x4a [0085.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.480] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components", lpFilePart=0x0) returned 0x54 [0085.481] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", lpFilePart=0x0) returned 0x55 [0085.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.481] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components", lpFilePart=0x0) returned 0x54 [0085.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", lpFilePart=0x0) returned 0x55 [0085.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.482] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects", lpFilePart=0x0) returned 0x58 [0085.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", lpFilePart=0x0) returned 0x59 [0085.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.483] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects", lpFilePart=0x0) returned 0x58 [0085.483] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", lpFilePart=0x0) returned 0x59 [0085.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.483] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.484] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers", lpFilePart=0x0) returned 0x51 [0085.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", lpFilePart=0x0) returned 0x52 [0085.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.484] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.484] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers", lpFilePart=0x0) returned 0x51 [0085.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", lpFilePart=0x0) returned 0x52 [0085.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.484] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign", lpFilePart=0x0) returned 0x47 [0085.485] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", lpFilePart=0x0) returned 0x48 [0085.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.501] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign", lpFilePart=0x0) returned 0x47 [0085.502] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", lpFilePart=0x0) returned 0x48 [0085.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.502] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components", lpFilePart=0x0) returned 0x52 [0085.502] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpFilePart=0x0) returned 0x53 [0085.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.515] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0085.518] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components", lpFilePart=0x0) returned 0x52 [0085.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", lpFilePart=0x0) returned 0x53 [0085.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0085.522] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0085.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0085.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.525] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds", lpFilePart=0x0) returned 0x38 [0085.525] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpFilePart=0x0) returned 0x39 [0085.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.526] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.526] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds", lpFilePart=0x0) returned 0x38 [0085.526] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpFilePart=0x0) returned 0x39 [0085.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.526] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.527] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People", lpFilePart=0x0) returned 0x3f [0085.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpFilePart=0x0) returned 0x40 [0085.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.553] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People", lpFilePart=0x0) returned 0x3f [0085.556] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpFilePart=0x0) returned 0x40 [0085.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.559] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places", lpFilePart=0x0) returned 0x3f [0085.562] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpFilePart=0x0) returned 0x40 [0085.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.567] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.570] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places", lpFilePart=0x0) returned 0x3f [0085.570] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpFilePart=0x0) returned 0x40 [0085.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.574] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things", lpFilePart=0x0) returned 0x3f [0085.577] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpFilePart=0x0) returned 0x40 [0085.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.600] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0085.602] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things", lpFilePart=0x0) returned 0x3f [0085.602] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpFilePart=0x0) returned 0x40 [0085.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf158 [0085.605] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0085.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs", lpFilePart=0x0) returned 0x3a [0085.608] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpFilePart=0x0) returned 0x3b [0085.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.627] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0085.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs", lpFilePart=0x0) returned 0x3a [0085.630] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpFilePart=0x0) returned 0x3b [0085.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf158 [0085.633] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0085.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0085.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0085.635] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0085.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.639] GetFileType (hFile=0x154) returned 0x1 [0085.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.639] GetFileType (hFile=0x154) returned 0x1 [0085.639] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x14c9 [0085.682] CloseHandle (hObject=0x154) returned 1 [0085.694] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0085.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.695] GetFileType (hFile=0x154) returned 0x1 [0085.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.695] GetFileType (hFile=0x154) returned 0x1 [0085.695] WriteFile (in: hFile=0x154, lpBuffer=0x1b750a8*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b750a8*, lpNumberOfBytesWritten=0x2ae4e0*=0x14d0, lpOverlapped=0x0) returned 1 [0085.696] CloseHandle (hObject=0x154) returned 1 [0085.696] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0085.697] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5f [0085.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.697] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8a400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b7f4f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2035fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14d0)) returned 1 [0085.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.anonymous")) returned 1 [0085.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0085.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.698] GetFileType (hFile=0x154) returned 0x1 [0085.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.698] GetFileType (hFile=0x154) returned 0x1 [0085.698] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x538 [0085.700] CloseHandle (hObject=0x154) returned 1 [0085.712] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0085.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.713] GetFileType (hFile=0x154) returned 0x1 [0085.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.713] GetFileType (hFile=0x154) returned 0x1 [0085.713] WriteFile (in: hFile=0x154, lpBuffer=0x1bc6990*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1bc6990*, lpNumberOfBytesWritten=0x2ae4b4*=0x540, lpOverlapped=0x0) returned 1 [0085.715] CloseHandle (hObject=0x154) returned 1 [0085.715] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0085.715] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x63 [0085.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8a400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b7f4f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2082270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0085.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.anonymous")) returned 1 [0085.716] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpFilePart=0x0) returned 0x4e [0085.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.716] GetFileType (hFile=0x154) returned 0x1 [0085.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.716] GetFileType (hFile=0x154) returned 0x1 [0085.716] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf38 [0085.719] ReadFile (in: hFile=0x154, lpBuffer=0x197698c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x197698c*, lpNumberOfBytesRead=0x2ae4ec*=0xf38, lpOverlapped=0x0) returned 1 [0085.730] CloseHandle (hObject=0x154) returned 1 [0085.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpFilePart=0x0) returned 0x4e [0085.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.769] GetFileType (hFile=0x154) returned 0x1 [0085.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.769] GetFileType (hFile=0x154) returned 0x1 [0085.769] WriteFile (in: hFile=0x154, lpBuffer=0x19c9660*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19c9660*, lpNumberOfBytesWritten=0x2ae4b4*=0xf40, lpOverlapped=0x0) returned 1 [0085.770] CloseHandle (hObject=0x154) returned 1 [0085.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", lpFilePart=0x0) returned 0x4e [0085.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.anonymous", lpFilePart=0x0) returned 0x58 [0085.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.771] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9d100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c3dbd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd20f4690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0085.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.anonymous")) returned 1 [0085.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpFilePart=0x0) returned 0x52 [0085.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.772] GetFileType (hFile=0x154) returned 0x1 [0085.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.772] GetFileType (hFile=0x154) returned 0x1 [0085.772] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x938 [0085.772] ReadFile (in: hFile=0x154, lpBuffer=0x19cb33c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19cb33c*, lpNumberOfBytesRead=0x2ae4ec*=0x938, lpOverlapped=0x0) returned 1 [0085.783] CloseHandle (hObject=0x154) returned 1 [0085.802] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpFilePart=0x0) returned 0x52 [0085.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.804] GetFileType (hFile=0x154) returned 0x1 [0085.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.804] GetFileType (hFile=0x154) returned 0x1 [0085.804] WriteFile (in: hFile=0x154, lpBuffer=0x1a1c0c4*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a1c0c4*, lpNumberOfBytesWritten=0x2ae4b4*=0x940, lpOverlapped=0x0) returned 1 [0085.806] CloseHandle (hObject=0x154) returned 1 [0085.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", lpFilePart=0x0) returned 0x52 [0085.806] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x5c [0085.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.806] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9d100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c3dbd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2166ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x940)) returned 1 [0085.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.anonymous")) returned 1 [0085.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpFilePart=0x0) returned 0x4f [0085.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.808] GetFileType (hFile=0x154) returned 0x1 [0085.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.808] GetFileType (hFile=0x154) returned 0x1 [0085.808] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x296b [0085.809] ReadFile (in: hFile=0x154, lpBuffer=0x1a1d468, nNumberOfBytesToRead=0x296b, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a1d468*, lpNumberOfBytesRead=0x2ae4ec*=0x296b, lpOverlapped=0x0) returned 1 [0085.844] CloseHandle (hObject=0x154) returned 1 [0085.864] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpFilePart=0x0) returned 0x4f [0085.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.866] GetFileType (hFile=0x154) returned 0x1 [0085.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.866] GetFileType (hFile=0x154) returned 0x1 [0085.866] WriteFile (in: hFile=0x154, lpBuffer=0x1a77184*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a77184*, lpNumberOfBytesWritten=0x2ae4e0*=0x2970, lpOverlapped=0x0) returned 1 [0085.868] CloseHandle (hObject=0x154) returned 1 [0085.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpFilePart=0x0) returned 0x4f [0085.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.anonymous", lpFilePart=0x0) returned 0x59 [0085.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.881] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9d100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86cfc2b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd21d8ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2970)) returned 1 [0085.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.anonymous")) returned 1 [0085.882] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpFilePart=0x0) returned 0x53 [0085.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.882] GetFileType (hFile=0x154) returned 0x1 [0085.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.882] GetFileType (hFile=0x154) returned 0x1 [0085.882] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf78 [0085.882] ReadFile (in: hFile=0x154, lpBuffer=0x1a7af54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a7af54*, lpNumberOfBytesRead=0x2ae4ec*=0xf78, lpOverlapped=0x0) returned 1 [0085.886] CloseHandle (hObject=0x154) returned 1 [0085.898] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpFilePart=0x0) returned 0x53 [0085.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.900] GetFileType (hFile=0x154) returned 0x1 [0085.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.900] GetFileType (hFile=0x154) returned 0x1 [0085.900] WriteFile (in: hFile=0x154, lpBuffer=0x1acdc20*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1acdc20*, lpNumberOfBytesWritten=0x2ae4b4*=0xf80, lpOverlapped=0x0) returned 1 [0085.901] CloseHandle (hObject=0x154) returned 1 [0085.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", lpFilePart=0x0) returned 0x53 [0085.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x5d [0085.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.901] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9d100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86cfc2b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd224b2f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf80)) returned 1 [0085.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.anonymous")) returned 1 [0085.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpFilePart=0x0) returned 0x51 [0085.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.902] GetFileType (hFile=0x154) returned 0x1 [0085.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.902] GetFileType (hFile=0x154) returned 0x1 [0085.902] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x16c7 [0085.902] ReadFile (in: hFile=0x154, lpBuffer=0x1acefcc, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1acefcc*, lpNumberOfBytesRead=0x2ae4ec*=0x16c7, lpOverlapped=0x0) returned 1 [0085.903] CloseHandle (hObject=0x154) returned 1 [0085.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpFilePart=0x0) returned 0x51 [0085.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.917] GetFileType (hFile=0x154) returned 0x1 [0085.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.917] GetFileType (hFile=0x154) returned 0x1 [0085.917] WriteFile (in: hFile=0x154, lpBuffer=0x1b22fc8*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b22fc8*, lpNumberOfBytesWritten=0x2ae4e0*=0x16d0, lpOverlapped=0x0) returned 1 [0085.918] CloseHandle (hObject=0x154) returned 1 [0085.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpFilePart=0x0) returned 0x51 [0085.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0085.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.918] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9d100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x770aa6b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2271450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16d0)) returned 1 [0085.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.anonymous")) returned 1 [0085.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpFilePart=0x0) returned 0x55 [0085.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.920] GetFileType (hFile=0x154) returned 0x1 [0085.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.920] GetFileType (hFile=0x154) returned 0x1 [0085.920] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x708 [0085.920] ReadFile (in: hFile=0x154, lpBuffer=0x1b252a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b252a4*, lpNumberOfBytesRead=0x2ae4ec*=0x708, lpOverlapped=0x0) returned 1 [0085.925] CloseHandle (hObject=0x154) returned 1 [0085.938] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpFilePart=0x0) returned 0x55 [0085.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.941] GetFileType (hFile=0x154) returned 0x1 [0085.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.941] GetFileType (hFile=0x154) returned 0x1 [0085.941] WriteFile (in: hFile=0x154, lpBuffer=0x1b75548*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b75548*, lpNumberOfBytesWritten=0x2ae4b4*=0x710, lpOverlapped=0x0) returned 1 [0085.944] CloseHandle (hObject=0x154) returned 1 [0085.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpFilePart=0x0) returned 0x55 [0085.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x5f [0085.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.944] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9d100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x770aa6b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd22975b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x710)) returned 1 [0085.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.anonymous")) returned 1 [0085.945] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpFilePart=0x0) returned 0x51 [0085.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.946] GetFileType (hFile=0x154) returned 0x1 [0085.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.946] GetFileType (hFile=0x154) returned 0x1 [0085.946] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x16c7 [0085.946] ReadFile (in: hFile=0x154, lpBuffer=0x1b76900, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b76900*, lpNumberOfBytesRead=0x2ae4ec*=0x16c7, lpOverlapped=0x0) returned 1 [0085.948] CloseHandle (hObject=0x154) returned 1 [0085.990] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpFilePart=0x0) returned 0x51 [0085.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0085.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.992] GetFileType (hFile=0x154) returned 0x1 [0085.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0085.992] GetFileType (hFile=0x154) returned 0x1 [0085.992] WriteFile (in: hFile=0x154, lpBuffer=0x19c9a34*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19c9a34*, lpNumberOfBytesWritten=0x2ae4e0*=0x16d0, lpOverlapped=0x0) returned 1 [0085.993] CloseHandle (hObject=0x154) returned 1 [0085.993] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpFilePart=0x0) returned 0x51 [0085.994] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0085.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0085.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82afe00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x770d0810, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd232fb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16d0)) returned 1 [0085.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0085.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.anonymous")) returned 1 [0085.996] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpFilePart=0x0) returned 0x55 [0085.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0085.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0085.997] GetFileType (hFile=0x154) returned 0x1 [0085.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0085.997] GetFileType (hFile=0x154) returned 0x1 [0085.997] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x708 [0085.997] ReadFile (in: hFile=0x154, lpBuffer=0x19cbd10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19cbd10*, lpNumberOfBytesRead=0x2ae4ec*=0x708, lpOverlapped=0x0) returned 1 [0086.016] CloseHandle (hObject=0x154) returned 1 [0086.027] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpFilePart=0x0) returned 0x55 [0086.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.029] GetFileType (hFile=0x154) returned 0x1 [0086.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.029] GetFileType (hFile=0x154) returned 0x1 [0086.029] WriteFile (in: hFile=0x154, lpBuffer=0x1a1bfb4*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a1bfb4*, lpNumberOfBytesWritten=0x2ae4b4*=0x710, lpOverlapped=0x0) returned 1 [0086.030] CloseHandle (hObject=0x154) returned 1 [0086.030] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpFilePart=0x0) returned 0x55 [0086.030] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x5f [0086.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.030] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82afe00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86e2cdb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd237bdf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x710)) returned 1 [0086.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.anonymous")) returned 1 [0086.031] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpFilePart=0x0) returned 0x57 [0086.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.032] GetFileType (hFile=0x154) returned 0x1 [0086.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.032] GetFileType (hFile=0x154) returned 0x1 [0086.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2eaf [0086.032] ReadFile (in: hFile=0x154, lpBuffer=0x1a1d384, nNumberOfBytesToRead=0x2eaf, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a1d384*, lpNumberOfBytesRead=0x2ae4ec*=0x2eaf, lpOverlapped=0x0) returned 1 [0086.213] CloseHandle (hObject=0x154) returned 1 [0086.225] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpFilePart=0x0) returned 0x57 [0086.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.226] GetFileType (hFile=0x154) returned 0x1 [0086.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.227] GetFileType (hFile=0x154) returned 0x1 [0086.227] WriteFile (in: hFile=0x154, lpBuffer=0x1a78ae0*, nNumberOfBytesToWrite=0x2eb0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a78ae0*, lpNumberOfBytesWritten=0x2ae4e0*=0x2eb0, lpOverlapped=0x0) returned 1 [0086.228] CloseHandle (hObject=0x154) returned 1 [0086.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpFilePart=0x0) returned 0x57 [0086.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x61 [0086.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.228] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82afe00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7737e0d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd256afd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2eb0)) returned 1 [0086.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.anonymous")) returned 1 [0086.229] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x5b [0086.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.388] GetFileType (hFile=0x154) returned 0x1 [0086.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.388] GetFileType (hFile=0x154) returned 0x1 [0086.388] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x638 [0086.388] ReadFile (in: hFile=0x154, lpBuffer=0x1a7c520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a7c520*, lpNumberOfBytesRead=0x2ae4ec*=0x638, lpOverlapped=0x0) returned 1 [0086.396] CloseHandle (hObject=0x154) returned 1 [0086.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x5b [0086.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.409] GetFileType (hFile=0x154) returned 0x1 [0086.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.409] GetFileType (hFile=0x154) returned 0x1 [0086.409] WriteFile (in: hFile=0x154, lpBuffer=0x1acc3cc*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1acc3cc*, lpNumberOfBytesWritten=0x2ae4b4*=0x640, lpOverlapped=0x0) returned 1 [0086.410] CloseHandle (hObject=0x154) returned 1 [0086.410] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x5b [0086.410] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x65 [0086.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.410] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82afe00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x876cdd70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd270def0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0086.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.anonymous")) returned 1 [0086.411] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpFilePart=0x0) returned 0x4f [0086.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.412] GetFileType (hFile=0x154) returned 0x1 [0086.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.412] GetFileType (hFile=0x154) returned 0x1 [0086.412] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2a0f [0086.412] ReadFile (in: hFile=0x154, lpBuffer=0x1acd7a0, nNumberOfBytesToRead=0x2a0f, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1acd7a0*, lpNumberOfBytesRead=0x2ae4ec*=0x2a0f, lpOverlapped=0x0) returned 1 [0086.481] CloseHandle (hObject=0x154) returned 1 [0086.493] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpFilePart=0x0) returned 0x4f [0086.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.494] GetFileType (hFile=0x154) returned 0x1 [0086.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.494] GetFileType (hFile=0x154) returned 0x1 [0086.494] WriteFile (in: hFile=0x154, lpBuffer=0x1b277dc*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b277dc*, lpNumberOfBytesWritten=0x2ae4e0*=0x2a10, lpOverlapped=0x0) returned 1 [0086.495] CloseHandle (hObject=0x154) returned 1 [0086.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpFilePart=0x0) returned 0x4f [0086.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.anonymous", lpFilePart=0x0) returned 0x59 [0086.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.496] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82afe00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8840b7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd27f2730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2a10)) returned 1 [0086.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.anonymous")) returned 1 [0086.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpFilePart=0x0) returned 0x53 [0086.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.497] GetFileType (hFile=0x154) returned 0x1 [0086.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.497] GetFileType (hFile=0x154) returned 0x1 [0086.497] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3618 [0086.497] ReadFile (in: hFile=0x154, lpBuffer=0x1b2a6c8, nNumberOfBytesToRead=0x3618, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b2a6c8*, lpNumberOfBytesRead=0x2ae4ec*=0x3618, lpOverlapped=0x0) returned 1 [0086.506] CloseHandle (hObject=0x154) returned 1 [0086.546] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpFilePart=0x0) returned 0x53 [0086.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.547] GetFileType (hFile=0x154) returned 0x1 [0086.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.547] GetFileType (hFile=0x154) returned 0x1 [0086.547] WriteFile (in: hFile=0x154, lpBuffer=0x198bdd8*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x198bdd8*, lpNumberOfBytesWritten=0x2ae4e0*=0x3620, lpOverlapped=0x0) returned 1 [0086.549] CloseHandle (hObject=0x154) returned 1 [0086.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpFilePart=0x0) returned 0x53 [0086.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x5d [0086.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2b00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8840b7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2864b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3620)) returned 1 [0086.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.anonymous")) returned 1 [0086.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpFilePart=0x0) returned 0x43 [0086.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.550] GetFileType (hFile=0x154) returned 0x1 [0086.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.550] GetFileType (hFile=0x154) returned 0x1 [0086.550] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1d29 [0086.550] ReadFile (in: hFile=0x154, lpBuffer=0x198f8bc, nNumberOfBytesToRead=0x1d29, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x198f8bc*, lpNumberOfBytesRead=0x2ae4ec*=0x1d29, lpOverlapped=0x0) returned 1 [0086.563] CloseHandle (hObject=0x154) returned 1 [0086.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpFilePart=0x0) returned 0x43 [0086.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.580] GetFileType (hFile=0x154) returned 0x1 [0086.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.580] GetFileType (hFile=0x154) returned 0x1 [0086.580] WriteFile (in: hFile=0x154, lpBuffer=0x19e5898*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19e5898*, lpNumberOfBytesWritten=0x2ae4e0*=0x1d30, lpOverlapped=0x0) returned 1 [0086.582] CloseHandle (hObject=0x154) returned 1 [0086.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpFilePart=0x0) returned 0x43 [0086.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.anonymous", lpFilePart=0x0) returned 0x4d [0086.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.583] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2b00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78ca2930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd28b0e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d30)) returned 1 [0086.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.anonymous")) returned 1 [0086.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpFilePart=0x0) returned 0x4e [0086.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.584] GetFileType (hFile=0x154) returned 0x1 [0086.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.584] GetFileType (hFile=0x154) returned 0x1 [0086.584] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xbe5 [0086.584] ReadFile (in: hFile=0x154, lpBuffer=0x19e8624, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19e8624*, lpNumberOfBytesRead=0x2ae4ec*=0xbe5, lpOverlapped=0x0) returned 1 [0086.693] CloseHandle (hObject=0x154) returned 1 [0086.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpFilePart=0x0) returned 0x4e [0086.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.707] GetFileType (hFile=0x154) returned 0x1 [0086.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.707] GetFileType (hFile=0x154) returned 0x1 [0086.707] WriteFile (in: hFile=0x154, lpBuffer=0x1a3a110*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a3a110*, lpNumberOfBytesWritten=0x2ae4b4*=0xbf0, lpOverlapped=0x0) returned 1 [0086.708] CloseHandle (hObject=0x154) returned 1 [0086.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpFilePart=0x0) returned 0x4e [0086.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.anonymous", lpFilePart=0x0) returned 0x58 [0086.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.709] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2b00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78e6b9b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd29e1910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0086.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.anonymous")) returned 1 [0086.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpFilePart=0x0) returned 0x52 [0086.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.710] GetFileType (hFile=0x154) returned 0x1 [0086.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.710] GetFileType (hFile=0x154) returned 0x1 [0086.710] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x838 [0086.710] ReadFile (in: hFile=0x154, lpBuffer=0x1a3bcec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a3bcec*, lpNumberOfBytesRead=0x2ae4ec*=0x838, lpOverlapped=0x0) returned 1 [0086.711] CloseHandle (hObject=0x154) returned 1 [0086.723] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpFilePart=0x0) returned 0x52 [0086.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.725] GetFileType (hFile=0x154) returned 0x1 [0086.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.725] GetFileType (hFile=0x154) returned 0x1 [0086.725] WriteFile (in: hFile=0x154, lpBuffer=0x1a8c574*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a8c574*, lpNumberOfBytesWritten=0x2ae4b4*=0x840, lpOverlapped=0x0) returned 1 [0086.726] CloseHandle (hObject=0x154) returned 1 [0086.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpFilePart=0x0) returned 0x52 [0086.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.anonymous", lpFilePart=0x0) returned 0x5c [0086.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.727] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2b00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78e6b9b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2a2dbd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0086.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.anonymous")) returned 1 [0086.727] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpFilePart=0x0) returned 0x54 [0086.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.728] GetFileType (hFile=0x154) returned 0x1 [0086.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.728] GetFileType (hFile=0x154) returned 0x1 [0086.728] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xceed [0086.728] ReadFile (in: hFile=0x154, lpBuffer=0x1a8d92c, nNumberOfBytesToRead=0xceed, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a8d92c*, lpNumberOfBytesRead=0x2ae4ec*=0xceed, lpOverlapped=0x0) returned 1 [0086.754] CloseHandle (hObject=0x154) returned 1 [0086.769] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpFilePart=0x0) returned 0x54 [0086.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.771] GetFileType (hFile=0x154) returned 0x1 [0086.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.771] GetFileType (hFile=0x154) returned 0x1 [0086.771] WriteFile (in: hFile=0x154, lpBuffer=0x1b013fc*, nNumberOfBytesToWrite=0xcef0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b013fc*, lpNumberOfBytesWritten=0x2ae4e0*=0xcef0, lpOverlapped=0x0) returned 1 [0086.773] CloseHandle (hObject=0x154) returned 1 [0086.773] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpFilePart=0x0) returned 0x54 [0086.773] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.anonymous", lpFilePart=0x0) returned 0x5e [0086.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.773] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8f8300, ftCreationTime.dwHighDateTime=0x1c9f985, ftLastAccessTime.dwLowDateTime=0x8d142170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2a9fff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcef0)) returned 1 [0086.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.anonymous")) returned 1 [0086.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpFilePart=0x0) returned 0x53 [0086.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.774] GetFileType (hFile=0x154) returned 0x1 [0086.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.774] GetFileType (hFile=0x154) returned 0x1 [0086.774] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1e93 [0086.774] ReadFile (in: hFile=0x154, lpBuffer=0x1b0e800, nNumberOfBytesToRead=0x1e93, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b0e800*, lpNumberOfBytesRead=0x2ae4ec*=0x1e93, lpOverlapped=0x0) returned 1 [0086.875] CloseHandle (hObject=0x154) returned 1 [0086.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpFilePart=0x0) returned 0x53 [0086.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.900] GetFileType (hFile=0x154) returned 0x1 [0086.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.900] GetFileType (hFile=0x154) returned 0x1 [0086.900] WriteFile (in: hFile=0x154, lpBuffer=0x1b64f0c*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b64f0c*, lpNumberOfBytesWritten=0x2ae4e0*=0x1ea0, lpOverlapped=0x0) returned 1 [0086.901] CloseHandle (hObject=0x154) returned 1 [0086.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpFilePart=0x0) returned 0x53 [0086.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.anonymous", lpFilePart=0x0) returned 0x5d [0086.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d5800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f1f3190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2bd0af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ea0)) returned 1 [0086.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.anonymous")) returned 1 [0086.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpFilePart=0x0) returned 0x57 [0086.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.903] GetFileType (hFile=0x154) returned 0x1 [0086.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.903] GetFileType (hFile=0x154) returned 0x1 [0086.903] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xaf8 [0086.903] ReadFile (in: hFile=0x154, lpBuffer=0x1b67dc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b67dc4*, lpNumberOfBytesRead=0x2ae4ec*=0xaf8, lpOverlapped=0x0) returned 1 [0086.906] CloseHandle (hObject=0x154) returned 1 [0086.965] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpFilePart=0x0) returned 0x57 [0086.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.966] GetFileType (hFile=0x154) returned 0x1 [0086.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.966] GetFileType (hFile=0x154) returned 0x1 [0086.966] WriteFile (in: hFile=0x154, lpBuffer=0x19c0ff8*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19c0ff8*, lpNumberOfBytesWritten=0x2ae4b4*=0xb00, lpOverlapped=0x0) returned 1 [0086.967] CloseHandle (hObject=0x154) returned 1 [0086.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpFilePart=0x0) returned 0x57 [0086.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x61 [0086.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d5800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f1f3190, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2c69070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb00)) returned 1 [0086.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.anonymous")) returned 1 [0086.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpFilePart=0x0) returned 0x5a [0086.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.970] GetFileType (hFile=0x154) returned 0x1 [0086.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0086.970] GetFileType (hFile=0x154) returned 0x1 [0086.970] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x25e5 [0086.970] ReadFile (in: hFile=0x154, lpBuffer=0x19c23e0, nNumberOfBytesToRead=0x25e5, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19c23e0*, lpNumberOfBytesRead=0x2ae4ec*=0x25e5, lpOverlapped=0x0) returned 1 [0086.980] CloseHandle (hObject=0x154) returned 1 [0086.995] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpFilePart=0x0) returned 0x5a [0086.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0086.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0086.997] GetFileType (hFile=0x154) returned 0x1 [0086.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0086.997] GetFileType (hFile=0x154) returned 0x1 [0086.997] WriteFile (in: hFile=0x154, lpBuffer=0x1a1af7c*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a1af7c*, lpNumberOfBytesWritten=0x2ae4e0*=0x25f0, lpOverlapped=0x0) returned 1 [0086.998] CloseHandle (hObject=0x154) returned 1 [0086.998] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpFilePart=0x0) returned 0x5a [0086.998] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x64 [0086.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0086.998] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d5800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f4c6bb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2cb5330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25f0)) returned 1 [0086.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0086.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.anonymous")) returned 1 [0086.999] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpFilePart=0x0) returned 0x5e [0086.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0086.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.000] GetFileType (hFile=0x154) returned 0x1 [0087.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.000] GetFileType (hFile=0x154) returned 0x1 [0087.000] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x838 [0087.000] ReadFile (in: hFile=0x154, lpBuffer=0x1a1e32c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a1e32c*, lpNumberOfBytesRead=0x2ae4ec*=0x838, lpOverlapped=0x0) returned 1 [0087.067] CloseHandle (hObject=0x154) returned 1 [0087.079] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpFilePart=0x0) returned 0x5e [0087.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.081] GetFileType (hFile=0x154) returned 0x1 [0087.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.081] GetFileType (hFile=0x154) returned 0x1 [0087.081] WriteFile (in: hFile=0x154, lpBuffer=0x1a6ebe4*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a6ebe4*, lpNumberOfBytesWritten=0x2ae4b4*=0x840, lpOverlapped=0x0) returned 1 [0087.083] CloseHandle (hObject=0x154) returned 1 [0087.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpFilePart=0x0) returned 0x5e [0087.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x68 [0087.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.083] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d5800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d272c70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2d73a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0087.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.anonymous")) returned 1 [0087.084] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpFilePart=0x0) returned 0x57 [0087.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.085] GetFileType (hFile=0x154) returned 0x1 [0087.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.085] GetFileType (hFile=0x154) returned 0x1 [0087.085] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x22f6 [0087.085] ReadFile (in: hFile=0x154, lpBuffer=0x1a6fff0, nNumberOfBytesToRead=0x22f6, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a6fff0*, lpNumberOfBytesRead=0x2ae4ec*=0x22f6, lpOverlapped=0x0) returned 1 [0087.117] CloseHandle (hObject=0x154) returned 1 [0087.129] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpFilePart=0x0) returned 0x57 [0087.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.131] GetFileType (hFile=0x154) returned 0x1 [0087.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.131] GetFileType (hFile=0x154) returned 0x1 [0087.131] WriteFile (in: hFile=0x154, lpBuffer=0x1ac7cdc*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1ac7cdc*, lpNumberOfBytesWritten=0x2ae4e0*=0x2300, lpOverlapped=0x0) returned 1 [0087.132] CloseHandle (hObject=0x154) returned 1 [0087.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpFilePart=0x0) returned 0x57 [0087.132] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x61 [0087.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.132] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d5800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d272c70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2e0bf90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2300)) returned 1 [0087.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.anonymous")) returned 1 [0087.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpFilePart=0x0) returned 0x5b [0087.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.133] GetFileType (hFile=0x154) returned 0x1 [0087.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.134] GetFileType (hFile=0x154) returned 0x1 [0087.134] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x140 [0087.134] ReadFile (in: hFile=0x154, lpBuffer=0x1aca674, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aca674*, lpNumberOfBytesRead=0x2ae4ec*=0x140, lpOverlapped=0x0) returned 1 [0087.135] CloseHandle (hObject=0x154) returned 1 [0087.146] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpFilePart=0x0) returned 0x5b [0087.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.148] GetFileType (hFile=0x154) returned 0x1 [0087.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.148] GetFileType (hFile=0x154) returned 0x1 [0087.148] WriteFile (in: hFile=0x154, lpBuffer=0x1b18c78*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b18c78*, lpNumberOfBytesWritten=0x2ae4b4*=0x150, lpOverlapped=0x0) returned 1 [0087.149] CloseHandle (hObject=0x154) returned 1 [0087.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpFilePart=0x0) returned 0x5b [0087.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x65 [0087.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.149] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d5800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d272c70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2e320f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0087.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.anonymous")) returned 1 [0087.156] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpFilePart=0x0) returned 0x51 [0087.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.157] GetFileType (hFile=0x154) returned 0x1 [0087.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.157] GetFileType (hFile=0x154) returned 0x1 [0087.157] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3efd [0087.158] ReadFile (in: hFile=0x154, lpBuffer=0x1b1a054, nNumberOfBytesToRead=0x3efd, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b1a054*, lpNumberOfBytesRead=0x2ae4ec*=0x3efd, lpOverlapped=0x0) returned 1 [0087.233] CloseHandle (hObject=0x154) returned 1 [0087.247] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpFilePart=0x0) returned 0x51 [0087.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.250] GetFileType (hFile=0x154) returned 0x1 [0087.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.250] GetFileType (hFile=0x154) returned 0x1 [0087.250] WriteFile (in: hFile=0x154, lpBuffer=0x1b7a940*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b7a940*, lpNumberOfBytesWritten=0x2ae4e0*=0x3f00, lpOverlapped=0x0) returned 1 [0087.252] CloseHandle (hObject=0x154) returned 1 [0087.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpFilePart=0x0) returned 0x51 [0087.253] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0087.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.253] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbec8400, ftCreationTime.dwHighDateTime=0x1c9e917, ftLastAccessTime.dwLowDateTime=0x8e3b4bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2f16930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f00)) returned 1 [0087.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.anonymous")) returned 1 [0087.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpFilePart=0x0) returned 0x54 [0087.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.254] GetFileType (hFile=0x154) returned 0x1 [0087.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.254] GetFileType (hFile=0x154) returned 0x1 [0087.254] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x40aa [0087.254] ReadFile (in: hFile=0x154, lpBuffer=0x1b7ed34, nNumberOfBytesToRead=0x40aa, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b7ed34*, lpNumberOfBytesRead=0x2ae4ec*=0x40aa, lpOverlapped=0x0) returned 1 [0087.275] CloseHandle (hObject=0x154) returned 1 [0087.326] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpFilePart=0x0) returned 0x54 [0087.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.328] GetFileType (hFile=0x154) returned 0x1 [0087.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.329] GetFileType (hFile=0x154) returned 0x1 [0087.329] WriteFile (in: hFile=0x154, lpBuffer=0x19e490c*, nNumberOfBytesToWrite=0x40b0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19e490c*, lpNumberOfBytesWritten=0x2ae4e0*=0x40b0, lpOverlapped=0x0) returned 1 [0087.330] CloseHandle (hObject=0x154) returned 1 [0087.330] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpFilePart=0x0) returned 0x54 [0087.331] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.anonymous", lpFilePart=0x0) returned 0x5e [0087.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.331] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe575ec00, ftCreationTime.dwHighDateTime=0x1c9e917, ftLastAccessTime.dwLowDateTime=0x8e3b4bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd2fd5010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40b0)) returned 1 [0087.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.anonymous")) returned 1 [0087.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpFilePart=0x0) returned 0x52 [0087.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.333] GetFileType (hFile=0x154) returned 0x1 [0087.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.333] GetFileType (hFile=0x154) returned 0x1 [0087.333] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2f2 [0087.333] ReadFile (in: hFile=0x154, lpBuffer=0x19e91cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19e91cc*, lpNumberOfBytesRead=0x2ae4ec*=0x2f2, lpOverlapped=0x0) returned 1 [0087.349] CloseHandle (hObject=0x154) returned 1 [0087.367] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpFilePart=0x0) returned 0x52 [0087.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.369] GetFileType (hFile=0x154) returned 0x1 [0087.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.369] GetFileType (hFile=0x154) returned 0x1 [0087.369] WriteFile (in: hFile=0x154, lpBuffer=0x1a3801c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a3801c*, lpNumberOfBytesWritten=0x2ae4b4*=0x300, lpOverlapped=0x0) returned 1 [0087.371] CloseHandle (hObject=0x154) returned 1 [0087.371] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpFilePart=0x0) returned 0x52 [0087.371] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.anonymous", lpFilePart=0x0) returned 0x5c [0087.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.371] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe652700, ftCreationTime.dwHighDateTime=0x1c911b6, ftLastAccessTime.dwLowDateTime=0x80e376d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3047430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1 [0087.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.anonymous")) returned 1 [0087.372] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpFilePart=0x0) returned 0x57 [0087.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.372] GetFileType (hFile=0x154) returned 0x1 [0087.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.372] GetFileType (hFile=0x154) returned 0x1 [0087.372] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2cc [0087.372] ReadFile (in: hFile=0x154, lpBuffer=0x1a396b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a396b8*, lpNumberOfBytesRead=0x2ae4ec*=0x2cc, lpOverlapped=0x0) returned 1 [0087.382] CloseHandle (hObject=0x154) returned 1 [0087.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpFilePart=0x0) returned 0x57 [0087.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.402] GetFileType (hFile=0x154) returned 0x1 [0087.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.403] GetFileType (hFile=0x154) returned 0x1 [0087.403] WriteFile (in: hFile=0x154, lpBuffer=0x1a88420*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a88420*, lpNumberOfBytesWritten=0x2ae4b4*=0x2d0, lpOverlapped=0x0) returned 1 [0087.404] CloseHandle (hObject=0x154) returned 1 [0087.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpFilePart=0x0) returned 0x57 [0087.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.anonymous", lpFilePart=0x0) returned 0x61 [0087.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.404] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145b0800, ftCreationTime.dwHighDateTime=0x1c911b6, ftLastAccessTime.dwLowDateTime=0x80ea9af0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd30936f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1 [0087.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.anonymous")) returned 1 [0087.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpFilePart=0x0) returned 0x55 [0087.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.406] GetFileType (hFile=0x154) returned 0x1 [0087.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.406] GetFileType (hFile=0x154) returned 0x1 [0087.406] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x307 [0087.406] ReadFile (in: hFile=0x154, lpBuffer=0x1a89b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a89b08*, lpNumberOfBytesRead=0x2ae4ec*=0x307, lpOverlapped=0x0) returned 1 [0087.408] CloseHandle (hObject=0x154) returned 1 [0087.426] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpFilePart=0x0) returned 0x55 [0087.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.428] GetFileType (hFile=0x154) returned 0x1 [0087.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.429] GetFileType (hFile=0x154) returned 0x1 [0087.429] WriteFile (in: hFile=0x154, lpBuffer=0x1ad89b0*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1ad89b0*, lpNumberOfBytesWritten=0x2ae4b4*=0x310, lpOverlapped=0x0) returned 1 [0087.430] CloseHandle (hObject=0x154) returned 1 [0087.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpFilePart=0x0) returned 0x55 [0087.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.anonymous", lpFilePart=0x0) returned 0x5f [0087.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.430] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ee8f00, ftCreationTime.dwHighDateTime=0x1c911b6, ftLastAccessTime.dwLowDateTime=0x8e3b4bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd30df9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1 [0087.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.anonymous")) returned 1 [0087.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpFilePart=0x0) returned 0x50 [0087.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.432] GetFileType (hFile=0x154) returned 0x1 [0087.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.432] GetFileType (hFile=0x154) returned 0x1 [0087.432] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x368 [0087.432] ReadFile (in: hFile=0x154, lpBuffer=0x1ada0d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ada0d8*, lpNumberOfBytesRead=0x2ae4ec*=0x368, lpOverlapped=0x0) returned 1 [0087.434] CloseHandle (hObject=0x154) returned 1 [0087.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpFilePart=0x0) returned 0x50 [0087.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.454] GetFileType (hFile=0x154) returned 0x1 [0087.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.454] GetFileType (hFile=0x154) returned 0x1 [0087.454] WriteFile (in: hFile=0x154, lpBuffer=0x1b29148*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b29148*, lpNumberOfBytesWritten=0x2ae4b4*=0x370, lpOverlapped=0x0) returned 1 [0087.456] CloseHandle (hObject=0x154) returned 1 [0087.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpFilePart=0x0) returned 0x50 [0087.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.anonymous", lpFilePart=0x0) returned 0x5a [0087.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b821600, ftCreationTime.dwHighDateTime=0x1c911b6, ftLastAccessTime.dwLowDateTime=0x8e3b4bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3105b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0087.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.anonymous")) returned 1 [0087.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpFilePart=0x0) returned 0x4e [0087.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.457] GetFileType (hFile=0x154) returned 0x1 [0087.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.457] GetFileType (hFile=0x154) returned 0x1 [0087.457] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3c0 [0087.458] ReadFile (in: hFile=0x154, lpBuffer=0x1b2a8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b2a8a8*, lpNumberOfBytesRead=0x2ae4ec*=0x3c0, lpOverlapped=0x0) returned 1 [0087.460] CloseHandle (hObject=0x154) returned 1 [0087.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpFilePart=0x0) returned 0x4e [0087.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.480] GetFileType (hFile=0x154) returned 0x1 [0087.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.481] GetFileType (hFile=0x154) returned 0x1 [0087.481] WriteFile (in: hFile=0x154, lpBuffer=0x1b79af8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b79af8*, lpNumberOfBytesWritten=0x2ae4b4*=0x3d0, lpOverlapped=0x0) returned 1 [0087.482] CloseHandle (hObject=0x154) returned 1 [0087.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpFilePart=0x0) returned 0x4e [0087.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.anonymous", lpFilePart=0x0) returned 0x58 [0087.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.482] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f159d00, ftCreationTime.dwHighDateTime=0x1c911b6, ftLastAccessTime.dwLowDateTime=0x80ea9af0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3151dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0087.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.anonymous")) returned 1 [0087.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpFilePart=0x0) returned 0x51 [0087.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.487] GetFileType (hFile=0x154) returned 0x1 [0087.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.487] GetFileType (hFile=0x154) returned 0x1 [0087.487] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x133a [0087.487] ReadFile (in: hFile=0x154, lpBuffer=0x1b7ae8c, nNumberOfBytesToRead=0x133a, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b7ae8c*, lpNumberOfBytesRead=0x2ae4ec*=0x133a, lpOverlapped=0x0) returned 1 [0087.511] CloseHandle (hObject=0x154) returned 1 [0087.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpFilePart=0x0) returned 0x51 [0087.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.564] GetFileType (hFile=0x154) returned 0x1 [0087.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.564] GetFileType (hFile=0x154) returned 0x1 [0087.565] WriteFile (in: hFile=0x154, lpBuffer=0x19d75d8*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19d75d8*, lpNumberOfBytesWritten=0x2ae4e0*=0x1340, lpOverlapped=0x0) returned 1 [0087.566] CloseHandle (hObject=0x154) returned 1 [0087.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpFilePart=0x0) returned 0x51 [0087.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.anonymous", lpFilePart=0x0) returned 0x5b [0087.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7c0000, ftCreationTime.dwHighDateTime=0x1c90f66, ftLastAccessTime.dwLowDateTime=0x8e3b4bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd32104b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1340)) returned 1 [0087.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.anonymous")) returned 1 [0087.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpFilePart=0x0) returned 0x54 [0087.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.568] GetFileType (hFile=0x154) returned 0x1 [0087.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.568] GetFileType (hFile=0x154) returned 0x1 [0087.568] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x133a [0087.568] ReadFile (in: hFile=0x154, lpBuffer=0x19d8e0c, nNumberOfBytesToRead=0x133a, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19d8e0c*, lpNumberOfBytesRead=0x2ae4ec*=0x133a, lpOverlapped=0x0) returned 1 [0087.572] CloseHandle (hObject=0x154) returned 1 [0087.590] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpFilePart=0x0) returned 0x54 [0087.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.594] GetFileType (hFile=0x154) returned 0x1 [0087.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.594] GetFileType (hFile=0x154) returned 0x1 [0087.594] WriteFile (in: hFile=0x154, lpBuffer=0x1a2bc38*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a2bc38*, lpNumberOfBytesWritten=0x2ae4e0*=0x1340, lpOverlapped=0x0) returned 1 [0087.598] CloseHandle (hObject=0x154) returned 1 [0087.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpFilePart=0x0) returned 0x54 [0087.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.anonymous", lpFilePart=0x0) returned 0x5e [0087.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.598] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf8d6200, ftCreationTime.dwHighDateTime=0x1c90f66, ftLastAccessTime.dwLowDateTime=0x80ea9af0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd325c770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1340)) returned 1 [0087.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.anonymous")) returned 1 [0087.599] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpFilePart=0x0) returned 0x54 [0087.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.600] GetFileType (hFile=0x154) returned 0x1 [0087.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.600] GetFileType (hFile=0x154) returned 0x1 [0087.600] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1e35 [0087.600] ReadFile (in: hFile=0x154, lpBuffer=0x1a2d490, nNumberOfBytesToRead=0x1e35, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a2d490*, lpNumberOfBytesRead=0x2ae4ec*=0x1e35, lpOverlapped=0x0) returned 1 [0087.622] CloseHandle (hObject=0x154) returned 1 [0087.643] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpFilePart=0x0) returned 0x54 [0087.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.645] GetFileType (hFile=0x154) returned 0x1 [0087.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.645] GetFileType (hFile=0x154) returned 0x1 [0087.645] WriteFile (in: hFile=0x154, lpBuffer=0x1a839bc*, nNumberOfBytesToWrite=0x1e40, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a839bc*, lpNumberOfBytesWritten=0x2ae4e0*=0x1e40, lpOverlapped=0x0) returned 1 [0087.646] CloseHandle (hObject=0x154) returned 1 [0087.646] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpFilePart=0x0) returned 0x54 [0087.646] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5e [0087.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.646] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe8500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8e5c9f30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd32ceb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e40)) returned 1 [0087.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.anonymous")) returned 1 [0087.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x58 [0087.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.648] GetFileType (hFile=0x154) returned 0x1 [0087.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.648] GetFileType (hFile=0x154) returned 0x1 [0087.648] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1938 [0087.648] ReadFile (in: hFile=0x154, lpBuffer=0x1a85d24, nNumberOfBytesToRead=0x1938, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a85d24*, lpNumberOfBytesRead=0x2ae4ec*=0x1938, lpOverlapped=0x0) returned 1 [0087.661] CloseHandle (hObject=0x154) returned 1 [0087.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x58 [0087.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.681] GetFileType (hFile=0x154) returned 0x1 [0087.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.681] GetFileType (hFile=0x154) returned 0x1 [0087.681] WriteFile (in: hFile=0x154, lpBuffer=0x1ada94c*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1ada94c*, lpNumberOfBytesWritten=0x2ae4e0*=0x1940, lpOverlapped=0x0) returned 1 [0087.683] CloseHandle (hObject=0x154) returned 1 [0087.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x58 [0087.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x62 [0087.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.683] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefb200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x81d64310, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3340fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0087.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.anonymous")) returned 1 [0087.685] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpFilePart=0x0) returned 0x52 [0087.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.685] GetFileType (hFile=0x154) returned 0x1 [0087.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.685] GetFileType (hFile=0x154) returned 0x1 [0087.685] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf8d [0087.685] ReadFile (in: hFile=0x154, lpBuffer=0x1add760, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1add760*, lpNumberOfBytesRead=0x2ae4ec*=0xf8d, lpOverlapped=0x0) returned 1 [0087.704] CloseHandle (hObject=0x154) returned 1 [0087.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpFilePart=0x0) returned 0x52 [0087.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.723] GetFileType (hFile=0x154) returned 0x1 [0087.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.723] GetFileType (hFile=0x154) returned 0x1 [0087.723] WriteFile (in: hFile=0x154, lpBuffer=0x1b30474*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b30474*, lpNumberOfBytesWritten=0x2ae4b4*=0xf90, lpOverlapped=0x0) returned 1 [0087.725] CloseHandle (hObject=0x154) returned 1 [0087.725] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpFilePart=0x0) returned 0x52 [0087.725] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5c [0087.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.725] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefb200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x81e229f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd33b33d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf90)) returned 1 [0087.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.anonymous")) returned 1 [0087.726] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpFilePart=0x0) returned 0x56 [0087.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.727] GetFileType (hFile=0x154) returned 0x1 [0087.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.727] GetFileType (hFile=0x154) returned 0x1 [0087.727] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xc0 [0087.727] ReadFile (in: hFile=0x154, lpBuffer=0x1b31900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b31900*, lpNumberOfBytesRead=0x2ae4ec*=0xc0, lpOverlapped=0x0) returned 1 [0087.729] CloseHandle (hObject=0x154) returned 1 [0087.746] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpFilePart=0x0) returned 0x56 [0087.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.748] GetFileType (hFile=0x154) returned 0x1 [0087.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.748] GetFileType (hFile=0x154) returned 0x1 [0087.748] WriteFile (in: hFile=0x154, lpBuffer=0x1b7fb24*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b7fb24*, lpNumberOfBytesWritten=0x2ae4b4*=0xd0, lpOverlapped=0x0) returned 1 [0087.750] CloseHandle (hObject=0x154) returned 1 [0087.750] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpFilePart=0x0) returned 0x56 [0087.750] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x60 [0087.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefb200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8f888c70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd33d9530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0087.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.anonymous")) returned 1 [0087.751] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0087.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.752] GetFileType (hFile=0x154) returned 0x1 [0087.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.752] GetFileType (hFile=0x154) returned 0x1 [0087.752] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5203 [0087.752] ReadFile (in: hFile=0x154, lpBuffer=0x1b80ef8, nNumberOfBytesToRead=0x5203, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b80ef8*, lpNumberOfBytesRead=0x2ae4ec*=0x5203, lpOverlapped=0x0) returned 1 [0087.762] CloseHandle (hObject=0x154) returned 1 [0087.814] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0087.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.815] GetFileType (hFile=0x154) returned 0x1 [0087.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.816] GetFileType (hFile=0x154) returned 0x1 [0087.816] WriteFile (in: hFile=0x154, lpBuffer=0x19eb614*, nNumberOfBytesToWrite=0x5210, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19eb614*, lpNumberOfBytesWritten=0x2ae4e0*=0x5210, lpOverlapped=0x0) returned 1 [0087.817] CloseHandle (hObject=0x154) returned 1 [0087.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0087.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5f [0087.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.818] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd8a500, ftCreationTime.dwHighDateTime=0x1ca0393, ftLastAccessTime.dwLowDateTime=0x81fc5910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3471ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5210)) returned 1 [0087.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.anonymous")) returned 1 [0087.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0087.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.821] GetFileType (hFile=0x154) returned 0x1 [0087.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.821] GetFileType (hFile=0x154) returned 0x1 [0087.821] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1238 [0087.821] ReadFile (in: hFile=0x154, lpBuffer=0x19f0d54, nNumberOfBytesToRead=0x1238, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19f0d54*, lpNumberOfBytesRead=0x2ae4ec*=0x1238, lpOverlapped=0x0) returned 1 [0087.834] CloseHandle (hObject=0x154) returned 1 [0087.846] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0087.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.850] GetFileType (hFile=0x154) returned 0x1 [0087.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.850] GetFileType (hFile=0x154) returned 0x1 [0087.850] WriteFile (in: hFile=0x154, lpBuffer=0x1a4367c*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a4367c*, lpNumberOfBytesWritten=0x2ae4e0*=0x1240, lpOverlapped=0x0) returned 1 [0087.851] CloseHandle (hObject=0x154) returned 1 [0087.851] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0087.851] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x63 [0087.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934f3d00, ftCreationTime.dwHighDateTime=0x1ca0393, ftLastAccessTime.dwLowDateTime=0x8fc67030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd34e3ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1240)) returned 1 [0087.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.anonymous")) returned 1 [0087.852] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpFilePart=0x0) returned 0x4b [0087.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.853] GetFileType (hFile=0x154) returned 0x1 [0087.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.853] GetFileType (hFile=0x154) returned 0x1 [0087.853] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xc1b [0087.853] ReadFile (in: hFile=0x154, lpBuffer=0x1a45a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a45a04*, lpNumberOfBytesRead=0x2ae4ec*=0xc1b, lpOverlapped=0x0) returned 1 [0087.866] CloseHandle (hObject=0x154) returned 1 [0087.879] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpFilePart=0x0) returned 0x4b [0087.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.896] GetFileType (hFile=0x154) returned 0x1 [0087.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.896] GetFileType (hFile=0x154) returned 0x1 [0087.896] WriteFile (in: hFile=0x154, lpBuffer=0x1a975d0*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a975d0*, lpNumberOfBytesWritten=0x2ae4b4*=0xc20, lpOverlapped=0x0) returned 1 [0087.899] CloseHandle (hObject=0x154) returned 1 [0087.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpFilePart=0x0) returned 0x4b [0087.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.anonymous", lpFilePart=0x0) returned 0x55 [0087.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefb200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8243c250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd35562f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc20)) returned 1 [0087.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.anonymous")) returned 1 [0087.900] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpFilePart=0x0) returned 0x4f [0087.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.901] GetFileType (hFile=0x154) returned 0x1 [0087.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.901] GetFileType (hFile=0x154) returned 0x1 [0087.901] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x838 [0087.901] ReadFile (in: hFile=0x154, lpBuffer=0x1a99188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a99188*, lpNumberOfBytesRead=0x2ae4ec*=0x838, lpOverlapped=0x0) returned 1 [0087.911] CloseHandle (hObject=0x154) returned 1 [0087.925] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpFilePart=0x0) returned 0x4f [0087.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.927] GetFileType (hFile=0x154) returned 0x1 [0087.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.927] GetFileType (hFile=0x154) returned 0x1 [0087.927] WriteFile (in: hFile=0x154, lpBuffer=0x1ae9a04*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1ae9a04*, lpNumberOfBytesWritten=0x2ae4b4*=0x840, lpOverlapped=0x0) returned 1 [0087.928] CloseHandle (hObject=0x154) returned 1 [0087.928] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpFilePart=0x0) returned 0x4f [0087.928] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.anonymous", lpFilePart=0x0) returned 0x59 [0087.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefb200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x903b1390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd35a25b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0087.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.anonymous")) returned 1 [0087.929] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpFilePart=0x0) returned 0x50 [0087.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.930] GetFileType (hFile=0x154) returned 0x1 [0087.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.930] GetFileType (hFile=0x154) returned 0x1 [0087.930] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x64fa [0087.930] ReadFile (in: hFile=0x154, lpBuffer=0x1aead94, nNumberOfBytesToRead=0x64fa, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aead94*, lpNumberOfBytesRead=0x2ae4ec*=0x64fa, lpOverlapped=0x0) returned 1 [0087.955] CloseHandle (hObject=0x154) returned 1 [0087.971] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpFilePart=0x0) returned 0x50 [0087.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0087.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.972] GetFileType (hFile=0x154) returned 0x1 [0087.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0087.973] GetFileType (hFile=0x154) returned 0x1 [0087.973] WriteFile (in: hFile=0x154, lpBuffer=0x1b57480*, nNumberOfBytesToWrite=0x6500, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b57480*, lpNumberOfBytesWritten=0x2ae4e0*=0x6500, lpOverlapped=0x0) returned 1 [0087.974] CloseHandle (hObject=0x154) returned 1 [0087.974] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpFilePart=0x0) returned 0x50 [0087.974] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.anonymous", lpFilePart=0x0) returned 0x5a [0087.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0087.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefb200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x82546bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd35ee870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6500)) returned 1 [0087.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0087.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.anonymous")) returned 1 [0087.975] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0087.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0087.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0087.975] GetFileType (hFile=0x154) returned 0x1 [0087.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0087.975] GetFileType (hFile=0x154) returned 0x1 [0087.975] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf38 [0087.976] ReadFile (in: hFile=0x154, lpBuffer=0x1b5edb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b5edb4*, lpNumberOfBytesRead=0x2ae4ec*=0xf38, lpOverlapped=0x0) returned 1 [0088.023] CloseHandle (hObject=0x154) returned 1 [0088.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0088.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.065] GetFileType (hFile=0x154) returned 0x1 [0088.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.065] GetFileType (hFile=0x154) returned 0x1 [0088.065] WriteFile (in: hFile=0x154, lpBuffer=0x19ad684*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19ad684*, lpNumberOfBytesWritten=0x2ae4b4*=0xf40, lpOverlapped=0x0) returned 1 [0088.066] CloseHandle (hObject=0x154) returned 1 [0088.066] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0088.066] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x5e [0088.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.066] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x82546bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd36d30b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0088.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.anonymous")) returned 1 [0088.067] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpFilePart=0x0) returned 0x50 [0088.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.067] GetFileType (hFile=0x154) returned 0x1 [0088.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.067] GetFileType (hFile=0x154) returned 0x1 [0088.067] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1963 [0088.068] ReadFile (in: hFile=0x154, lpBuffer=0x19aea38, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19aea38*, lpNumberOfBytesRead=0x2ae4ec*=0x1963, lpOverlapped=0x0) returned 1 [0088.070] CloseHandle (hObject=0x154) returned 1 [0088.082] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpFilePart=0x0) returned 0x50 [0088.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.083] GetFileType (hFile=0x154) returned 0x1 [0088.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.083] GetFileType (hFile=0x154) returned 0x1 [0088.083] WriteFile (in: hFile=0x154, lpBuffer=0x1a03754*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a03754*, lpNumberOfBytesWritten=0x2ae4e0*=0x1970, lpOverlapped=0x0) returned 1 [0088.085] CloseHandle (hObject=0x154) returned 1 [0088.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpFilePart=0x0) returned 0x50 [0088.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.anonymous", lpFilePart=0x0) returned 0x5a [0088.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.085] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x82546bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd371f370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1970)) returned 1 [0088.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.anonymous")) returned 1 [0088.086] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0088.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.086] GetFileType (hFile=0x154) returned 0x1 [0088.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.086] GetFileType (hFile=0x154) returned 0x1 [0088.086] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1638 [0088.086] ReadFile (in: hFile=0x154, lpBuffer=0x1a055b4, nNumberOfBytesToRead=0x1638, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a055b4*, lpNumberOfBytesRead=0x2ae4ec*=0x1638, lpOverlapped=0x0) returned 1 [0088.088] CloseHandle (hObject=0x154) returned 1 [0088.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0088.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.101] GetFileType (hFile=0x154) returned 0x1 [0088.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.101] GetFileType (hFile=0x154) returned 0x1 [0088.102] WriteFile (in: hFile=0x154, lpBuffer=0x1a592dc*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a592dc*, lpNumberOfBytesWritten=0x2ae4e0*=0x1640, lpOverlapped=0x0) returned 1 [0088.103] CloseHandle (hObject=0x154) returned 1 [0088.103] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0088.103] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x5e [0088.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.103] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x82546bf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd37454d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1640)) returned 1 [0088.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.anonymous")) returned 1 [0088.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpFilePart=0x0) returned 0x4f [0088.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.104] GetFileType (hFile=0x154) returned 0x1 [0088.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.104] GetFileType (hFile=0x154) returned 0x1 [0088.104] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2d38 [0088.104] ReadFile (in: hFile=0x154, lpBuffer=0x1a5ae20, nNumberOfBytesToRead=0x2d38, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a5ae20*, lpNumberOfBytesRead=0x2ae4ec*=0x2d38, lpOverlapped=0x0) returned 1 [0088.146] CloseHandle (hObject=0x154) returned 1 [0088.158] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpFilePart=0x0) returned 0x4f [0088.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.160] GetFileType (hFile=0x154) returned 0x1 [0088.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.160] GetFileType (hFile=0x154) returned 0x1 [0088.160] WriteFile (in: hFile=0x154, lpBuffer=0x1ab5e48*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1ab5e48*, lpNumberOfBytesWritten=0x2ae4e0*=0x2d40, lpOverlapped=0x0) returned 1 [0088.161] CloseHandle (hObject=0x154) returned 1 [0088.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpFilePart=0x0) returned 0x4f [0088.162] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.anonymous", lpFilePart=0x0) returned 0x59 [0088.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.162] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8256cd50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd37dda50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d40)) returned 1 [0088.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.anonymous")) returned 1 [0088.163] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpFilePart=0x0) returned 0x4f [0088.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.173] GetFileType (hFile=0x154) returned 0x1 [0088.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.173] GetFileType (hFile=0x154) returned 0x1 [0088.173] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xd97 [0088.173] ReadFile (in: hFile=0x154, lpBuffer=0x1ab9df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ab9df8*, lpNumberOfBytesRead=0x2ae4ec*=0xd97, lpOverlapped=0x0) returned 1 [0088.215] CloseHandle (hObject=0x154) returned 1 [0088.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpFilePart=0x0) returned 0x4f [0088.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.230] GetFileType (hFile=0x154) returned 0x1 [0088.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.230] GetFileType (hFile=0x154) returned 0x1 [0088.230] WriteFile (in: hFile=0x154, lpBuffer=0x1b0c158*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b0c158*, lpNumberOfBytesWritten=0x2ae4b4*=0xda0, lpOverlapped=0x0) returned 1 [0088.231] CloseHandle (hObject=0x154) returned 1 [0088.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpFilePart=0x0) returned 0x4f [0088.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.anonymous", lpFilePart=0x0) returned 0x59 [0088.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.231] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x905c66d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3875fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xda0)) returned 1 [0088.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.anonymous")) returned 1 [0088.232] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpFilePart=0x0) returned 0x53 [0088.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.425] GetFileType (hFile=0x154) returned 0x1 [0088.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.425] GetFileType (hFile=0x154) returned 0x1 [0088.425] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5a4 [0088.426] ReadFile (in: hFile=0x154, lpBuffer=0x1b0daa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b0daa4*, lpNumberOfBytesRead=0x2ae4ec*=0x5a4, lpOverlapped=0x0) returned 1 [0088.830] CloseHandle (hObject=0x154) returned 1 [0088.843] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpFilePart=0x0) returned 0x53 [0088.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.846] GetFileType (hFile=0x154) returned 0x1 [0088.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.846] GetFileType (hFile=0x154) returned 0x1 [0088.846] WriteFile (in: hFile=0x154, lpBuffer=0x1b5d664*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b5d664*, lpNumberOfBytesWritten=0x2ae4b4*=0x5b0, lpOverlapped=0x0) returned 1 [0088.849] CloseHandle (hObject=0x154) returned 1 [0088.849] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpFilePart=0x0) returned 0x53 [0088.849] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.anonymous", lpFilePart=0x0) returned 0x5d [0088.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.849] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8269d850, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3e696d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0088.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.anonymous")) returned 1 [0088.850] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpFilePart=0x0) returned 0x47 [0088.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.850] GetFileType (hFile=0x154) returned 0x1 [0088.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.850] GetFileType (hFile=0x154) returned 0x1 [0088.850] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xd14 [0088.850] ReadFile (in: hFile=0x154, lpBuffer=0x1b5f708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b5f708*, lpNumberOfBytesRead=0x2ae4ec*=0xd14, lpOverlapped=0x0) returned 1 [0088.864] CloseHandle (hObject=0x154) returned 1 [0088.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpFilePart=0x0) returned 0x47 [0088.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.921] GetFileType (hFile=0x154) returned 0x1 [0088.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.921] GetFileType (hFile=0x154) returned 0x1 [0088.921] WriteFile (in: hFile=0x154, lpBuffer=0x19b1588*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19b1588*, lpNumberOfBytesWritten=0x2ae4b4*=0xd20, lpOverlapped=0x0) returned 1 [0088.922] CloseHandle (hObject=0x154) returned 1 [0088.922] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpFilePart=0x0) returned 0x47 [0088.922] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.anonymous", lpFilePart=0x0) returned 0x51 [0088.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x826e9b10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3f01c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd20)) returned 1 [0088.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.anonymous")) returned 1 [0088.923] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpFilePart=0x0) returned 0x4b [0088.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.923] GetFileType (hFile=0x154) returned 0x1 [0088.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.923] GetFileType (hFile=0x154) returned 0x1 [0088.923] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x838 [0088.923] ReadFile (in: hFile=0x154, lpBuffer=0x19b3118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19b3118*, lpNumberOfBytesRead=0x2ae4ec*=0x838, lpOverlapped=0x0) returned 1 [0088.932] CloseHandle (hObject=0x154) returned 1 [0088.955] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpFilePart=0x0) returned 0x4b [0088.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.956] GetFileType (hFile=0x154) returned 0x1 [0088.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0088.956] GetFileType (hFile=0x154) returned 0x1 [0088.956] WriteFile (in: hFile=0x154, lpBuffer=0x1a03984*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a03984*, lpNumberOfBytesWritten=0x2ae4b4*=0x840, lpOverlapped=0x0) returned 1 [0088.957] CloseHandle (hObject=0x154) returned 1 [0088.957] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpFilePart=0x0) returned 0x4b [0088.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.anonymous", lpFilePart=0x0) returned 0x55 [0088.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0088.958] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20df00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x826e9b10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3f74070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0088.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0088.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.anonymous")) returned 1 [0088.959] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpFilePart=0x0) returned 0x59 [0088.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0088.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0088.967] GetFileType (hFile=0x154) returned 0x1 [0088.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0088.967] GetFileType (hFile=0x154) returned 0x1 [0088.967] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf38 [0088.967] ReadFile (in: hFile=0x154, lpBuffer=0x1a05c64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a05c64*, lpNumberOfBytesRead=0x2ae4ec*=0xf38, lpOverlapped=0x0) returned 1 [0088.980] CloseHandle (hObject=0x154) returned 1 [0088.999] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpFilePart=0x0) returned 0x59 [0088.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0088.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.002] GetFileType (hFile=0x154) returned 0x1 [0089.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.002] GetFileType (hFile=0x154) returned 0x1 [0089.002] WriteFile (in: hFile=0x154, lpBuffer=0x1a58808*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a58808*, lpNumberOfBytesWritten=0x2ae4b4*=0xf40, lpOverlapped=0x0) returned 1 [0089.006] CloseHandle (hObject=0x154) returned 1 [0089.007] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpFilePart=0x0) returned 0x59 [0089.007] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.anonymous", lpFilePart=0x0) returned 0x63 [0089.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.007] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28a2a00, ftCreationTime.dwHighDateTime=0x1ca0ba9, ftLastAccessTime.dwLowDateTime=0x82782090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd3fe6490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0089.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.anonymous")) returned 1 [0089.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpFilePart=0x0) returned 0x5d [0089.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.008] GetFileType (hFile=0x154) returned 0x1 [0089.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.008] GetFileType (hFile=0x154) returned 0x1 [0089.008] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x540 [0089.008] ReadFile (in: hFile=0x154, lpBuffer=0x1a5a154, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a5a154*, lpNumberOfBytesRead=0x2ae4ec*=0x540, lpOverlapped=0x0) returned 1 [0089.021] CloseHandle (hObject=0x154) returned 1 [0089.034] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpFilePart=0x0) returned 0x5d [0089.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.035] GetFileType (hFile=0x154) returned 0x1 [0089.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.035] GetFileType (hFile=0x154) returned 0x1 [0089.035] WriteFile (in: hFile=0x154, lpBuffer=0x1aa9b60*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1aa9b60*, lpNumberOfBytesWritten=0x2ae4b4*=0x550, lpOverlapped=0x0) returned 1 [0089.036] CloseHandle (hObject=0x154) returned 1 [0089.037] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpFilePart=0x0) returned 0x5d [0089.037] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.anonymous", lpFilePart=0x0) returned 0x67 [0089.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.037] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2097300, ftCreationTime.dwHighDateTime=0x1ca0baa, ftLastAccessTime.dwLowDateTime=0x82782090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4032750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0089.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.anonymous")) returned 1 [0089.038] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpFilePart=0x0) returned 0x48 [0089.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.038] GetFileType (hFile=0x154) returned 0x1 [0089.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.038] GetFileType (hFile=0x154) returned 0x1 [0089.038] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2605 [0089.039] ReadFile (in: hFile=0x154, lpBuffer=0x1aaaf24, nNumberOfBytesToRead=0x2605, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aaaf24*, lpNumberOfBytesRead=0x2ae4ec*=0x2605, lpOverlapped=0x0) returned 1 [0089.113] CloseHandle (hObject=0x154) returned 1 [0089.125] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpFilePart=0x0) returned 0x48 [0089.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.127] GetFileType (hFile=0x154) returned 0x1 [0089.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.127] GetFileType (hFile=0x154) returned 0x1 [0089.127] WriteFile (in: hFile=0x154, lpBuffer=0x1b03b60*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b03b60*, lpNumberOfBytesWritten=0x2ae4e0*=0x2610, lpOverlapped=0x0) returned 1 [0089.128] CloseHandle (hObject=0x154) returned 1 [0089.128] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpFilePart=0x0) returned 0x48 [0089.128] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.anonymous", lpFilePart=0x0) returned 0x52 [0089.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.129] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf520c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9078f750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd40f0e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2610)) returned 1 [0089.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.anonymous")) returned 1 [0089.130] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpFilePart=0x0) returned 0x4c [0089.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.130] GetFileType (hFile=0x154) returned 0x1 [0089.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.131] GetFileType (hFile=0x154) returned 0x1 [0089.131] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x838 [0089.131] ReadFile (in: hFile=0x154, lpBuffer=0x1b06e34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b06e34*, lpNumberOfBytesRead=0x2ae4ec*=0x838, lpOverlapped=0x0) returned 1 [0089.196] CloseHandle (hObject=0x154) returned 1 [0089.209] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpFilePart=0x0) returned 0x4c [0089.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.210] GetFileType (hFile=0x154) returned 0x1 [0089.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.210] GetFileType (hFile=0x154) returned 0x1 [0089.210] WriteFile (in: hFile=0x154, lpBuffer=0x1b576a4*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b576a4*, lpNumberOfBytesWritten=0x2ae4b4*=0x840, lpOverlapped=0x0) returned 1 [0089.211] CloseHandle (hObject=0x154) returned 1 [0089.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpFilePart=0x0) returned 0x4c [0089.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x56 [0089.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.211] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf520c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9078f750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd41d5670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0089.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.anonymous")) returned 1 [0089.212] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpFilePart=0x0) returned 0x4b [0089.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.213] GetFileType (hFile=0x154) returned 0x1 [0089.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.213] GetFileType (hFile=0x154) returned 0x1 [0089.213] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x450 [0089.213] ReadFile (in: hFile=0x154, lpBuffer=0x1b58e70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b58e70*, lpNumberOfBytesRead=0x2ae4ec*=0x450, lpOverlapped=0x0) returned 1 [0089.248] CloseHandle (hObject=0x154) returned 1 [0089.287] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpFilePart=0x0) returned 0x4b [0089.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.289] GetFileType (hFile=0x154) returned 0x1 [0089.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.289] GetFileType (hFile=0x154) returned 0x1 [0089.289] WriteFile (in: hFile=0x154, lpBuffer=0x19a7b00*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19a7b00*, lpNumberOfBytesWritten=0x2ae4b4*=0x460, lpOverlapped=0x0) returned 1 [0089.290] CloseHandle (hObject=0x154) returned 1 [0089.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpFilePart=0x0) returned 0x4b [0089.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.anonymous", lpFilePart=0x0) returned 0x55 [0089.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.290] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10833900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x92230d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4293d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0089.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.anonymous")) returned 1 [0089.291] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpFilePart=0x0) returned 0x50 [0089.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.291] GetFileType (hFile=0x154) returned 0x1 [0089.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.292] GetFileType (hFile=0x154) returned 0x1 [0089.292] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5431 [0089.292] ReadFile (in: hFile=0x154, lpBuffer=0x19a8e78, nNumberOfBytesToRead=0x5431, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19a8e78*, lpNumberOfBytesRead=0x2ae4ec*=0x5431, lpOverlapped=0x0) returned 1 [0089.312] CloseHandle (hObject=0x154) returned 1 [0089.324] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpFilePart=0x0) returned 0x50 [0089.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.326] GetFileType (hFile=0x154) returned 0x1 [0089.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.326] GetFileType (hFile=0x154) returned 0x1 [0089.326] WriteFile (in: hFile=0x154, lpBuffer=0x1a101a4*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a101a4*, lpNumberOfBytesWritten=0x2ae4e0*=0x5440, lpOverlapped=0x0) returned 1 [0089.327] CloseHandle (hObject=0x154) returned 1 [0089.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpFilePart=0x0) returned 0x50 [0089.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5a [0089.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.327] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25efdc00, ftCreationTime.dwHighDateTime=0x1ca0394, ftLastAccessTime.dwLowDateTime=0x923d3c90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd42e0010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5440)) returned 1 [0089.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.anonymous")) returned 1 [0089.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0089.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.328] GetFileType (hFile=0x154) returned 0x1 [0089.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.328] GetFileType (hFile=0x154) returned 0x1 [0089.328] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1538 [0089.328] ReadFile (in: hFile=0x154, lpBuffer=0x1a15ad4, nNumberOfBytesToRead=0x1538, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a15ad4*, lpNumberOfBytesRead=0x2ae4ec*=0x1538, lpOverlapped=0x0) returned 1 [0089.345] CloseHandle (hObject=0x154) returned 1 [0089.356] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0089.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.357] GetFileType (hFile=0x154) returned 0x1 [0089.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.358] GetFileType (hFile=0x154) returned 0x1 [0089.358] WriteFile (in: hFile=0x154, lpBuffer=0x1a692fc*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a692fc*, lpNumberOfBytesWritten=0x2ae4e0*=0x1540, lpOverlapped=0x0) returned 1 [0089.359] CloseHandle (hObject=0x154) returned 1 [0089.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x54 [0089.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x5e [0089.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.359] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d97a100, ftCreationTime.dwHighDateTime=0x1ca0394, ftLastAccessTime.dwLowDateTime=0x923d3c90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd432c2d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1540)) returned 1 [0089.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.anonymous")) returned 1 [0089.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpFilePart=0x0) returned 0x51 [0089.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.385] GetFileType (hFile=0x154) returned 0x1 [0089.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.385] GetFileType (hFile=0x154) returned 0x1 [0089.385] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1995 [0089.385] ReadFile (in: hFile=0x154, lpBuffer=0x1a6ad48, nNumberOfBytesToRead=0x1995, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a6ad48*, lpNumberOfBytesRead=0x2ae4ec*=0x1995, lpOverlapped=0x0) returned 1 [0089.415] CloseHandle (hObject=0x154) returned 1 [0089.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpFilePart=0x0) returned 0x51 [0089.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.428] GetFileType (hFile=0x154) returned 0x1 [0089.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.428] GetFileType (hFile=0x154) returned 0x1 [0089.428] WriteFile (in: hFile=0x154, lpBuffer=0x1abfb54*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1abfb54*, lpNumberOfBytesWritten=0x2ae4e0*=0x19a0, lpOverlapped=0x0) returned 1 [0089.429] CloseHandle (hObject=0x154) returned 1 [0089.429] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpFilePart=0x0) returned 0x51 [0089.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0089.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.430] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10833900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x85319370, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd43ea9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19a0)) returned 1 [0089.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.anonymous")) returned 1 [0089.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpFilePart=0x0) returned 0x55 [0089.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.430] GetFileType (hFile=0x154) returned 0x1 [0089.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.431] GetFileType (hFile=0x154) returned 0x1 [0089.431] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x838 [0089.431] ReadFile (in: hFile=0x154, lpBuffer=0x1ac2230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ac2230*, lpNumberOfBytesRead=0x2ae4ec*=0x838, lpOverlapped=0x0) returned 1 [0089.432] CloseHandle (hObject=0x154) returned 1 [0089.444] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpFilePart=0x0) returned 0x55 [0089.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.445] GetFileType (hFile=0x154) returned 0x1 [0089.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.445] GetFileType (hFile=0x154) returned 0x1 [0089.445] WriteFile (in: hFile=0x154, lpBuffer=0x1b12ac4*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b12ac4*, lpNumberOfBytesWritten=0x2ae4b4*=0x840, lpOverlapped=0x0) returned 1 [0089.446] CloseHandle (hObject=0x154) returned 1 [0089.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpFilePart=0x0) returned 0x55 [0089.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.anonymous", lpFilePart=0x0) returned 0x5f [0089.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10833900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x923d3c90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4410b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0089.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.anonymous")) returned 1 [0089.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0089.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.448] GetFileType (hFile=0x154) returned 0x1 [0089.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.448] GetFileType (hFile=0x154) returned 0x1 [0089.448] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2308 [0089.448] ReadFile (in: hFile=0x154, lpBuffer=0x1b13e8c, nNumberOfBytesToRead=0x2308, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b13e8c*, lpNumberOfBytesRead=0x2ae4ec*=0x2308, lpOverlapped=0x0) returned 1 [0089.480] CloseHandle (hObject=0x154) returned 1 [0089.491] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0089.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.493] GetFileType (hFile=0x154) returned 0x1 [0089.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.493] GetFileType (hFile=0x154) returned 0x1 [0089.493] WriteFile (in: hFile=0x154, lpBuffer=0x1b6bbc4*, nNumberOfBytesToWrite=0x2310, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b6bbc4*, lpNumberOfBytesWritten=0x2ae4e0*=0x2310, lpOverlapped=0x0) returned 1 [0089.494] CloseHandle (hObject=0x154) returned 1 [0089.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpFilePart=0x0) returned 0x55 [0089.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x5f [0089.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.494] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b46600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8538b790, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4482f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2310)) returned 1 [0089.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.anonymous")) returned 1 [0089.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0089.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0089.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.496] GetFileType (hFile=0x154) returned 0x1 [0089.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0089.496] GetFileType (hFile=0x154) returned 0x1 [0089.496] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x638 [0089.496] ReadFile (in: hFile=0x154, lpBuffer=0x1b6ea48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b6ea48*, lpNumberOfBytesRead=0x2ae4ec*=0x638, lpOverlapped=0x0) returned 1 [0089.510] CloseHandle (hObject=0x154) returned 1 [0089.545] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0089.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0089.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.546] GetFileType (hFile=0x154) returned 0x1 [0089.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0089.546] GetFileType (hFile=0x154) returned 0x1 [0089.547] WriteFile (in: hFile=0x154, lpBuffer=0x19bea78*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19bea78*, lpNumberOfBytesWritten=0x2ae4b4*=0x640, lpOverlapped=0x0) returned 1 [0089.548] CloseHandle (hObject=0x154) returned 1 [0089.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x59 [0089.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x63 [0089.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0089.548] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b46600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x924b84d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd44f5350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0089.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.anonymous")) returned 1 [0089.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0089.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData", lpFilePart=0x0) returned 0x3a [0089.549] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", lpFilePart=0x0) returned 0x3b [0089.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0089.549] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0089.550] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0089.550] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0089.550] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0089.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0089.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0089.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0089.550] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData", lpFilePart=0x0) returned 0x3a [0089.550] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", lpFilePart=0x0) returned 0x3b [0089.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0089.550] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0089.551] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0089.551] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0089.551] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0089.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0089.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0089.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0089.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net", lpFilePart=0x0) returned 0x45 [0089.551] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpFilePart=0x0) returned 0x46 [0089.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0089.573] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.574] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.575] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.575] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.575] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.575] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.575] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0089.575] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0089.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0089.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0089.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net", lpFilePart=0x0) returned 0x45 [0089.576] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpFilePart=0x0) returned 0x46 [0089.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0089.577] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.577] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.577] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.578] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0089.579] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0089.579] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0089.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0089.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0089.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0089.580] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar", lpFilePart=0x0) returned 0x4e [0089.580] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpFilePart=0x0) returned 0x4f [0089.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0089.623] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.623] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.623] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.623] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.624] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.624] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.624] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0089.624] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0089.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0089.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0089.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0089.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar", lpFilePart=0x0) returned 0x4e [0089.625] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpFilePart=0x0) returned 0x4f [0089.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0089.626] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.626] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.627] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.627] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.627] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.627] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.627] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0089.627] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0089.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0089.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0089.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpFilePart=0x0) returned 0x69 [0089.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0089.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.629] GetFileType (hFile=0x154) returned 0x1 [0089.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0089.629] GetFileType (hFile=0x154) returned 0x1 [0089.629] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3424 [0089.629] ReadFile (in: hFile=0x154, lpBuffer=0x19c87bc, nNumberOfBytesToRead=0x3424, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c87bc*, lpNumberOfBytesRead=0x2ae404*=0x3424, lpOverlapped=0x0) returned 1 [0089.631] CloseHandle (hObject=0x154) returned 1 [0089.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpFilePart=0x0) returned 0x69 [0089.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0089.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.652] GetFileType (hFile=0x154) returned 0x1 [0089.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0089.652] GetFileType (hFile=0x154) returned 0x1 [0089.652] WriteFile (in: hFile=0x154, lpBuffer=0x1a25a94*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a25a94*, lpNumberOfBytesWritten=0x2ae3f8*=0x3430, lpOverlapped=0x0) returned 1 [0089.653] CloseHandle (hObject=0x154) returned 1 [0089.653] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpFilePart=0x0) returned 0x69 [0089.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x73 [0089.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0089.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59eb0000, ftCreationTime.dwHighDateTime=0x1ca046d, ftLastAccessTime.dwLowDateTime=0x86b7f4f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd45ffcf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3430)) returned 1 [0089.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0089.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.anonymous")) returned 1 [0089.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x6d [0089.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0089.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.655] GetFileType (hFile=0x154) returned 0x1 [0089.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0089.655] GetFileType (hFile=0x154) returned 0x1 [0089.655] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc38 [0089.655] ReadFile (in: hFile=0x154, lpBuffer=0x1a2a100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a2a100*, lpNumberOfBytesRead=0x2ae404*=0xc38, lpOverlapped=0x0) returned 1 [0089.667] CloseHandle (hObject=0x154) returned 1 [0089.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x6d [0089.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0089.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.684] GetFileType (hFile=0x154) returned 0x1 [0089.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0089.684] GetFileType (hFile=0x154) returned 0x1 [0089.684] WriteFile (in: hFile=0x154, lpBuffer=0x1a7bdcc*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a7bdcc*, lpNumberOfBytesWritten=0x2ae3cc*=0xc40, lpOverlapped=0x0) returned 1 [0089.685] CloseHandle (hObject=0x154) returned 1 [0089.685] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x6d [0089.685] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x77 [0089.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0089.685] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50619800, ftCreationTime.dwHighDateTime=0x1ca046d, ftLastAccessTime.dwLowDateTime=0x76dfcdf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd464bfb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc40)) returned 1 [0089.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0089.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.anonymous")) returned 1 [0089.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpFilePart=0x0) returned 0x6b [0089.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0089.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.686] GetFileType (hFile=0x154) returned 0x1 [0089.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0089.686] GetFileType (hFile=0x154) returned 0x1 [0089.686] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3fa2 [0089.686] ReadFile (in: hFile=0x154, lpBuffer=0x1a7d254, nNumberOfBytesToRead=0x3fa2, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a7d254*, lpNumberOfBytesRead=0x2ae404*=0x3fa2, lpOverlapped=0x0) returned 1 [0089.688] CloseHandle (hObject=0x154) returned 1 [0089.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpFilePart=0x0) returned 0x6b [0089.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0089.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.702] GetFileType (hFile=0x154) returned 0x1 [0089.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0089.702] GetFileType (hFile=0x154) returned 0x1 [0089.702] WriteFile (in: hFile=0x154, lpBuffer=0x1addeb0*, nNumberOfBytesToWrite=0x3fb0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1addeb0*, lpNumberOfBytesWritten=0x2ae3f8*=0x3fb0, lpOverlapped=0x0) returned 1 [0089.703] CloseHandle (hObject=0x154) returned 1 [0089.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpFilePart=0x0) returned 0x6b [0089.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.anonymous", lpFilePart=0x0) returned 0x75 [0089.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0089.704] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b46600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b7f4f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4672110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3fb0)) returned 1 [0089.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0089.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.anonymous")) returned 1 [0089.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpFilePart=0x0) returned 0x63 [0089.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0089.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.705] GetFileType (hFile=0x154) returned 0x1 [0089.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0089.705] GetFileType (hFile=0x154) returned 0x1 [0089.705] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1b49 [0089.705] ReadFile (in: hFile=0x154, lpBuffer=0x1ae2444, nNumberOfBytesToRead=0x1b49, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ae2444*, lpNumberOfBytesRead=0x2ae404*=0x1b49, lpOverlapped=0x0) returned 1 [0089.737] CloseHandle (hObject=0x154) returned 1 [0089.756] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpFilePart=0x0) returned 0x63 [0089.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0089.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.758] GetFileType (hFile=0x154) returned 0x1 [0089.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0089.758] GetFileType (hFile=0x154) returned 0x1 [0089.758] WriteFile (in: hFile=0x154, lpBuffer=0x1b37ac0*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b37ac0*, lpNumberOfBytesWritten=0x2ae3f8*=0x1b50, lpOverlapped=0x0) returned 1 [0089.759] CloseHandle (hObject=0x154) returned 1 [0089.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpFilePart=0x0) returned 0x63 [0089.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.anonymous", lpFilePart=0x0) returned 0x6d [0089.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0089.760] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b46600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8872b4b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd470a690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b50)) returned 1 [0089.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0089.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.anonymous")) returned 1 [0089.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpFilePart=0x0) returned 0x67 [0089.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0089.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.761] GetFileType (hFile=0x154) returned 0x1 [0089.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0089.761] GetFileType (hFile=0x154) returned 0x1 [0089.761] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x778 [0089.761] ReadFile (in: hFile=0x154, lpBuffer=0x1b3a338, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3a338*, lpNumberOfBytesRead=0x2ae404*=0x778, lpOverlapped=0x0) returned 1 [0089.770] CloseHandle (hObject=0x154) returned 1 [0089.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpFilePart=0x0) returned 0x67 [0089.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0089.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.791] GetFileType (hFile=0x154) returned 0x1 [0089.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0089.791] GetFileType (hFile=0x154) returned 0x1 [0089.791] WriteFile (in: hFile=0x154, lpBuffer=0x1b8a82c*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b8a82c*, lpNumberOfBytesWritten=0x2ae3cc*=0x780, lpOverlapped=0x0) returned 1 [0089.793] CloseHandle (hObject=0x154) returned 1 [0089.793] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpFilePart=0x0) returned 0x67 [0089.793] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x71 [0089.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0089.793] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b46600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77ef2ab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4756950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x780)) returned 1 [0089.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0089.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.anonymous")) returned 1 [0089.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0089.794] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData", lpFilePart=0x0) returned 0x50 [0089.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpFilePart=0x0) returned 0x51 [0089.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0089.832] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.931] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.931] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.931] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.932] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.933] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.934] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.935] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.935] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.935] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.935] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0089.935] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0089.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0089.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0089.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0089.940] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData", lpFilePart=0x0) returned 0x50 [0089.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpFilePart=0x0) returned 0x51 [0089.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0089.941] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.942] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.942] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.942] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.942] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.942] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.942] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.943] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.943] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.943] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.943] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.943] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.943] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.944] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.944] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.944] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.944] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.944] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.944] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.945] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.945] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.945] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.945] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.945] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.945] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.946] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.946] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.946] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.946] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.946] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0089.946] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0089.946] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0089.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0089.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0089.948] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpFilePart=0x0) returned 0x64 [0089.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0089.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0089.949] GetFileType (hFile=0x154) returned 0x1 [0089.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0089.949] GetFileType (hFile=0x154) returned 0x1 [0089.949] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x44c9 [0089.949] ReadFile (in: hFile=0x154, lpBuffer=0x1997950, nNumberOfBytesToRead=0x44c9, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1997950*, lpNumberOfBytesRead=0x2ae404*=0x44c9, lpOverlapped=0x0) returned 1 [0090.072] CloseHandle (hObject=0x154) returned 1 [0090.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpFilePart=0x0) returned 0x64 [0090.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.123] GetFileType (hFile=0x154) returned 0x1 [0090.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.123] GetFileType (hFile=0x154) returned 0x1 [0090.123] WriteFile (in: hFile=0x154, lpBuffer=0x19f9f4c*, nNumberOfBytesToWrite=0x44d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19f9f4c*, lpNumberOfBytesWritten=0x2ae3f8*=0x44d0, lpOverlapped=0x0) returned 1 [0090.125] CloseHandle (hObject=0x154) returned 1 [0090.125] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpFilePart=0x0) returned 0x64 [0090.125] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.anonymous", lpFilePart=0x0) returned 0x6e [0090.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.125] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf874c700, ftCreationTime.dwHighDateTime=0x1c9602c, ftLastAccessTime.dwLowDateTime=0x76640670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4a76630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x44d0)) returned 1 [0090.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.anonymous")) returned 1 [0090.126] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpFilePart=0x0) returned 0x68 [0090.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.127] GetFileType (hFile=0x154) returned 0x1 [0090.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.127] GetFileType (hFile=0x154) returned 0x1 [0090.127] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c6e [0090.127] ReadFile (in: hFile=0x154, lpBuffer=0x19fe9cc, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fe9cc*, lpNumberOfBytesRead=0x2ae404*=0x1c6e, lpOverlapped=0x0) returned 1 [0090.274] CloseHandle (hObject=0x154) returned 1 [0090.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpFilePart=0x0) returned 0x68 [0090.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.287] GetFileType (hFile=0x154) returned 0x1 [0090.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.287] GetFileType (hFile=0x154) returned 0x1 [0090.287] WriteFile (in: hFile=0x154, lpBuffer=0x1a545e8*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a545e8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0090.288] CloseHandle (hObject=0x154) returned 1 [0090.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpFilePart=0x0) returned 0x68 [0090.288] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.anonymous", lpFilePart=0x0) returned 0x72 [0090.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.288] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c5bf00, ftCreationTime.dwHighDateTime=0x1c9602c, ftLastAccessTime.dwLowDateTime=0x76640670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4c19550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0090.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.anonymous")) returned 1 [0090.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpFilePart=0x0) returned 0x6b [0090.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.289] GetFileType (hFile=0x154) returned 0x1 [0090.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.289] GetFileType (hFile=0x154) returned 0x1 [0090.289] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3356 [0090.289] ReadFile (in: hFile=0x154, lpBuffer=0x1a5683c, nNumberOfBytesToRead=0x3356, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5683c*, lpNumberOfBytesRead=0x2ae404*=0x3356, lpOverlapped=0x0) returned 1 [0090.319] CloseHandle (hObject=0x154) returned 1 [0090.331] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpFilePart=0x0) returned 0x6b [0090.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.332] GetFileType (hFile=0x154) returned 0x1 [0090.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.332] GetFileType (hFile=0x154) returned 0x1 [0090.332] WriteFile (in: hFile=0x154, lpBuffer=0x1ab3708*, nNumberOfBytesToWrite=0x3360, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ab3708*, lpNumberOfBytesWritten=0x2ae3f8*=0x3360, lpOverlapped=0x0) returned 1 [0090.333] CloseHandle (hObject=0x154) returned 1 [0090.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpFilePart=0x0) returned 0x6b [0090.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.anonymous", lpFilePart=0x0) returned 0x75 [0090.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.334] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e59300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4c8b970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3360)) returned 1 [0090.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.anonymous")) returned 1 [0090.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpFilePart=0x0) returned 0x6f [0090.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.369] GetFileType (hFile=0x154) returned 0x1 [0090.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.369] GetFileType (hFile=0x154) returned 0x1 [0090.369] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c70 [0090.369] ReadFile (in: hFile=0x154, lpBuffer=0x1ab7074, nNumberOfBytesToRead=0x1c70, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab7074*, lpNumberOfBytesRead=0x2ae404*=0x1c70, lpOverlapped=0x0) returned 1 [0090.385] CloseHandle (hObject=0x154) returned 1 [0090.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpFilePart=0x0) returned 0x6f [0090.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.398] GetFileType (hFile=0x154) returned 0x1 [0090.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.398] GetFileType (hFile=0x154) returned 0x1 [0090.398] WriteFile (in: hFile=0x154, lpBuffer=0x1b0ccdc*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b0ccdc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c80, lpOverlapped=0x0) returned 1 [0090.399] CloseHandle (hObject=0x154) returned 1 [0090.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpFilePart=0x0) returned 0x6f [0090.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.anonymous", lpFilePart=0x0) returned 0x79 [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.400] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e59300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4d23ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c80)) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.anonymous")) returned 1 [0090.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpFilePart=0x0) returned 0x6a [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.400] GetFileType (hFile=0x154) returned 0x1 [0090.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.401] GetFileType (hFile=0x154) returned 0x1 [0090.401] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2f79 [0090.401] ReadFile (in: hFile=0x154, lpBuffer=0x1b0ef7c, nNumberOfBytesToRead=0x2f79, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b0ef7c*, lpNumberOfBytesRead=0x2ae404*=0x2f79, lpOverlapped=0x0) returned 1 [0090.424] CloseHandle (hObject=0x154) returned 1 [0090.436] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpFilePart=0x0) returned 0x6a [0090.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.438] GetFileType (hFile=0x154) returned 0x1 [0090.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.438] GetFileType (hFile=0x154) returned 0x1 [0090.438] WriteFile (in: hFile=0x154, lpBuffer=0x1b6aae8*, nNumberOfBytesToWrite=0x2f80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b6aae8*, lpNumberOfBytesWritten=0x2ae3f8*=0x2f80, lpOverlapped=0x0) returned 1 [0090.439] CloseHandle (hObject=0x154) returned 1 [0090.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpFilePart=0x0) returned 0x6a [0090.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.anonymous", lpFilePart=0x0) returned 0x74 [0090.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.440] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e59300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76640670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4d96310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f80)) returned 1 [0090.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.anonymous")) returned 1 [0090.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpFilePart=0x0) returned 0x6e [0090.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.441] GetFileType (hFile=0x154) returned 0x1 [0090.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.441] GetFileType (hFile=0x154) returned 0x1 [0090.441] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c70 [0090.441] ReadFile (in: hFile=0x154, lpBuffer=0x1b6e06c, nNumberOfBytesToRead=0x1c70, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6e06c*, lpNumberOfBytesRead=0x2ae404*=0x1c70, lpOverlapped=0x0) returned 1 [0090.454] CloseHandle (hObject=0x154) returned 1 [0090.491] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpFilePart=0x0) returned 0x6e [0090.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.493] GetFileType (hFile=0x154) returned 0x1 [0090.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.493] GetFileType (hFile=0x154) returned 0x1 [0090.493] WriteFile (in: hFile=0x154, lpBuffer=0x19c5c88*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19c5c88*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c80, lpOverlapped=0x0) returned 1 [0090.494] CloseHandle (hObject=0x154) returned 1 [0090.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpFilePart=0x0) returned 0x6e [0090.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.anonymous", lpFilePart=0x0) returned 0x78 [0090.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.494] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e59300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7668c930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4e08730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c80)) returned 1 [0090.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.anonymous")) returned 1 [0090.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpFilePart=0x0) returned 0x68 [0090.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.495] GetFileType (hFile=0x154) returned 0x1 [0090.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.495] GetFileType (hFile=0x154) returned 0x1 [0090.495] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x480d [0090.495] ReadFile (in: hFile=0x154, lpBuffer=0x19c7f1c, nNumberOfBytesToRead=0x480d, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c7f1c*, lpNumberOfBytesRead=0x2ae404*=0x480d, lpOverlapped=0x0) returned 1 [0090.497] CloseHandle (hObject=0x154) returned 1 [0090.509] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpFilePart=0x0) returned 0x68 [0090.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.510] GetFileType (hFile=0x154) returned 0x1 [0090.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.511] GetFileType (hFile=0x154) returned 0x1 [0090.511] WriteFile (in: hFile=0x154, lpBuffer=0x1a2b558*, nNumberOfBytesToWrite=0x4810, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a2b558*, lpNumberOfBytesWritten=0x2ae3f8*=0x4810, lpOverlapped=0x0) returned 1 [0090.512] CloseHandle (hObject=0x154) returned 1 [0090.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpFilePart=0x0) returned 0x68 [0090.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.anonymous", lpFilePart=0x0) returned 0x72 [0090.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565adc00, ftCreationTime.dwHighDateTime=0x1c96038, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4e2e890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4810)) returned 1 [0090.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.anonymous")) returned 1 [0090.513] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpFilePart=0x0) returned 0x6c [0090.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.513] GetFileType (hFile=0x154) returned 0x1 [0090.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.513] GetFileType (hFile=0x154) returned 0x1 [0090.513] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c6e [0090.513] ReadFile (in: hFile=0x154, lpBuffer=0x1a30350, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a30350*, lpNumberOfBytesRead=0x2ae404*=0x1c6e, lpOverlapped=0x0) returned 1 [0090.515] CloseHandle (hObject=0x154) returned 1 [0090.527] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpFilePart=0x0) returned 0x6c [0090.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.528] GetFileType (hFile=0x154) returned 0x1 [0090.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.528] GetFileType (hFile=0x154) returned 0x1 [0090.528] WriteFile (in: hFile=0x154, lpBuffer=0x1a85f6c*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a85f6c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0090.529] CloseHandle (hObject=0x154) returned 1 [0090.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpFilePart=0x0) returned 0x6c [0090.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.anonymous", lpFilePart=0x0) returned 0x76 [0090.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.530] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08a6100, ftCreationTime.dwHighDateTime=0x1c96036, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4e549f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0090.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.anonymous")) returned 1 [0090.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpFilePart=0x0) returned 0x67 [0090.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.531] GetFileType (hFile=0x154) returned 0x1 [0090.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.532] GetFileType (hFile=0x154) returned 0x1 [0090.532] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x46de [0090.532] ReadFile (in: hFile=0x154, lpBuffer=0x1a881d8, nNumberOfBytesToRead=0x46de, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a881d8*, lpNumberOfBytesRead=0x2ae404*=0x46de, lpOverlapped=0x0) returned 1 [0090.533] CloseHandle (hObject=0x154) returned 1 [0090.545] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpFilePart=0x0) returned 0x67 [0090.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.547] GetFileType (hFile=0x154) returned 0x1 [0090.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.547] GetFileType (hFile=0x154) returned 0x1 [0090.547] WriteFile (in: hFile=0x154, lpBuffer=0x1aeb224*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aeb224*, lpNumberOfBytesWritten=0x2ae3f8*=0x46e0, lpOverlapped=0x0) returned 1 [0090.548] CloseHandle (hObject=0x154) returned 1 [0090.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpFilePart=0x0) returned 0x67 [0090.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.anonymous", lpFilePart=0x0) returned 0x71 [0090.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b1f9000, ftCreationTime.dwHighDateTime=0x1c96038, ftLastAccessTime.dwLowDateTime=0x7668c930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4ea0cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x46e0)) returned 1 [0090.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.anonymous")) returned 1 [0090.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpFilePart=0x0) returned 0x6b [0090.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.550] GetFileType (hFile=0x154) returned 0x1 [0090.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.550] GetFileType (hFile=0x154) returned 0x1 [0090.550] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c6e [0090.550] ReadFile (in: hFile=0x154, lpBuffer=0x1aefed8, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aefed8*, lpNumberOfBytesRead=0x2ae404*=0x1c6e, lpOverlapped=0x0) returned 1 [0090.551] CloseHandle (hObject=0x154) returned 1 [0090.563] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpFilePart=0x0) returned 0x6b [0090.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.564] GetFileType (hFile=0x154) returned 0x1 [0090.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.565] GetFileType (hFile=0x154) returned 0x1 [0090.565] WriteFile (in: hFile=0x154, lpBuffer=0x1b45af4*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b45af4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0090.566] CloseHandle (hObject=0x154) returned 1 [0090.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpFilePart=0x0) returned 0x6b [0090.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.anonymous", lpFilePart=0x0) returned 0x75 [0090.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7b16f00, ftCreationTime.dwHighDateTime=0x1c96036, ftLastAccessTime.dwLowDateTime=0x7668c930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4ec6e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0090.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.anonymous")) returned 1 [0090.567] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpFilePart=0x0) returned 0x64 [0090.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.567] GetFileType (hFile=0x154) returned 0x1 [0090.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.567] GetFileType (hFile=0x154) returned 0x1 [0090.567] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13ca [0090.567] ReadFile (in: hFile=0x154, lpBuffer=0x1b47d44, nNumberOfBytesToRead=0x13ca, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b47d44*, lpNumberOfBytesRead=0x2ae404*=0x13ca, lpOverlapped=0x0) returned 1 [0090.569] CloseHandle (hObject=0x154) returned 1 [0090.597] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpFilePart=0x0) returned 0x64 [0090.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.598] GetFileType (hFile=0x154) returned 0x1 [0090.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.598] GetFileType (hFile=0x154) returned 0x1 [0090.598] WriteFile (in: hFile=0x154, lpBuffer=0x199a5c4*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x199a5c4*, lpNumberOfBytesWritten=0x2ae3f8*=0x13d0, lpOverlapped=0x0) returned 1 [0090.600] CloseHandle (hObject=0x154) returned 1 [0090.600] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpFilePart=0x0) returned 0x64 [0090.600] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.anonymous", lpFilePart=0x0) returned 0x6e [0090.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.600] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ecd600, ftCreationTime.dwHighDateTime=0x1c95f8f, ftLastAccessTime.dwLowDateTime=0x7668c930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4f130d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13d0)) returned 1 [0090.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.anonymous")) returned 1 [0090.601] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpFilePart=0x0) returned 0x68 [0090.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.601] GetFileType (hFile=0x154) returned 0x1 [0090.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.601] GetFileType (hFile=0x154) returned 0x1 [0090.601] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c6e [0090.601] ReadFile (in: hFile=0x154, lpBuffer=0x199bf44, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x199bf44*, lpNumberOfBytesRead=0x2ae404*=0x1c6e, lpOverlapped=0x0) returned 1 [0090.603] CloseHandle (hObject=0x154) returned 1 [0090.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpFilePart=0x0) returned 0x68 [0090.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.625] GetFileType (hFile=0x154) returned 0x1 [0090.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.625] GetFileType (hFile=0x154) returned 0x1 [0090.625] WriteFile (in: hFile=0x154, lpBuffer=0x19f1b60*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19f1b60*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0090.627] CloseHandle (hObject=0x154) returned 1 [0090.627] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpFilePart=0x0) returned 0x68 [0090.627] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.anonymous", lpFilePart=0x0) returned 0x72 [0090.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.627] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x784c5400, ftCreationTime.dwHighDateTime=0x1c95f8f, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4f5f390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0090.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.anonymous")) returned 1 [0090.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpFilePart=0x0) returned 0x66 [0090.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.628] GetFileType (hFile=0x154) returned 0x1 [0090.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.628] GetFileType (hFile=0x154) returned 0x1 [0090.628] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x41de [0090.628] ReadFile (in: hFile=0x154, lpBuffer=0x19f3da0, nNumberOfBytesToRead=0x41de, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f3da0*, lpNumberOfBytesRead=0x2ae404*=0x41de, lpOverlapped=0x0) returned 1 [0090.630] CloseHandle (hObject=0x154) returned 1 [0090.642] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpFilePart=0x0) returned 0x66 [0090.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.644] GetFileType (hFile=0x154) returned 0x1 [0090.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.644] GetFileType (hFile=0x154) returned 0x1 [0090.644] WriteFile (in: hFile=0x154, lpBuffer=0x1a554ec*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a554ec*, lpNumberOfBytesWritten=0x2ae3f8*=0x41e0, lpOverlapped=0x0) returned 1 [0090.645] CloseHandle (hObject=0x154) returned 1 [0090.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpFilePart=0x0) returned 0x66 [0090.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.anonymous", lpFilePart=0x0) returned 0x70 [0090.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.645] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851f8500, ftCreationTime.dwHighDateTime=0x1c9602d, ftLastAccessTime.dwLowDateTime=0x7668c930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4f854f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x41e0)) returned 1 [0090.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.anonymous")) returned 1 [0090.646] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpFilePart=0x0) returned 0x6a [0090.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.646] GetFileType (hFile=0x154) returned 0x1 [0090.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.646] GetFileType (hFile=0x154) returned 0x1 [0090.646] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c6e [0090.646] ReadFile (in: hFile=0x154, lpBuffer=0x1a59c98, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a59c98*, lpNumberOfBytesRead=0x2ae404*=0x1c6e, lpOverlapped=0x0) returned 1 [0090.648] CloseHandle (hObject=0x154) returned 1 [0090.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpFilePart=0x0) returned 0x6a [0090.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.663] GetFileType (hFile=0x154) returned 0x1 [0090.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.663] GetFileType (hFile=0x154) returned 0x1 [0090.663] WriteFile (in: hFile=0x154, lpBuffer=0x1aaf8b4*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aaf8b4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0090.664] CloseHandle (hObject=0x154) returned 1 [0090.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpFilePart=0x0) returned 0x6a [0090.664] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.anonymous", lpFilePart=0x0) returned 0x74 [0090.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.664] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68834d00, ftCreationTime.dwHighDateTime=0x1c9602d, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4fab650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0090.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.anonymous")) returned 1 [0090.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpFilePart=0x0) returned 0x63 [0090.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.665] GetFileType (hFile=0x154) returned 0x1 [0090.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.666] GetFileType (hFile=0x154) returned 0x1 [0090.666] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3e78 [0090.666] ReadFile (in: hFile=0x154, lpBuffer=0x1ab1afc, nNumberOfBytesToRead=0x3e78, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab1afc*, lpNumberOfBytesRead=0x2ae404*=0x3e78, lpOverlapped=0x0) returned 1 [0090.667] CloseHandle (hObject=0x154) returned 1 [0090.679] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpFilePart=0x0) returned 0x63 [0090.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.681] GetFileType (hFile=0x154) returned 0x1 [0090.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.681] GetFileType (hFile=0x154) returned 0x1 [0090.681] WriteFile (in: hFile=0x154, lpBuffer=0x1b12164*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b12164*, lpNumberOfBytesWritten=0x2ae3f8*=0x3e80, lpOverlapped=0x0) returned 1 [0090.682] CloseHandle (hObject=0x154) returned 1 [0090.682] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpFilePart=0x0) returned 0x63 [0090.682] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.anonymous", lpFilePart=0x0) returned 0x6d [0090.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd1f00, ftCreationTime.dwHighDateTime=0x1c9602d, ftLastAccessTime.dwLowDateTime=0x7668c930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4fd17b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e80)) returned 1 [0090.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.anonymous")) returned 1 [0090.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpFilePart=0x0) returned 0x67 [0090.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.683] GetFileType (hFile=0x154) returned 0x1 [0090.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.683] GetFileType (hFile=0x154) returned 0x1 [0090.683] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c6e [0090.683] ReadFile (in: hFile=0x154, lpBuffer=0x1b16580, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b16580*, lpNumberOfBytesRead=0x2ae404*=0x1c6e, lpOverlapped=0x0) returned 1 [0090.685] CloseHandle (hObject=0x154) returned 1 [0090.696] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpFilePart=0x0) returned 0x67 [0090.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.698] GetFileType (hFile=0x154) returned 0x1 [0090.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.698] GetFileType (hFile=0x154) returned 0x1 [0090.698] WriteFile (in: hFile=0x154, lpBuffer=0x1b6c19c*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b6c19c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0090.699] CloseHandle (hObject=0x154) returned 1 [0090.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpFilePart=0x0) returned 0x67 [0090.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.anonymous", lpFilePart=0x0) returned 0x71 [0090.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.699] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbac46e00, ftCreationTime.dwHighDateTime=0x1c9602d, ftLastAccessTime.dwLowDateTime=0x8584e390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd4ff7910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0090.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.anonymous")) returned 1 [0090.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpFilePart=0x0) returned 0x67 [0090.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.700] GetFileType (hFile=0x154) returned 0x1 [0090.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.700] GetFileType (hFile=0x154) returned 0x1 [0090.700] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2256 [0090.700] ReadFile (in: hFile=0x154, lpBuffer=0x1b6e3d0, nNumberOfBytesToRead=0x2256, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6e3d0*, lpNumberOfBytesRead=0x2ae404*=0x2256, lpOverlapped=0x0) returned 1 [0090.702] CloseHandle (hObject=0x154) returned 1 [0090.737] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpFilePart=0x0) returned 0x67 [0090.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.739] GetFileType (hFile=0x154) returned 0x1 [0090.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.739] GetFileType (hFile=0x154) returned 0x1 [0090.739] WriteFile (in: hFile=0x154, lpBuffer=0x19c6bfc*, nNumberOfBytesToWrite=0x2260, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19c6bfc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2260, lpOverlapped=0x0) returned 1 [0090.740] CloseHandle (hObject=0x154) returned 1 [0090.740] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpFilePart=0x0) returned 0x67 [0090.740] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.anonymous", lpFilePart=0x0) returned 0x71 [0090.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.740] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ec3100, ftCreationTime.dwHighDateTime=0x1c9bd19, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5069d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2260)) returned 1 [0090.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.anonymous")) returned 1 [0090.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpFilePart=0x0) returned 0x6b [0090.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.741] GetFileType (hFile=0x154) returned 0x1 [0090.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.741] GetFileType (hFile=0x154) returned 0x1 [0090.741] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9d8 [0090.741] ReadFile (in: hFile=0x154, lpBuffer=0x19c9e14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c9e14*, lpNumberOfBytesRead=0x2ae404*=0x9d8, lpOverlapped=0x0) returned 1 [0090.744] CloseHandle (hObject=0x154) returned 1 [0090.756] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpFilePart=0x0) returned 0x6b [0090.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.757] GetFileType (hFile=0x154) returned 0x1 [0090.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.757] GetFileType (hFile=0x154) returned 0x1 [0090.757] WriteFile (in: hFile=0x154, lpBuffer=0x1a1aef4*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1aef4*, lpNumberOfBytesWritten=0x2ae3cc*=0x9e0, lpOverlapped=0x0) returned 1 [0090.758] CloseHandle (hObject=0x154) returned 1 [0090.758] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpFilePart=0x0) returned 0x6b [0090.758] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x75 [0090.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24d1d00, ftCreationTime.dwHighDateTime=0x1c9bd19, ftLastAccessTime.dwLowDateTime=0x76f9fd10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd508fe90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1 [0090.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.anonymous")) returned 1 [0090.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpFilePart=0x0) returned 0x70 [0090.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.760] GetFileType (hFile=0x154) returned 0x1 [0090.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.760] GetFileType (hFile=0x154) returned 0x1 [0090.760] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x630 [0090.760] ReadFile (in: hFile=0x154, lpBuffer=0x1a1c9bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1c9bc*, lpNumberOfBytesRead=0x2ae404*=0x630, lpOverlapped=0x0) returned 1 [0090.761] CloseHandle (hObject=0x154) returned 1 [0090.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpFilePart=0x0) returned 0x70 [0090.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.776] GetFileType (hFile=0x154) returned 0x1 [0090.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.776] GetFileType (hFile=0x154) returned 0x1 [0090.776] WriteFile (in: hFile=0x154, lpBuffer=0x1a6c898*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6c898*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0090.777] CloseHandle (hObject=0x154) returned 1 [0090.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpFilePart=0x0) returned 0x70 [0090.778] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.anonymous", lpFilePart=0x0) returned 0x7a [0090.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.778] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1416c000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c89e90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd50b5ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0090.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.anonymous")) returned 1 [0090.779] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpFilePart=0x0) returned 0x6c [0090.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.779] GetFileType (hFile=0x154) returned 0x1 [0090.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.779] GetFileType (hFile=0x154) returned 0x1 [0090.779] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1de3 [0090.779] ReadFile (in: hFile=0x154, lpBuffer=0x1a6dd38, nNumberOfBytesToRead=0x1de3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6dd38*, lpNumberOfBytesRead=0x2ae404*=0x1de3, lpOverlapped=0x0) returned 1 [0090.781] CloseHandle (hObject=0x154) returned 1 [0090.793] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpFilePart=0x0) returned 0x6c [0090.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.794] GetFileType (hFile=0x154) returned 0x1 [0090.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.794] GetFileType (hFile=0x154) returned 0x1 [0090.794] WriteFile (in: hFile=0x154, lpBuffer=0x1ac40d4*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ac40d4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1df0, lpOverlapped=0x0) returned 1 [0090.795] CloseHandle (hObject=0x154) returned 1 [0090.795] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpFilePart=0x0) returned 0x6c [0090.795] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.anonymous", lpFilePart=0x0) returned 0x76 [0090.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.795] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1416c000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76fc5e70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd50dc150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1df0)) returned 1 [0090.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.anonymous")) returned 1 [0090.796] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpFilePart=0x0) returned 0x67 [0090.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.796] GetFileType (hFile=0x154) returned 0x1 [0090.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.796] GetFileType (hFile=0x154) returned 0x1 [0090.796] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x22c0 [0090.796] ReadFile (in: hFile=0x154, lpBuffer=0x1ac64c0, nNumberOfBytesToRead=0x22c0, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac64c0*, lpNumberOfBytesRead=0x2ae404*=0x22c0, lpOverlapped=0x0) returned 1 [0090.798] CloseHandle (hObject=0x154) returned 1 [0090.810] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpFilePart=0x0) returned 0x67 [0090.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.811] GetFileType (hFile=0x154) returned 0x1 [0090.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.811] GetFileType (hFile=0x154) returned 0x1 [0090.811] WriteFile (in: hFile=0x154, lpBuffer=0x1b1e0b8*, nNumberOfBytesToWrite=0x22d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b1e0b8*, lpNumberOfBytesWritten=0x2ae3f8*=0x22d0, lpOverlapped=0x0) returned 1 [0090.812] CloseHandle (hObject=0x154) returned 1 [0090.813] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpFilePart=0x0) returned 0x67 [0090.813] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.anonymous", lpFilePart=0x0) returned 0x71 [0090.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.813] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17b6e00, ftCreationTime.dwHighDateTime=0x1c9bd19, ftLastAccessTime.dwLowDateTime=0x76fc5e70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd51022b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x22d0)) returned 1 [0090.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.anonymous")) returned 1 [0090.814] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpFilePart=0x0) returned 0x6b [0090.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.814] GetFileType (hFile=0x154) returned 0x1 [0090.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.814] GetFileType (hFile=0x154) returned 0x1 [0090.814] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9d8 [0090.814] ReadFile (in: hFile=0x154, lpBuffer=0x1b21340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b21340*, lpNumberOfBytesRead=0x2ae404*=0x9d8, lpOverlapped=0x0) returned 1 [0090.817] CloseHandle (hObject=0x154) returned 1 [0090.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpFilePart=0x0) returned 0x6b [0090.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.831] GetFileType (hFile=0x154) returned 0x1 [0090.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.831] GetFileType (hFile=0x154) returned 0x1 [0090.831] WriteFile (in: hFile=0x154, lpBuffer=0x1b72420*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b72420*, lpNumberOfBytesWritten=0x2ae3cc*=0x9e0, lpOverlapped=0x0) returned 1 [0090.834] CloseHandle (hObject=0x154) returned 1 [0090.834] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpFilePart=0x0) returned 0x6b [0090.834] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x75 [0090.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.834] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212a7600, ftCreationTime.dwHighDateTime=0x1c9bd1a, ftLastAccessTime.dwLowDateTime=0x86c89e90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd514e570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1 [0090.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.anonymous")) returned 1 [0090.835] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpFilePart=0x0) returned 0x70 [0090.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.835] GetFileType (hFile=0x154) returned 0x1 [0090.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.835] GetFileType (hFile=0x154) returned 0x1 [0090.835] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x630 [0090.835] ReadFile (in: hFile=0x154, lpBuffer=0x1b73ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b73ee8*, lpNumberOfBytesRead=0x2ae404*=0x630, lpOverlapped=0x0) returned 1 [0090.837] CloseHandle (hObject=0x154) returned 1 [0090.873] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpFilePart=0x0) returned 0x70 [0090.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.874] GetFileType (hFile=0x154) returned 0x1 [0090.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.875] GetFileType (hFile=0x154) returned 0x1 [0090.875] WriteFile (in: hFile=0x154, lpBuffer=0x19c2188*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c2188*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0090.887] CloseHandle (hObject=0x154) returned 1 [0090.887] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpFilePart=0x0) returned 0x70 [0090.887] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.anonymous", lpFilePart=0x0) returned 0x7a [0090.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.887] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1416c000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c89e90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd51c0990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0090.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.anonymous")) returned 1 [0090.888] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpFilePart=0x0) returned 0x6c [0090.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.888] GetFileType (hFile=0x154) returned 0x1 [0090.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.888] GetFileType (hFile=0x154) returned 0x1 [0090.888] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1dd7 [0090.888] ReadFile (in: hFile=0x154, lpBuffer=0x19c3628, nNumberOfBytesToRead=0x1dd7, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c3628*, lpNumberOfBytesRead=0x2ae404*=0x1dd7, lpOverlapped=0x0) returned 1 [0090.890] CloseHandle (hObject=0x154) returned 1 [0090.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpFilePart=0x0) returned 0x6c [0090.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.903] GetFileType (hFile=0x154) returned 0x1 [0090.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.903] GetFileType (hFile=0x154) returned 0x1 [0090.903] WriteFile (in: hFile=0x154, lpBuffer=0x1a19974*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a19974*, lpNumberOfBytesWritten=0x2ae3f8*=0x1de0, lpOverlapped=0x0) returned 1 [0090.904] CloseHandle (hObject=0x154) returned 1 [0090.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpFilePart=0x0) returned 0x6c [0090.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.anonymous", lpFilePart=0x0) returned 0x76 [0090.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.905] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1416c000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c89e90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd51e6af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1de0)) returned 1 [0090.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.anonymous")) returned 1 [0090.905] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpFilePart=0x0) returned 0x69 [0090.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.911] GetFileType (hFile=0x154) returned 0x1 [0090.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.911] GetFileType (hFile=0x154) returned 0x1 [0090.912] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2798 [0090.912] ReadFile (in: hFile=0x154, lpBuffer=0x1a1bd58, nNumberOfBytesToRead=0x2798, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1bd58*, lpNumberOfBytesRead=0x2ae404*=0x2798, lpOverlapped=0x0) returned 1 [0090.946] CloseHandle (hObject=0x154) returned 1 [0090.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpFilePart=0x0) returned 0x69 [0090.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.970] GetFileType (hFile=0x154) returned 0x1 [0090.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.970] GetFileType (hFile=0x154) returned 0x1 [0090.970] WriteFile (in: hFile=0x154, lpBuffer=0x1a75160*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a75160*, lpNumberOfBytesWritten=0x2ae3f8*=0x27a0, lpOverlapped=0x0) returned 1 [0090.971] CloseHandle (hObject=0x154) returned 1 [0090.971] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpFilePart=0x0) returned 0x69 [0090.972] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x73 [0090.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.972] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547ed00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f538fd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd52a51d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1 [0090.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.anonymous")) returned 1 [0090.972] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpFilePart=0x0) returned 0x6d [0090.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.973] GetFileType (hFile=0x154) returned 0x1 [0090.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.973] GetFileType (hFile=0x154) returned 0x1 [0090.973] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc0 [0090.973] ReadFile (in: hFile=0x154, lpBuffer=0x1a77fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a77fbc*, lpNumberOfBytesRead=0x2ae404*=0xc0, lpOverlapped=0x0) returned 1 [0090.974] CloseHandle (hObject=0x154) returned 1 [0090.987] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpFilePart=0x0) returned 0x6d [0090.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0090.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.988] GetFileType (hFile=0x154) returned 0x1 [0090.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0090.988] GetFileType (hFile=0x154) returned 0x1 [0090.988] WriteFile (in: hFile=0x154, lpBuffer=0x1ac6210*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ac6210*, lpNumberOfBytesWritten=0x2ae3cc*=0xd0, lpOverlapped=0x0) returned 1 [0090.989] CloseHandle (hObject=0x154) returned 1 [0090.989] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpFilePart=0x0) returned 0x6d [0090.989] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x77 [0090.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0090.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547ed00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f538fd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd52cb330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0090.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0090.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.anonymous")) returned 1 [0090.990] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpFilePart=0x0) returned 0x5f [0090.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0090.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0090.991] GetFileType (hFile=0x154) returned 0x1 [0090.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0090.991] GetFileType (hFile=0x154) returned 0x1 [0090.991] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1fec [0090.991] ReadFile (in: hFile=0x154, lpBuffer=0x1ac7664, nNumberOfBytesToRead=0x1fec, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac7664*, lpNumberOfBytesRead=0x2ae404*=0x1fec, lpOverlapped=0x0) returned 1 [0091.034] CloseHandle (hObject=0x154) returned 1 [0091.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpFilePart=0x0) returned 0x5f [0091.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.062] GetFileType (hFile=0x154) returned 0x1 [0091.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.062] GetFileType (hFile=0x154) returned 0x1 [0091.062] WriteFile (in: hFile=0x154, lpBuffer=0x1b1e3fc*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b1e3fc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1ff0, lpOverlapped=0x0) returned 1 [0091.063] CloseHandle (hObject=0x154) returned 1 [0091.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpFilePart=0x0) returned 0x5f [0091.063] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.anonymous", lpFilePart=0x0) returned 0x69 [0091.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.063] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1483400, ftCreationTime.dwHighDateTime=0x1ca0395, ftLastAccessTime.dwLowDateTime=0x921be950, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5389a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ff0)) returned 1 [0091.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.anonymous")) returned 1 [0091.064] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpFilePart=0x0) returned 0x65 [0091.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.065] GetFileType (hFile=0x154) returned 0x1 [0091.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.065] GetFileType (hFile=0x154) returned 0x1 [0091.065] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1ffe [0091.065] ReadFile (in: hFile=0x154, lpBuffer=0x1b20958, nNumberOfBytesToRead=0x1ffe, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b20958*, lpNumberOfBytesRead=0x2ae404*=0x1ffe, lpOverlapped=0x0) returned 1 [0091.086] CloseHandle (hObject=0x154) returned 1 [0091.098] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpFilePart=0x0) returned 0x65 [0091.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.099] GetFileType (hFile=0x154) returned 0x1 [0091.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.100] GetFileType (hFile=0x154) returned 0x1 [0091.100] WriteFile (in: hFile=0x154, lpBuffer=0x1b77744*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b77744*, lpNumberOfBytesWritten=0x2ae3f8*=0x2000, lpOverlapped=0x0) returned 1 [0091.101] CloseHandle (hObject=0x154) returned 1 [0091.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpFilePart=0x0) returned 0x65 [0091.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x6f [0091.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ec4a100, ftCreationTime.dwHighDateTime=0x1ca0395, ftLastAccessTime.dwLowDateTime=0x921be950, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd53d5cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0091.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.anonymous")) returned 1 [0091.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpFilePart=0x0) returned 0x69 [0091.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.102] GetFileType (hFile=0x154) returned 0x1 [0091.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.102] GetFileType (hFile=0x154) returned 0x1 [0091.102] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5a4 [0091.102] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a2ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7a2ac*, lpNumberOfBytesRead=0x2ae404*=0x5a4, lpOverlapped=0x0) returned 1 [0091.131] CloseHandle (hObject=0x154) returned 1 [0091.167] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpFilePart=0x0) returned 0x69 [0091.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.169] GetFileType (hFile=0x154) returned 0x1 [0091.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.169] GetFileType (hFile=0x154) returned 0x1 [0091.169] WriteFile (in: hFile=0x154, lpBuffer=0x19c9e00*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c9e00*, lpNumberOfBytesWritten=0x2ae3cc*=0x5b0, lpOverlapped=0x0) returned 1 [0091.170] CloseHandle (hObject=0x154) returned 1 [0091.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpFilePart=0x0) returned 0x69 [0091.170] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x73 [0091.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.170] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e410000, ftCreationTime.dwHighDateTime=0x1ca03bf, ftLastAccessTime.dwLowDateTime=0x921be950, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd546e250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0091.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.anonymous")) returned 1 [0091.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.171] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers", lpFilePart=0x0) returned 0x4f [0091.171] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpFilePart=0x0) returned 0x50 [0091.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0091.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.172] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.172] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0091.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers", lpFilePart=0x0) returned 0x4f [0091.172] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpFilePart=0x0) returned 0x50 [0091.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0091.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.173] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.173] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0091.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.173] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpFilePart=0x0) returned 0x60 [0091.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.173] GetFileType (hFile=0x154) returned 0x1 [0091.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.173] GetFileType (hFile=0x154) returned 0x1 [0091.173] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe1b [0091.174] ReadFile (in: hFile=0x154, lpBuffer=0x19ce130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ce130*, lpNumberOfBytesRead=0x2ae404*=0xe1b, lpOverlapped=0x0) returned 1 [0091.206] CloseHandle (hObject=0x154) returned 1 [0091.217] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpFilePart=0x0) returned 0x60 [0091.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.218] GetFileType (hFile=0x154) returned 0x1 [0091.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.219] GetFileType (hFile=0x154) returned 0x1 [0091.219] WriteFile (in: hFile=0x154, lpBuffer=0x1a20728*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a20728*, lpNumberOfBytesWritten=0x2ae3cc*=0xe20, lpOverlapped=0x0) returned 1 [0091.220] CloseHandle (hObject=0x154) returned 1 [0091.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpFilePart=0x0) returned 0x60 [0091.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.anonymous", lpFilePart=0x0) returned 0x6a [0091.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.220] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547ed00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77012130, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd55067d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0091.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.anonymous")) returned 1 [0091.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpFilePart=0x0) returned 0x64 [0091.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.221] GetFileType (hFile=0x154) returned 0x1 [0091.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.221] GetFileType (hFile=0x154) returned 0x1 [0091.221] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x838 [0091.221] ReadFile (in: hFile=0x154, lpBuffer=0x1a22390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a22390*, lpNumberOfBytesRead=0x2ae404*=0x838, lpOverlapped=0x0) returned 1 [0091.242] CloseHandle (hObject=0x154) returned 1 [0091.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpFilePart=0x0) returned 0x64 [0091.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.255] GetFileType (hFile=0x154) returned 0x1 [0091.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.255] GetFileType (hFile=0x154) returned 0x1 [0091.256] WriteFile (in: hFile=0x154, lpBuffer=0x1a72c38*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a72c38*, lpNumberOfBytesWritten=0x2ae3cc*=0x840, lpOverlapped=0x0) returned 1 [0091.257] CloseHandle (hObject=0x154) returned 1 [0091.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpFilePart=0x0) returned 0x64 [0091.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.anonymous", lpFilePart=0x0) returned 0x6e [0091.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1547ed00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c89e90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5552a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0091.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.anonymous")) returned 1 [0091.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.258] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion", lpFilePart=0x0) returned 0x50 [0091.258] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpFilePart=0x0) returned 0x51 [0091.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0091.258] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.258] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.258] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.258] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.258] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0091.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.259] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion", lpFilePart=0x0) returned 0x50 [0091.259] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpFilePart=0x0) returned 0x51 [0091.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0091.259] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.259] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.259] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0091.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpFilePart=0x0) returned 0x6d [0091.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.280] GetFileType (hFile=0x154) returned 0x1 [0091.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.280] GetFileType (hFile=0x154) returned 0x1 [0091.280] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x393c [0091.280] ReadFile (in: hFile=0x154, lpBuffer=0x1a762d8, nNumberOfBytesToRead=0x393c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a762d8*, lpNumberOfBytesRead=0x2ae404*=0x393c, lpOverlapped=0x0) returned 1 [0091.296] CloseHandle (hObject=0x154) returned 1 [0091.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpFilePart=0x0) returned 0x6d [0091.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.309] GetFileType (hFile=0x154) returned 0x1 [0091.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.309] GetFileType (hFile=0x154) returned 0x1 [0091.309] WriteFile (in: hFile=0x154, lpBuffer=0x1ad4f00*, nNumberOfBytesToWrite=0x3940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ad4f00*, lpNumberOfBytesWritten=0x2ae3f8*=0x3940, lpOverlapped=0x0) returned 1 [0091.310] CloseHandle (hObject=0x154) returned 1 [0091.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpFilePart=0x0) returned 0x6d [0091.310] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x77 [0091.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.310] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45357600, ftCreationTime.dwHighDateTime=0x1ca05ed, ftLastAccessTime.dwLowDateTime=0x876cdd70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd55c4eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3940)) returned 1 [0091.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.anonymous")) returned 1 [0091.311] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x71 [0091.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.311] GetFileType (hFile=0x154) returned 0x1 [0091.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.312] GetFileType (hFile=0x154) returned 0x1 [0091.312] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1738 [0091.312] ReadFile (in: hFile=0x154, lpBuffer=0x1ad8e68, nNumberOfBytesToRead=0x1738, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad8e68*, lpNumberOfBytesRead=0x2ae404*=0x1738, lpOverlapped=0x0) returned 1 [0091.322] CloseHandle (hObject=0x154) returned 1 [0091.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x71 [0091.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.336] GetFileType (hFile=0x154) returned 0x1 [0091.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.336] GetFileType (hFile=0x154) returned 0x1 [0091.336] WriteFile (in: hFile=0x154, lpBuffer=0x1b2d090*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b2d090*, lpNumberOfBytesWritten=0x2ae3f8*=0x1740, lpOverlapped=0x0) returned 1 [0091.337] CloseHandle (hObject=0x154) returned 1 [0091.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpFilePart=0x0) returned 0x71 [0091.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x7b [0091.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.338] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee17e00, ftCreationTime.dwHighDateTime=0x1ca039f, ftLastAccessTime.dwLowDateTime=0x7737e0d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5611170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1740)) returned 1 [0091.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.anonymous")) returned 1 [0091.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare", lpFilePart=0x0) returned 0x53 [0091.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpFilePart=0x0) returned 0x54 [0091.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0091.352] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.352] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.352] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.352] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0091.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare", lpFilePart=0x0) returned 0x53 [0091.352] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpFilePart=0x0) returned 0x54 [0091.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbebd8 [0091.352] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.353] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.353] FindNextFileW (in: hFindFile=0xbebd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.353] FindClose (in: hFindFile=0xbebd8 | out: hFindFile=0xbebd8) returned 1 [0091.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpFilePart=0x0) returned 0x76 [0091.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.353] GetFileType (hFile=0x154) returned 0x1 [0091.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.353] GetFileType (hFile=0x154) returned 0x1 [0091.353] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xab11 [0091.353] ReadFile (in: hFile=0x154, lpBuffer=0x1b30c58, nNumberOfBytesToRead=0xab11, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b30c58*, lpNumberOfBytesRead=0x2ae404*=0xab11, lpOverlapped=0x0) returned 1 [0091.380] CloseHandle (hObject=0x154) returned 1 [0091.397] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpFilePart=0x0) returned 0x76 [0091.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.398] GetFileType (hFile=0x154) returned 0x1 [0091.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.398] GetFileType (hFile=0x154) returned 0x1 [0091.398] WriteFile (in: hFile=0x154, lpBuffer=0x199c464*, nNumberOfBytesToWrite=0xab20, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x199c464*, lpNumberOfBytesWritten=0x2ae3f8*=0xab20, lpOverlapped=0x0) returned 1 [0091.400] CloseHandle (hObject=0x154) returned 1 [0091.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpFilePart=0x0) returned 0x76 [0091.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.anonymous", lpFilePart=0x0) returned 0x80 [0091.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.400] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16791a00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8538b790, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd56a96f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xab20)) returned 1 [0091.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.anonymous")) returned 1 [0091.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview", lpFilePart=0x0) returned 0x5a [0091.401] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpFilePart=0x0) returned 0x5b [0091.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.430] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.431] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.431] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.431] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0091.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview", lpFilePart=0x0) returned 0x5a [0091.432] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpFilePart=0x0) returned 0x5b [0091.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0091.433] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.433] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.433] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.434] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.434] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.434] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.434] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.434] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.434] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.434] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0091.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.435] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpFilePart=0x0) returned 0x6d [0091.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.437] GetFileType (hFile=0x154) returned 0x1 [0091.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.437] GetFileType (hFile=0x154) returned 0x1 [0091.437] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2519 [0091.437] ReadFile (in: hFile=0x154, lpBuffer=0x19ab284, nNumberOfBytesToRead=0x2519, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ab284*, lpNumberOfBytesRead=0x2ae404*=0x2519, lpOverlapped=0x0) returned 1 [0091.513] CloseHandle (hObject=0x154) returned 1 [0091.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpFilePart=0x0) returned 0x6d [0091.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.550] GetFileType (hFile=0x154) returned 0x1 [0091.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.550] GetFileType (hFile=0x154) returned 0x1 [0091.550] WriteFile (in: hFile=0x154, lpBuffer=0x1a03a10*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a03a10*, lpNumberOfBytesWritten=0x2ae3f8*=0x2520, lpOverlapped=0x0) returned 1 [0091.551] CloseHandle (hObject=0x154) returned 1 [0091.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpFilePart=0x0) returned 0x6d [0091.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.anonymous", lpFilePart=0x0) returned 0x77 [0091.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16791a00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x85685310, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd58264b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2520)) returned 1 [0091.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.anonymous")) returned 1 [0091.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpFilePart=0x0) returned 0x71 [0091.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.552] GetFileType (hFile=0x154) returned 0x1 [0091.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.552] GetFileType (hFile=0x154) returned 0x1 [0091.552] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xca8 [0091.552] ReadFile (in: hFile=0x154, lpBuffer=0x1a071e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a071e4*, lpNumberOfBytesRead=0x2ae404*=0xca8, lpOverlapped=0x0) returned 1 [0091.590] CloseHandle (hObject=0x154) returned 1 [0091.603] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpFilePart=0x0) returned 0x71 [0091.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.604] GetFileType (hFile=0x154) returned 0x1 [0091.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.604] GetFileType (hFile=0x154) returned 0x1 [0091.604] WriteFile (in: hFile=0x154, lpBuffer=0x1a590d8*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a590d8*, lpNumberOfBytesWritten=0x2ae3cc*=0xcb0, lpOverlapped=0x0) returned 1 [0091.605] CloseHandle (hObject=0x154) returned 1 [0091.605] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpFilePart=0x0) returned 0x71 [0091.605] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x7b [0091.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.605] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16791a00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76451490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd58988d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcb0)) returned 1 [0091.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.anonymous")) returned 1 [0091.606] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpFilePart=0x0) returned 0x71 [0091.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.606] GetFileType (hFile=0x154) returned 0x1 [0091.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.606] GetFileType (hFile=0x154) returned 0x1 [0091.606] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9bd [0091.606] ReadFile (in: hFile=0x154, lpBuffer=0x1a5af44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5af44*, lpNumberOfBytesRead=0x2ae404*=0x9bd, lpOverlapped=0x0) returned 1 [0091.624] CloseHandle (hObject=0x154) returned 1 [0091.636] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpFilePart=0x0) returned 0x71 [0091.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.637] GetFileType (hFile=0x154) returned 0x1 [0091.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.637] GetFileType (hFile=0x154) returned 0x1 [0091.637] WriteFile (in: hFile=0x154, lpBuffer=0x1aabf84*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aabf84*, lpNumberOfBytesWritten=0x2ae3cc*=0x9c0, lpOverlapped=0x0) returned 1 [0091.638] CloseHandle (hObject=0x154) returned 1 [0091.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpFilePart=0x0) returned 0x71 [0091.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.anonymous", lpFilePart=0x0) returned 0x7b [0091.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.639] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17aa4700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86ac0e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd58e4b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0091.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.anonymous")) returned 1 [0091.640] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpFilePart=0x0) returned 0x6f [0091.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.640] GetFileType (hFile=0x154) returned 0x1 [0091.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.641] GetFileType (hFile=0x154) returned 0x1 [0091.641] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x24ed [0091.641] ReadFile (in: hFile=0x154, lpBuffer=0x1aad41c, nNumberOfBytesToRead=0x24ed, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aad41c*, lpNumberOfBytesRead=0x2ae404*=0x24ed, lpOverlapped=0x0) returned 1 [0091.662] CloseHandle (hObject=0x154) returned 1 [0091.674] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpFilePart=0x0) returned 0x6f [0091.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.676] GetFileType (hFile=0x154) returned 0x1 [0091.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.676] GetFileType (hFile=0x154) returned 0x1 [0091.676] WriteFile (in: hFile=0x154, lpBuffer=0x1b05ab8*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b05ab8*, lpNumberOfBytesWritten=0x2ae3f8*=0x24f0, lpOverlapped=0x0) returned 1 [0091.677] CloseHandle (hObject=0x154) returned 1 [0091.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpFilePart=0x0) returned 0x6f [0091.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.anonymous", lpFilePart=0x0) returned 0x79 [0091.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.677] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17aa4700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88c604d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5956fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24f0)) returned 1 [0091.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.anonymous")) returned 1 [0091.678] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpFilePart=0x0) returned 0x73 [0091.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.679] GetFileType (hFile=0x154) returned 0x1 [0091.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.679] GetFileType (hFile=0x154) returned 0x1 [0091.679] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xca8 [0091.679] ReadFile (in: hFile=0x154, lpBuffer=0x1b09278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b09278*, lpNumberOfBytesRead=0x2ae404*=0xca8, lpOverlapped=0x0) returned 1 [0091.692] CloseHandle (hObject=0x154) returned 1 [0091.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpFilePart=0x0) returned 0x73 [0091.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.705] GetFileType (hFile=0x154) returned 0x1 [0091.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.705] GetFileType (hFile=0x154) returned 0x1 [0091.705] WriteFile (in: hFile=0x154, lpBuffer=0x1b5b174*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b5b174*, lpNumberOfBytesWritten=0x2ae3cc*=0xcb0, lpOverlapped=0x0) returned 1 [0091.706] CloseHandle (hObject=0x154) returned 1 [0091.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpFilePart=0x0) returned 0x73 [0091.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x7d [0091.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.707] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17aa4700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78e45850, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd59a3270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcb0)) returned 1 [0091.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.anonymous")) returned 1 [0091.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpFilePart=0x0) returned 0x6f [0091.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.707] GetFileType (hFile=0x154) returned 0x1 [0091.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.708] GetFileType (hFile=0x154) returned 0x1 [0091.708] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x98b [0091.708] ReadFile (in: hFile=0x154, lpBuffer=0x1b5cfb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b5cfb0*, lpNumberOfBytesRead=0x2ae404*=0x98b, lpOverlapped=0x0) returned 1 [0091.709] CloseHandle (hObject=0x154) returned 1 [0091.747] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpFilePart=0x0) returned 0x6f [0091.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.748] GetFileType (hFile=0x154) returned 0x1 [0091.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.748] GetFileType (hFile=0x154) returned 0x1 [0091.748] WriteFile (in: hFile=0x154, lpBuffer=0x19a4018*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a4018*, lpNumberOfBytesWritten=0x2ae3cc*=0x990, lpOverlapped=0x0) returned 1 [0091.749] CloseHandle (hObject=0x154) returned 1 [0091.750] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpFilePart=0x0) returned 0x6f [0091.750] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x79 [0091.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17aa4700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f2192f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5a15690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1 [0091.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.anonymous")) returned 1 [0091.751] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpFilePart=0x0) returned 0x73 [0091.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.752] GetFileType (hFile=0x154) returned 0x1 [0091.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.752] GetFileType (hFile=0x154) returned 0x1 [0091.752] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x74 [0091.752] ReadFile (in: hFile=0x154, lpBuffer=0x19a5534, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a5534*, lpNumberOfBytesRead=0x2ae404*=0x74, lpOverlapped=0x0) returned 1 [0091.753] CloseHandle (hObject=0x154) returned 1 [0091.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpFilePart=0x0) returned 0x73 [0091.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.766] GetFileType (hFile=0x154) returned 0x1 [0091.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.766] GetFileType (hFile=0x154) returned 0x1 [0091.766] WriteFile (in: hFile=0x154, lpBuffer=0x19f36e8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19f36e8*, lpNumberOfBytesWritten=0x2ae3cc*=0x80, lpOverlapped=0x0) returned 1 [0091.767] CloseHandle (hObject=0x154) returned 1 [0091.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpFilePart=0x0) returned 0x73 [0091.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x7d [0091.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.767] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17aa4700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d1682d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5a3b7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0091.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.anonymous")) returned 1 [0091.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.768] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms", lpFilePart=0x0) returned 0x51 [0091.768] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpFilePart=0x0) returned 0x52 [0091.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0091.888] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.889] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.889] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.889] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.889] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.890] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.891] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.892] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.893] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.893] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.894] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.895] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.896] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.896] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.896] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.896] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.896] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.896] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0091.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0091.897] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms", lpFilePart=0x0) returned 0x51 [0091.897] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpFilePart=0x0) returned 0x52 [0091.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0091.898] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.899] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.900] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.901] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.901] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.901] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.901] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.901] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.901] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.902] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.903] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.904] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.905] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.906] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.906] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0091.906] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0091.906] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0091.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0091.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0091.907] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x64 [0091.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.935] GetFileType (hFile=0x154) returned 0x1 [0091.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.936] GetFileType (hFile=0x154) returned 0x1 [0091.936] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xbe8 [0091.936] ReadFile (in: hFile=0x154, lpBuffer=0x1a06a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a06a10*, lpNumberOfBytesRead=0x2ae404*=0xbe8, lpOverlapped=0x0) returned 1 [0091.958] CloseHandle (hObject=0x154) returned 1 [0091.970] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x64 [0091.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0091.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.972] GetFileType (hFile=0x154) returned 0x1 [0091.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0091.972] GetFileType (hFile=0x154) returned 0x1 [0091.973] CloseHandle (hObject=0x154) returned 1 [0091.974] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x64 [0091.974] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.anonymous", lpFilePart=0x0) returned 0x6e [0091.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0091.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17aa4700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x857b5e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5c2a9d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0091.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0091.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.anonymous")) returned 1 [0091.975] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x68 [0091.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0091.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0091.975] GetFileType (hFile=0x154) returned 0x1 [0091.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0091.975] GetFileType (hFile=0x154) returned 0x1 [0091.975] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x924 [0091.975] ReadFile (in: hFile=0x154, lpBuffer=0x1a5a29c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5a29c*, lpNumberOfBytesRead=0x2ae404*=0x924, lpOverlapped=0x0) returned 1 [0092.127] CloseHandle (hObject=0x154) returned 1 [0092.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x68 [0092.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.140] GetFileType (hFile=0x154) returned 0x1 [0092.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.140] GetFileType (hFile=0x154) returned 0x1 [0092.140] WriteFile (in: hFile=0x154, lpBuffer=0x1aab004*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aab004*, lpNumberOfBytesWritten=0x2ae3cc*=0x930, lpOverlapped=0x0) returned 1 [0092.141] CloseHandle (hObject=0x154) returned 1 [0092.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x68 [0092.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.anonymous", lpFilePart=0x0) returned 0x72 [0092.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.141] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x857b5e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5dcd8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x930)) returned 1 [0092.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.anonymous")) returned 1 [0092.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpFilePart=0x0) returned 0x5f [0092.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.142] GetFileType (hFile=0x154) returned 0x1 [0092.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.142] GetFileType (hFile=0x154) returned 0x1 [0092.142] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xae8 [0092.142] ReadFile (in: hFile=0x154, lpBuffer=0x1aacf30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aacf30*, lpNumberOfBytesRead=0x2ae404*=0xae8, lpOverlapped=0x0) returned 1 [0092.177] CloseHandle (hObject=0x154) returned 1 [0092.190] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpFilePart=0x0) returned 0x5f [0092.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.192] GetFileType (hFile=0x154) returned 0x1 [0092.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.192] GetFileType (hFile=0x154) returned 0x1 [0092.193] CloseHandle (hObject=0x154) returned 1 [0092.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpFilePart=0x0) returned 0x5f [0092.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.anonymous", lpFilePart=0x0) returned 0x69 [0092.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.193] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x769d2770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5e3fd10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaf0)) returned 1 [0092.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.anonymous")) returned 1 [0092.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpFilePart=0x0) returned 0x5f [0092.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.194] GetFileType (hFile=0x154) returned 0x1 [0092.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.194] GetFileType (hFile=0x154) returned 0x1 [0092.194] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x161d [0092.195] ReadFile (in: hFile=0x154, lpBuffer=0x1aff940, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aff940*, lpNumberOfBytesRead=0x2ae404*=0x161d, lpOverlapped=0x0) returned 1 [0092.196] CloseHandle (hObject=0x154) returned 1 [0092.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpFilePart=0x0) returned 0x5f [0092.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.209] GetFileType (hFile=0x154) returned 0x1 [0092.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.210] GetFileType (hFile=0x154) returned 0x1 [0092.210] WriteFile (in: hFile=0x154, lpBuffer=0x1b535cc*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b535cc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1620, lpOverlapped=0x0) returned 1 [0092.211] CloseHandle (hObject=0x154) returned 1 [0092.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpFilePart=0x0) returned 0x5f [0092.211] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.anonymous", lpFilePart=0x0) returned 0x69 [0092.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.211] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5e65e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1620)) returned 1 [0092.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.anonymous")) returned 1 [0092.212] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpFilePart=0x0) returned 0x60 [0092.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.212] GetFileType (hFile=0x154) returned 0x1 [0092.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.212] GetFileType (hFile=0x154) returned 0x1 [0092.212] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x7dd3 [0092.212] ReadFile (in: hFile=0x154, lpBuffer=0x1b55140, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b55140*, lpNumberOfBytesRead=0x2ae404*=0x7dd3, lpOverlapped=0x0) returned 1 [0092.220] CloseHandle (hObject=0x154) returned 1 [0092.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpFilePart=0x0) returned 0x60 [0092.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.259] GetFileType (hFile=0x154) returned 0x1 [0092.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.259] GetFileType (hFile=0x154) returned 0x1 [0092.259] WriteFile (in: hFile=0x154, lpBuffer=0x19d3250*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19d3250*, lpNumberOfBytesWritten=0x2ae3f8*=0x7de0, lpOverlapped=0x0) returned 1 [0092.260] CloseHandle (hObject=0x154) returned 1 [0092.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpFilePart=0x0) returned 0x60 [0092.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.anonymous", lpFilePart=0x0) returned 0x6a [0092.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.261] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5ed8290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7de0)) returned 1 [0092.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.anonymous")) returned 1 [0092.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpFilePart=0x0) returned 0x5f [0092.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.262] GetFileType (hFile=0x154) returned 0x1 [0092.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.262] GetFileType (hFile=0x154) returned 0x1 [0092.262] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x132a [0092.262] ReadFile (in: hFile=0x154, lpBuffer=0x19db590, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19db590*, lpNumberOfBytesRead=0x2ae404*=0x132a, lpOverlapped=0x0) returned 1 [0092.277] CloseHandle (hObject=0x154) returned 1 [0092.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpFilePart=0x0) returned 0x5f [0092.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.290] GetFileType (hFile=0x154) returned 0x1 [0092.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.291] GetFileType (hFile=0x154) returned 0x1 [0092.291] WriteFile (in: hFile=0x154, lpBuffer=0x1a2e36c*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a2e36c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1330, lpOverlapped=0x0) returned 1 [0092.292] CloseHandle (hObject=0x154) returned 1 [0092.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpFilePart=0x0) returned 0x5f [0092.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.anonymous", lpFilePart=0x0) returned 0x69 [0092.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.292] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5f24550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1330)) returned 1 [0092.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.anonymous")) returned 1 [0092.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x66 [0092.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.293] GetFileType (hFile=0x154) returned 0x1 [0092.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.293] GetFileType (hFile=0x154) returned 0x1 [0092.293] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb9b8 [0092.293] ReadFile (in: hFile=0x154, lpBuffer=0x1a2fc08, nNumberOfBytesToRead=0xb9b8, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a2fc08*, lpNumberOfBytesRead=0x2ae404*=0xb9b8, lpOverlapped=0x0) returned 1 [0092.312] CloseHandle (hObject=0x154) returned 1 [0092.325] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x66 [0092.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.327] GetFileType (hFile=0x154) returned 0x1 [0092.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.327] GetFileType (hFile=0x154) returned 0x1 [0092.327] WriteFile (in: hFile=0x154, lpBuffer=0x1a9f744*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a9f744*, lpNumberOfBytesWritten=0x2ae3f8*=0xb9c0, lpOverlapped=0x0) returned 1 [0092.328] CloseHandle (hObject=0x154) returned 1 [0092.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x66 [0092.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.anonymous", lpFilePart=0x0) returned 0x70 [0092.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.329] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd5f96970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb9c0)) returned 1 [0092.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.anonymous")) returned 1 [0092.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6b [0092.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.330] GetFileType (hFile=0x154) returned 0x1 [0092.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.330] GetFileType (hFile=0x154) returned 0x1 [0092.330] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4ebb [0092.330] ReadFile (in: hFile=0x154, lpBuffer=0x1aab6d0, nNumberOfBytesToRead=0x4ebb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aab6d0*, lpNumberOfBytesRead=0x2ae404*=0x4ebb, lpOverlapped=0x0) returned 1 [0092.388] CloseHandle (hObject=0x154) returned 1 [0092.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6b [0092.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.402] GetFileType (hFile=0x154) returned 0x1 [0092.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.402] GetFileType (hFile=0x154) returned 0x1 [0092.402] WriteFile (in: hFile=0x154, lpBuffer=0x1b10e7c*, nNumberOfBytesToWrite=0x4ec0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b10e7c*, lpNumberOfBytesWritten=0x2ae3f8*=0x4ec0, lpOverlapped=0x0) returned 1 [0092.403] CloseHandle (hObject=0x154) returned 1 [0092.403] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6b [0092.403] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.anonymous", lpFilePart=0x0) returned 0x75 [0092.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.403] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd602eef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ec0)) returned 1 [0092.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.anonymous")) returned 1 [0092.404] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x61 [0092.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.405] GetFileType (hFile=0x154) returned 0x1 [0092.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.405] GetFileType (hFile=0x154) returned 0x1 [0092.405] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5690 [0092.405] ReadFile (in: hFile=0x154, lpBuffer=0x1b16308, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b16308*, lpNumberOfBytesRead=0x2ae404*=0x5690, lpOverlapped=0x0) returned 1 [0092.406] CloseHandle (hObject=0x154) returned 1 [0092.419] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x61 [0092.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.420] GetFileType (hFile=0x154) returned 0x1 [0092.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.420] GetFileType (hFile=0x154) returned 0x1 [0092.420] WriteFile (in: hFile=0x154, lpBuffer=0x1b7e210*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b7e210*, lpNumberOfBytesWritten=0x2ae3f8*=0x56a0, lpOverlapped=0x0) returned 1 [0092.422] CloseHandle (hObject=0x154) returned 1 [0092.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x61 [0092.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.anonymous", lpFilePart=0x0) returned 0x6b [0092.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.422] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd607b1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x56a0)) returned 1 [0092.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.anonymous")) returned 1 [0092.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpFilePart=0x0) returned 0x5f [0092.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.423] GetFileType (hFile=0x154) returned 0x1 [0092.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.423] GetFileType (hFile=0x154) returned 0x1 [0092.423] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x6a [0092.423] ReadFile (in: hFile=0x154, lpBuffer=0x1b83e88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b83e88*, lpNumberOfBytesRead=0x2ae404*=0x6a, lpOverlapped=0x0) returned 1 [0092.424] CloseHandle (hObject=0x154) returned 1 [0092.462] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpFilePart=0x0) returned 0x5f [0092.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.463] GetFileType (hFile=0x154) returned 0x1 [0092.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.463] GetFileType (hFile=0x154) returned 0x1 [0092.463] WriteFile (in: hFile=0x154, lpBuffer=0x19ca1fc*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19ca1fc*, lpNumberOfBytesWritten=0x2ae3cc*=0x70, lpOverlapped=0x0) returned 1 [0092.464] CloseHandle (hObject=0x154) returned 1 [0092.465] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpFilePart=0x0) returned 0x5f [0092.465] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.anonymous", lpFilePart=0x0) returned 0x69 [0092.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.465] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd60c7470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0092.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.anonymous")) returned 1 [0092.466] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x64 [0092.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.466] GetFileType (hFile=0x154) returned 0x1 [0092.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.466] GetFileType (hFile=0x154) returned 0x1 [0092.466] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x21a6 [0092.466] ReadFile (in: hFile=0x154, lpBuffer=0x19cb610, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cb610*, lpNumberOfBytesRead=0x2ae404*=0x21a6, lpOverlapped=0x0) returned 1 [0092.478] CloseHandle (hObject=0x154) returned 1 [0092.490] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x64 [0092.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.491] GetFileType (hFile=0x154) returned 0x1 [0092.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.491] GetFileType (hFile=0x154) returned 0x1 [0092.491] WriteFile (in: hFile=0x154, lpBuffer=0x1a22c6c*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a22c6c*, lpNumberOfBytesWritten=0x2ae3f8*=0x21b0, lpOverlapped=0x0) returned 1 [0092.492] CloseHandle (hObject=0x154) returned 1 [0092.493] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x64 [0092.493] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.anonymous", lpFilePart=0x0) returned 0x6e [0092.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.493] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18db7400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6113730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21b0)) returned 1 [0092.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.anonymous")) returned 1 [0092.493] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x63 [0092.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.494] GetFileType (hFile=0x154) returned 0x1 [0092.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.494] GetFileType (hFile=0x154) returned 0x1 [0092.494] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3d57 [0092.494] ReadFile (in: hFile=0x154, lpBuffer=0x1a253b4, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a253b4*, lpNumberOfBytesRead=0x2ae404*=0x3d57, lpOverlapped=0x0) returned 1 [0092.523] CloseHandle (hObject=0x154) returned 1 [0092.535] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x63 [0092.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.541] GetFileType (hFile=0x154) returned 0x1 [0092.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.541] GetFileType (hFile=0x154) returned 0x1 [0092.541] WriteFile (in: hFile=0x154, lpBuffer=0x1a85480*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a85480*, lpNumberOfBytesWritten=0x2ae3f8*=0x3d60, lpOverlapped=0x0) returned 1 [0092.542] CloseHandle (hObject=0x154) returned 1 [0092.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x63 [0092.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.anonymous", lpFilePart=0x0) returned 0x6d [0092.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.542] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6185b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d60)) returned 1 [0092.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.anonymous")) returned 1 [0092.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpFilePart=0x0) returned 0x60 [0092.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.543] GetFileType (hFile=0x154) returned 0x1 [0092.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.543] GetFileType (hFile=0x154) returned 0x1 [0092.543] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1845 [0092.543] ReadFile (in: hFile=0x154, lpBuffer=0x1a8975c, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8975c*, lpNumberOfBytesRead=0x2ae404*=0x1845, lpOverlapped=0x0) returned 1 [0092.545] CloseHandle (hObject=0x154) returned 1 [0092.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpFilePart=0x0) returned 0x60 [0092.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.558] GetFileType (hFile=0x154) returned 0x1 [0092.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.558] GetFileType (hFile=0x154) returned 0x1 [0092.558] WriteFile (in: hFile=0x154, lpBuffer=0x1added8*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1added8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1850, lpOverlapped=0x0) returned 1 [0092.559] CloseHandle (hObject=0x154) returned 1 [0092.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpFilePart=0x0) returned 0x60 [0092.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.anonymous", lpFilePart=0x0) returned 0x6a [0092.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.559] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd61abcb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1850)) returned 1 [0092.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.anonymous")) returned 1 [0092.560] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x62 [0092.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.561] GetFileType (hFile=0x154) returned 0x1 [0092.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.561] GetFileType (hFile=0x154) returned 0x1 [0092.561] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5141 [0092.561] ReadFile (in: hFile=0x154, lpBuffer=0x1adfc98, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1adfc98*, lpNumberOfBytesRead=0x2ae404*=0x5141, lpOverlapped=0x0) returned 1 [0092.562] CloseHandle (hObject=0x154) returned 1 [0092.574] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x62 [0092.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.576] GetFileType (hFile=0x154) returned 0x1 [0092.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.576] GetFileType (hFile=0x154) returned 0x1 [0092.576] WriteFile (in: hFile=0x154, lpBuffer=0x1b46114*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b46114*, lpNumberOfBytesWritten=0x2ae3f8*=0x5150, lpOverlapped=0x0) returned 1 [0092.577] CloseHandle (hObject=0x154) returned 1 [0092.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x62 [0092.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.anonymous", lpFilePart=0x0) returned 0x6c [0092.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.577] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd61f7f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5150)) returned 1 [0092.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.anonymous")) returned 1 [0092.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x65 [0092.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.579] GetFileType (hFile=0x154) returned 0x1 [0092.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.579] GetFileType (hFile=0x154) returned 0x1 [0092.579] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x193c [0092.579] ReadFile (in: hFile=0x154, lpBuffer=0x1b4b7f0, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b4b7f0*, lpNumberOfBytesRead=0x2ae404*=0x193c, lpOverlapped=0x0) returned 1 [0092.580] CloseHandle (hObject=0x154) returned 1 [0092.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x65 [0092.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.617] GetFileType (hFile=0x154) returned 0x1 [0092.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.617] GetFileType (hFile=0x154) returned 0x1 [0092.617] WriteFile (in: hFile=0x154, lpBuffer=0x19a1d18*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19a1d18*, lpNumberOfBytesWritten=0x2ae3f8*=0x1940, lpOverlapped=0x0) returned 1 [0092.618] CloseHandle (hObject=0x154) returned 1 [0092.619] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x65 [0092.619] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.anonymous", lpFilePart=0x0) returned 0x6f [0092.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.619] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a28890, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6244230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0092.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.anonymous")) returned 1 [0092.619] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x63 [0092.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.620] GetFileType (hFile=0x154) returned 0x1 [0092.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.620] GetFileType (hFile=0x154) returned 0x1 [0092.620] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3c64 [0092.620] ReadFile (in: hFile=0x154, lpBuffer=0x19a3bf0, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a3bf0*, lpNumberOfBytesRead=0x2ae404*=0x3c64, lpOverlapped=0x0) returned 1 [0092.622] CloseHandle (hObject=0x154) returned 1 [0092.635] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x63 [0092.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.636] GetFileType (hFile=0x154) returned 0x1 [0092.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.636] GetFileType (hFile=0x154) returned 0x1 [0092.636] WriteFile (in: hFile=0x154, lpBuffer=0x1a03808*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a03808*, lpNumberOfBytesWritten=0x2ae3f8*=0x3c70, lpOverlapped=0x0) returned 1 [0092.638] CloseHandle (hObject=0x154) returned 1 [0092.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x63 [0092.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.anonymous", lpFilePart=0x0) returned 0x6d [0092.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.638] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a28890, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd626a390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c70)) returned 1 [0092.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.anonymous")) returned 1 [0092.639] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpFilePart=0x0) returned 0x61 [0092.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.639] GetFileType (hFile=0x154) returned 0x1 [0092.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.639] GetFileType (hFile=0x154) returned 0x1 [0092.639] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x276 [0092.639] ReadFile (in: hFile=0x154, lpBuffer=0x1a07c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a07c78*, lpNumberOfBytesRead=0x2ae404*=0x276, lpOverlapped=0x0) returned 1 [0092.646] CloseHandle (hObject=0x154) returned 1 [0092.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpFilePart=0x0) returned 0x61 [0092.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.660] GetFileType (hFile=0x154) returned 0x1 [0092.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.660] GetFileType (hFile=0x154) returned 0x1 [0092.660] WriteFile (in: hFile=0x154, lpBuffer=0x1a56850*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a56850*, lpNumberOfBytesWritten=0x2ae3cc*=0x280, lpOverlapped=0x0) returned 1 [0092.661] CloseHandle (hObject=0x154) returned 1 [0092.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpFilePart=0x0) returned 0x61 [0092.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.anonymous", lpFilePart=0x0) returned 0x6b [0092.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.662] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b33230, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd62b6650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1 [0092.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.anonymous")) returned 1 [0092.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpFilePart=0x0) returned 0x69 [0092.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.672] GetFileType (hFile=0x154) returned 0x1 [0092.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.672] GetFileType (hFile=0x154) returned 0x1 [0092.672] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe6 [0092.672] ReadFile (in: hFile=0x154, lpBuffer=0x1a57d74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a57d74*, lpNumberOfBytesRead=0x2ae404*=0xe6, lpOverlapped=0x0) returned 1 [0092.673] CloseHandle (hObject=0x154) returned 1 [0092.684] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpFilePart=0x0) returned 0x69 [0092.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.686] GetFileType (hFile=0x154) returned 0x1 [0092.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.686] GetFileType (hFile=0x154) returned 0x1 [0092.686] WriteFile (in: hFile=0x154, lpBuffer=0x1aa5ff0*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aa5ff0*, lpNumberOfBytesWritten=0x2ae3cc*=0xf0, lpOverlapped=0x0) returned 1 [0092.687] CloseHandle (hObject=0x154) returned 1 [0092.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpFilePart=0x0) returned 0x69 [0092.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.anonymous", lpFilePart=0x0) returned 0x73 [0092.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.687] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b33230, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6302910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0092.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.anonymous")) returned 1 [0092.688] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpFilePart=0x0) returned 0x66 [0092.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.688] GetFileType (hFile=0x154) returned 0x1 [0092.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.688] GetFileType (hFile=0x154) returned 0x1 [0092.688] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x41b [0092.688] ReadFile (in: hFile=0x154, lpBuffer=0x1aa7870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa7870*, lpNumberOfBytesRead=0x2ae404*=0x41b, lpOverlapped=0x0) returned 1 [0092.690] CloseHandle (hObject=0x154) returned 1 [0092.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpFilePart=0x0) returned 0x66 [0092.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.705] GetFileType (hFile=0x154) returned 0x1 [0092.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.705] GetFileType (hFile=0x154) returned 0x1 [0092.705] WriteFile (in: hFile=0x154, lpBuffer=0x1af6c7c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1af6c7c*, lpNumberOfBytesWritten=0x2ae3cc*=0x420, lpOverlapped=0x0) returned 1 [0092.707] CloseHandle (hObject=0x154) returned 1 [0092.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpFilePart=0x0) returned 0x66 [0092.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.anonymous", lpFilePart=0x0) returned 0x70 [0092.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.707] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6328a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x420)) returned 1 [0092.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.anonymous")) returned 1 [0092.708] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpFilePart=0x0) returned 0x60 [0092.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.708] GetFileType (hFile=0x154) returned 0x1 [0092.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.708] GetFileType (hFile=0x154) returned 0x1 [0092.708] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb9 [0092.708] ReadFile (in: hFile=0x154, lpBuffer=0x1af8178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af8178*, lpNumberOfBytesRead=0x2ae404*=0xb9, lpOverlapped=0x0) returned 1 [0092.709] CloseHandle (hObject=0x154) returned 1 [0092.721] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpFilePart=0x0) returned 0x60 [0092.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.722] GetFileType (hFile=0x154) returned 0x1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.722] GetFileType (hFile=0x154) returned 0x1 [0092.722] WriteFile (in: hFile=0x154, lpBuffer=0x1b46370*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b46370*, lpNumberOfBytesWritten=0x2ae3cc*=0xc0, lpOverlapped=0x0) returned 1 [0092.723] CloseHandle (hObject=0x154) returned 1 [0092.723] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpFilePart=0x0) returned 0x60 [0092.723] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.anonymous", lpFilePart=0x0) returned 0x6a [0092.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.723] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd634ebd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.anonymous")) returned 1 [0092.724] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpFilePart=0x0) returned 0x68 [0092.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.724] GetFileType (hFile=0x154) returned 0x1 [0092.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.724] GetFileType (hFile=0x154) returned 0x1 [0092.724] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35 [0092.724] ReadFile (in: hFile=0x154, lpBuffer=0x1b477e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b477e4*, lpNumberOfBytesRead=0x2ae404*=0x35, lpOverlapped=0x0) returned 1 [0092.726] CloseHandle (hObject=0x154) returned 1 [0092.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpFilePart=0x0) returned 0x68 [0092.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.739] GetFileType (hFile=0x154) returned 0x1 [0092.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.739] GetFileType (hFile=0x154) returned 0x1 [0092.740] WriteFile (in: hFile=0x154, lpBuffer=0x1b95900*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b95900*, lpNumberOfBytesWritten=0x2ae3cc*=0x40, lpOverlapped=0x0) returned 1 [0092.741] CloseHandle (hObject=0x154) returned 1 [0092.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpFilePart=0x0) returned 0x68 [0092.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.anonymous", lpFilePart=0x0) returned 0x72 [0092.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.741] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6374d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0092.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.anonymous")) returned 1 [0092.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpFilePart=0x0) returned 0x65 [0092.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.745] GetFileType (hFile=0x154) returned 0x1 [0092.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.745] GetFileType (hFile=0x154) returned 0x1 [0092.745] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xbb [0092.745] ReadFile (in: hFile=0x154, lpBuffer=0x199443c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x199443c*, lpNumberOfBytesRead=0x2ae404*=0xbb, lpOverlapped=0x0) returned 1 [0092.746] CloseHandle (hObject=0x154) returned 1 [0092.781] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpFilePart=0x0) returned 0x65 [0092.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.783] GetFileType (hFile=0x154) returned 0x1 [0092.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.783] GetFileType (hFile=0x154) returned 0x1 [0092.783] WriteFile (in: hFile=0x154, lpBuffer=0x19e2644*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19e2644*, lpNumberOfBytesWritten=0x2ae3cc*=0xc0, lpOverlapped=0x0) returned 1 [0092.784] CloseHandle (hObject=0x154) returned 1 [0092.784] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpFilePart=0x0) returned 0x65 [0092.784] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.anonymous", lpFilePart=0x0) returned 0x6f [0092.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.784] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd63e7150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0092.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.anonymous")) returned 1 [0092.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpFilePart=0x0) returned 0x62 [0092.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.785] GetFileType (hFile=0x154) returned 0x1 [0092.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.786] GetFileType (hFile=0x154) returned 0x1 [0092.786] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x26e [0092.786] ReadFile (in: hFile=0x154, lpBuffer=0x19e3cf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e3cf0*, lpNumberOfBytesRead=0x2ae404*=0x26e, lpOverlapped=0x0) returned 1 [0092.787] CloseHandle (hObject=0x154) returned 1 [0092.800] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpFilePart=0x0) returned 0x62 [0092.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.801] GetFileType (hFile=0x154) returned 0x1 [0092.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.801] GetFileType (hFile=0x154) returned 0x1 [0092.801] WriteFile (in: hFile=0x154, lpBuffer=0x1a32878*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a32878*, lpNumberOfBytesWritten=0x2ae3cc*=0x270, lpOverlapped=0x0) returned 1 [0092.802] CloseHandle (hObject=0x154) returned 1 [0092.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpFilePart=0x0) returned 0x62 [0092.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.anonymous", lpFilePart=0x0) returned 0x6c [0092.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd640d2b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0092.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.anonymous")) returned 1 [0092.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpFilePart=0x0) returned 0x6a [0092.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.804] GetFileType (hFile=0x154) returned 0x1 [0092.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.804] GetFileType (hFile=0x154) returned 0x1 [0092.804] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe1 [0092.804] ReadFile (in: hFile=0x154, lpBuffer=0x1a33dac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a33dac*, lpNumberOfBytesRead=0x2ae404*=0xe1, lpOverlapped=0x0) returned 1 [0092.805] CloseHandle (hObject=0x154) returned 1 [0092.817] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpFilePart=0x0) returned 0x6a [0092.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.818] GetFileType (hFile=0x154) returned 0x1 [0092.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.818] GetFileType (hFile=0x154) returned 0x1 [0092.818] WriteFile (in: hFile=0x154, lpBuffer=0x1a82034*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a82034*, lpNumberOfBytesWritten=0x2ae3cc*=0xf0, lpOverlapped=0x0) returned 1 [0092.819] CloseHandle (hObject=0x154) returned 1 [0092.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpFilePart=0x0) returned 0x6a [0092.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.anonymous", lpFilePart=0x0) returned 0x74 [0092.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.820] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0ca100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6433410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0092.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.anonymous")) returned 1 [0092.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpFilePart=0x0) returned 0x67 [0092.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.824] GetFileType (hFile=0x154) returned 0x1 [0092.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.825] GetFileType (hFile=0x154) returned 0x1 [0092.825] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x41b [0092.825] ReadFile (in: hFile=0x154, lpBuffer=0x1a838c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a838c0*, lpNumberOfBytesRead=0x2ae404*=0x41b, lpOverlapped=0x0) returned 1 [0092.826] CloseHandle (hObject=0x154) returned 1 [0092.839] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpFilePart=0x0) returned 0x67 [0092.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.840] GetFileType (hFile=0x154) returned 0x1 [0092.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.841] GetFileType (hFile=0x154) returned 0x1 [0092.841] WriteFile (in: hFile=0x154, lpBuffer=0x1ad2ccc*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ad2ccc*, lpNumberOfBytesWritten=0x2ae3cc*=0x420, lpOverlapped=0x0) returned 1 [0092.842] CloseHandle (hObject=0x154) returned 1 [0092.842] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpFilePart=0x0) returned 0x67 [0092.842] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.anonymous", lpFilePart=0x0) returned 0x71 [0092.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.842] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd647f6d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x420)) returned 1 [0092.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.anonymous")) returned 1 [0092.843] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpFilePart=0x0) returned 0x65 [0092.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.844] GetFileType (hFile=0x154) returned 0x1 [0092.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.844] GetFileType (hFile=0x154) returned 0x1 [0092.844] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4b2 [0092.844] ReadFile (in: hFile=0x154, lpBuffer=0x1ad45e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad45e8*, lpNumberOfBytesRead=0x2ae404*=0x4b2, lpOverlapped=0x0) returned 1 [0092.856] CloseHandle (hObject=0x154) returned 1 [0092.867] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpFilePart=0x0) returned 0x65 [0092.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.869] GetFileType (hFile=0x154) returned 0x1 [0092.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.869] GetFileType (hFile=0x154) returned 0x1 [0092.869] WriteFile (in: hFile=0x154, lpBuffer=0x1b23d14*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b23d14*, lpNumberOfBytesWritten=0x2ae3cc*=0x4c0, lpOverlapped=0x0) returned 1 [0092.870] CloseHandle (hObject=0x154) returned 1 [0092.870] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpFilePart=0x0) returned 0x65 [0092.870] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.anonymous", lpFilePart=0x0) returned 0x6f [0092.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.870] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd64a5830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4c0)) returned 1 [0092.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.anonymous")) returned 1 [0092.871] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6a [0092.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.871] GetFileType (hFile=0x154) returned 0x1 [0092.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.871] GetFileType (hFile=0x154) returned 0x1 [0092.871] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x7a7 [0092.871] ReadFile (in: hFile=0x154, lpBuffer=0x1b25918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b25918*, lpNumberOfBytesRead=0x2ae404*=0x7a7, lpOverlapped=0x0) returned 1 [0092.884] CloseHandle (hObject=0x154) returned 1 [0092.896] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6a [0092.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.898] GetFileType (hFile=0x154) returned 0x1 [0092.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.898] GetFileType (hFile=0x154) returned 0x1 [0092.898] WriteFile (in: hFile=0x154, lpBuffer=0x1b75f08*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b75f08*, lpNumberOfBytesWritten=0x2ae3cc*=0x7b0, lpOverlapped=0x0) returned 1 [0092.899] CloseHandle (hObject=0x154) returned 1 [0092.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6a [0092.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.anonymous", lpFilePart=0x0) returned 0x74 [0092.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd64f1af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7b0)) returned 1 [0092.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.anonymous")) returned 1 [0092.900] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpFilePart=0x0) returned 0x66 [0092.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.903] GetFileType (hFile=0x154) returned 0x1 [0092.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0092.903] GetFileType (hFile=0x154) returned 0x1 [0092.903] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x805 [0092.903] ReadFile (in: hFile=0x154, lpBuffer=0x1b77b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b77b80*, lpNumberOfBytesRead=0x2ae404*=0x805, lpOverlapped=0x0) returned 1 [0092.905] CloseHandle (hObject=0x154) returned 1 [0092.977] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpFilePart=0x0) returned 0x66 [0092.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0092.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0092.979] GetFileType (hFile=0x154) returned 0x1 [0092.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0092.980] GetFileType (hFile=0x154) returned 0x1 [0092.980] WriteFile (in: hFile=0x154, lpBuffer=0x19c8e70*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c8e70*, lpNumberOfBytesWritten=0x2ae3cc*=0x810, lpOverlapped=0x0) returned 1 [0092.981] CloseHandle (hObject=0x154) returned 1 [0092.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpFilePart=0x0) returned 0x66 [0092.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.anonymous", lpFilePart=0x0) returned 0x70 [0092.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0092.981] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd65b01d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x810)) returned 1 [0092.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0092.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.anonymous")) returned 1 [0092.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpFilePart=0x0) returned 0x64 [0092.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0092.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.023] GetFileType (hFile=0x154) returned 0x1 [0093.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.023] GetFileType (hFile=0x154) returned 0x1 [0093.023] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc96 [0093.023] ReadFile (in: hFile=0x154, lpBuffer=0x19caf58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19caf58*, lpNumberOfBytesRead=0x2ae404*=0xc96, lpOverlapped=0x0) returned 1 [0093.025] CloseHandle (hObject=0x154) returned 1 [0093.037] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpFilePart=0x0) returned 0x64 [0093.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.038] GetFileType (hFile=0x154) returned 0x1 [0093.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.038] GetFileType (hFile=0x154) returned 0x1 [0093.038] WriteFile (in: hFile=0x154, lpBuffer=0x1a1cde0*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1cde0*, lpNumberOfBytesWritten=0x2ae3cc*=0xca0, lpOverlapped=0x0) returned 1 [0093.039] CloseHandle (hObject=0x154) returned 1 [0093.039] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpFilePart=0x0) returned 0x64 [0093.039] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.anonymous", lpFilePart=0x0) returned 0x6e [0093.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6648750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xca0)) returned 1 [0093.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.anonymous")) returned 1 [0093.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6b [0093.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.041] GetFileType (hFile=0x154) returned 0x1 [0093.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.041] GetFileType (hFile=0x154) returned 0x1 [0093.041] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3a2 [0093.041] ReadFile (in: hFile=0x154, lpBuffer=0x1a1e60c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1e60c*, lpNumberOfBytesRead=0x2ae404*=0x3a2, lpOverlapped=0x0) returned 1 [0093.069] CloseHandle (hObject=0x154) returned 1 [0093.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6b [0093.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.085] GetFileType (hFile=0x154) returned 0x1 [0093.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.085] GetFileType (hFile=0x154) returned 0x1 [0093.085] WriteFile (in: hFile=0x154, lpBuffer=0x1a6d800*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6d800*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0093.086] CloseHandle (hObject=0x154) returned 1 [0093.086] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6b [0093.086] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.anonymous", lpFilePart=0x0) returned 0x75 [0093.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.086] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd66bab70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0093.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.anonymous")) returned 1 [0093.087] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x69 [0093.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.088] GetFileType (hFile=0x154) returned 0x1 [0093.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.088] GetFileType (hFile=0x154) returned 0x1 [0093.088] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x262 [0093.088] ReadFile (in: hFile=0x154, lpBuffer=0x1a6eedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6eedc*, lpNumberOfBytesRead=0x2ae404*=0x262, lpOverlapped=0x0) returned 1 [0093.089] CloseHandle (hObject=0x154) returned 1 [0093.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x69 [0093.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.102] GetFileType (hFile=0x154) returned 0x1 [0093.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.103] GetFileType (hFile=0x154) returned 0x1 [0093.103] WriteFile (in: hFile=0x154, lpBuffer=0x1abda88*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1abda88*, lpNumberOfBytesWritten=0x2ae3cc*=0x270, lpOverlapped=0x0) returned 1 [0093.104] CloseHandle (hObject=0x154) returned 1 [0093.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x69 [0093.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.anonymous", lpFilePart=0x0) returned 0x73 [0093.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.104] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd66e0cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0093.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.anonymous")) returned 1 [0093.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6e [0093.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.105] GetFileType (hFile=0x154) returned 0x1 [0093.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.105] GetFileType (hFile=0x154) returned 0x1 [0093.105] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1499 [0093.105] ReadFile (in: hFile=0x154, lpBuffer=0x1abef18, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1abef18*, lpNumberOfBytesRead=0x2ae404*=0x1499, lpOverlapped=0x0) returned 1 [0093.120] CloseHandle (hObject=0x154) returned 1 [0093.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6e [0093.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.134] GetFileType (hFile=0x154) returned 0x1 [0093.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.134] GetFileType (hFile=0x154) returned 0x1 [0093.134] WriteFile (in: hFile=0x154, lpBuffer=0x1b12424*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b12424*, lpNumberOfBytesWritten=0x2ae3f8*=0x14a0, lpOverlapped=0x0) returned 1 [0093.136] CloseHandle (hObject=0x154) returned 1 [0093.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6e [0093.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.anonymous", lpFilePart=0x0) returned 0x78 [0093.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.136] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed15500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd672cf90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14a0)) returned 1 [0093.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.anonymous")) returned 1 [0093.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x72 [0093.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.137] GetFileType (hFile=0x154) returned 0x1 [0093.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.137] GetFileType (hFile=0x154) returned 0x1 [0093.137] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x638 [0093.137] ReadFile (in: hFile=0x154, lpBuffer=0x1b14544, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b14544*, lpNumberOfBytesRead=0x2ae404*=0x638, lpOverlapped=0x0) returned 1 [0093.139] CloseHandle (hObject=0x154) returned 1 [0093.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x72 [0093.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.152] GetFileType (hFile=0x154) returned 0x1 [0093.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.152] GetFileType (hFile=0x154) returned 0x1 [0093.152] WriteFile (in: hFile=0x154, lpBuffer=0x1b64420*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b64420*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0093.153] CloseHandle (hObject=0x154) returned 1 [0093.153] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x72 [0093.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x7c [0093.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.154] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed15500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6779250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0093.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.anonymous")) returned 1 [0093.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpFilePart=0x0) returned 0x65 [0093.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.155] GetFileType (hFile=0x154) returned 0x1 [0093.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.155] GetFileType (hFile=0x154) returned 0x1 [0093.155] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xfa1 [0093.155] ReadFile (in: hFile=0x154, lpBuffer=0x1b6685c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6685c*, lpNumberOfBytesRead=0x2ae404*=0xfa1, lpOverlapped=0x0) returned 1 [0093.157] CloseHandle (hObject=0x154) returned 1 [0093.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpFilePart=0x0) returned 0x65 [0093.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.195] GetFileType (hFile=0x154) returned 0x1 [0093.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.195] GetFileType (hFile=0x154) returned 0x1 [0093.195] WriteFile (in: hFile=0x154, lpBuffer=0x19b9dc0*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19b9dc0*, lpNumberOfBytesWritten=0x2ae3cc*=0xfb0, lpOverlapped=0x0) returned 1 [0093.196] CloseHandle (hObject=0x154) returned 1 [0093.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpFilePart=0x0) returned 0x65 [0093.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.anonymous", lpFilePart=0x0) returned 0x6f [0093.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.197] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed15500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e343d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd67c5510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfb0)) returned 1 [0093.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.anonymous")) returned 1 [0093.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpFilePart=0x0) returned 0x64 [0093.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.198] GetFileType (hFile=0x154) returned 0x1 [0093.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.198] GetFileType (hFile=0x154) returned 0x1 [0093.198] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1bfb [0093.198] ReadFile (in: hFile=0x154, lpBuffer=0x19bb1f8, nNumberOfBytesToRead=0x1bfb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19bb1f8*, lpNumberOfBytesRead=0x2ae404*=0x1bfb, lpOverlapped=0x0) returned 1 [0093.209] CloseHandle (hObject=0x154) returned 1 [0093.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpFilePart=0x0) returned 0x64 [0093.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.223] GetFileType (hFile=0x154) returned 0x1 [0093.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.223] GetFileType (hFile=0x154) returned 0x1 [0093.223] WriteFile (in: hFile=0x154, lpBuffer=0x1a10be4*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a10be4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c00, lpOverlapped=0x0) returned 1 [0093.230] CloseHandle (hObject=0x154) returned 1 [0093.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpFilePart=0x0) returned 0x64 [0093.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.anonymous", lpFilePart=0x0) returned 0x6e [0093.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.231] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed15500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd68117d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0093.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.anonymous")) returned 1 [0093.231] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpFilePart=0x0) returned 0x69 [0093.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.232] GetFileType (hFile=0x154) returned 0x1 [0093.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.232] GetFileType (hFile=0x154) returned 0x1 [0093.232] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x167d1 [0093.232] ReadFile (in: hFile=0x154, lpBuffer=0x15464290, nNumberOfBytesToRead=0x167d1, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x15464290*, lpNumberOfBytesRead=0x2ae404*=0x167d1, lpOverlapped=0x0) returned 1 [0093.251] CloseHandle (hObject=0x154) returned 1 [0093.271] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpFilePart=0x0) returned 0x69 [0093.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.273] GetFileType (hFile=0x154) returned 0x1 [0093.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.273] GetFileType (hFile=0x154) returned 0x1 [0093.273] WriteFile (in: hFile=0x154, lpBuffer=0x154d4a20*, nNumberOfBytesToWrite=0x167e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x154d4a20*, lpNumberOfBytesWritten=0x2ae3f8*=0x167e0, lpOverlapped=0x0) returned 1 [0093.276] CloseHandle (hObject=0x154) returned 1 [0093.276] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", lpFilePart=0x0) returned 0x69 [0093.276] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.anonymous", lpFilePart=0x0) returned 0x73 [0093.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.276] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed15500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78d3aeb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6883bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x167e0)) returned 1 [0093.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.anonymous")) returned 1 [0093.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpFilePart=0x0) returned 0x60 [0093.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.277] GetFileType (hFile=0x154) returned 0x1 [0093.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.277] GetFileType (hFile=0x154) returned 0x1 [0093.277] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x33a [0093.277] ReadFile (in: hFile=0x154, lpBuffer=0x1a604a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a604a4*, lpNumberOfBytesRead=0x2ae404*=0x33a, lpOverlapped=0x0) returned 1 [0093.301] CloseHandle (hObject=0x154) returned 1 [0093.313] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpFilePart=0x0) returned 0x60 [0093.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.314] GetFileType (hFile=0x154) returned 0x1 [0093.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.314] GetFileType (hFile=0x154) returned 0x1 [0093.314] WriteFile (in: hFile=0x154, lpBuffer=0x1aaf438*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aaf438*, lpNumberOfBytesWritten=0x2ae3cc*=0x340, lpOverlapped=0x0) returned 1 [0093.315] CloseHandle (hObject=0x154) returned 1 [0093.315] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpFilePart=0x0) returned 0x60 [0093.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.anonymous", lpFilePart=0x0) returned 0x6a [0093.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.316] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed15500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d24cb10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd68f6010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0093.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.anonymous")) returned 1 [0093.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x67 [0093.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0093.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.317] GetFileType (hFile=0x154) returned 0x1 [0093.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0093.317] GetFileType (hFile=0x154) returned 0x1 [0093.317] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd78 [0093.317] ReadFile (in: hFile=0x154, lpBuffer=0x1ab16c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab16c0*, lpNumberOfBytesRead=0x2ae404*=0xd78, lpOverlapped=0x0) returned 1 [0093.329] CloseHandle (hObject=0x154) returned 1 [0093.341] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x67 [0093.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0093.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.343] GetFileType (hFile=0x154) returned 0x1 [0093.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0093.343] GetFileType (hFile=0x154) returned 0x1 [0093.343] WriteFile (in: hFile=0x154, lpBuffer=0x1b039ac*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b039ac*, lpNumberOfBytesWritten=0x2ae3cc*=0xd80, lpOverlapped=0x0) returned 1 [0093.344] CloseHandle (hObject=0x154) returned 1 [0093.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x67 [0093.344] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.anonymous", lpFilePart=0x0) returned 0x71 [0093.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0093.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20028200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x851e8870, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd69422d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd80)) returned 1 [0093.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.anonymous")) returned 1 [0093.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0093.345] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview", lpFilePart=0x0) returned 0x62 [0093.345] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpFilePart=0x0) returned 0x63 [0093.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf098 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.361] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.362] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.363] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.364] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0093.364] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0093.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0093.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0093.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview", lpFilePart=0x0) returned 0x62 [0093.365] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpFilePart=0x0) returned 0x63 [0093.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf098 [0093.366] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.366] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.366] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.366] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.366] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.367] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.368] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.369] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.369] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.369] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.369] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0093.369] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0093.369] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0093.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0093.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0093.370] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpFilePart=0x0) returned 0x72 [0093.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.377] GetFileType (hFile=0x154) returned 0x1 [0093.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.377] GetFileType (hFile=0x154) returned 0x1 [0093.377] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x368c [0093.378] ReadFile (in: hFile=0x154, lpBuffer=0x1b0d62c, nNumberOfBytesToRead=0x368c, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b0d62c*, lpNumberOfBytesRead=0x2ae390*=0x368c, lpOverlapped=0x0) returned 1 [0093.387] CloseHandle (hObject=0x154) returned 1 [0093.424] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpFilePart=0x0) returned 0x72 [0093.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.426] GetFileType (hFile=0x154) returned 0x1 [0093.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.426] GetFileType (hFile=0x154) returned 0x1 [0093.426] WriteFile (in: hFile=0x154, lpBuffer=0x1b6b4e4*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b6b4e4*, lpNumberOfBytesWritten=0x2ae384*=0x3690, lpOverlapped=0x0) returned 1 [0093.427] CloseHandle (hObject=0x154) returned 1 [0093.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpFilePart=0x0) returned 0x72 [0093.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.anonymous", lpFilePart=0x0) returned 0x7c [0093.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.427] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x85da9510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6a009b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3690)) returned 1 [0093.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.anonymous")) returned 1 [0093.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpFilePart=0x0) returned 0x6c [0093.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.428] GetFileType (hFile=0x154) returned 0x1 [0093.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.428] GetFileType (hFile=0x154) returned 0x1 [0093.428] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3a68 [0093.429] ReadFile (in: hFile=0x154, lpBuffer=0x1b6f178, nNumberOfBytesToRead=0x3a68, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b6f178*, lpNumberOfBytesRead=0x2ae390*=0x3a68, lpOverlapped=0x0) returned 1 [0093.443] CloseHandle (hObject=0x154) returned 1 [0093.493] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpFilePart=0x0) returned 0x6c [0093.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.495] GetFileType (hFile=0x154) returned 0x1 [0093.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.495] GetFileType (hFile=0x154) returned 0x1 [0093.495] WriteFile (in: hFile=0x154, lpBuffer=0x19d2594*, nNumberOfBytesToWrite=0x3a70, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19d2594*, lpNumberOfBytesWritten=0x2ae384*=0x3a70, lpOverlapped=0x0) returned 1 [0093.496] CloseHandle (hObject=0x154) returned 1 [0093.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpFilePart=0x0) returned 0x6c [0093.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.anonymous", lpFilePart=0x0) returned 0x76 [0093.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.500] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76d64870, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6abf090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a70)) returned 1 [0093.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.anonymous")) returned 1 [0093.501] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpFilePart=0x0) returned 0x6d [0093.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.501] GetFileType (hFile=0x154) returned 0x1 [0093.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.501] GetFileType (hFile=0x154) returned 0x1 [0093.501] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3004 [0093.501] ReadFile (in: hFile=0x154, lpBuffer=0x19d65d0, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19d65d0*, lpNumberOfBytesRead=0x2ae390*=0x3004, lpOverlapped=0x0) returned 1 [0093.521] CloseHandle (hObject=0x154) returned 1 [0093.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpFilePart=0x0) returned 0x6d [0093.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.535] GetFileType (hFile=0x154) returned 0x1 [0093.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.535] GetFileType (hFile=0x154) returned 0x1 [0093.535] WriteFile (in: hFile=0x154, lpBuffer=0x1a32408*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a32408*, lpNumberOfBytesWritten=0x2ae384*=0x3010, lpOverlapped=0x0) returned 1 [0093.536] CloseHandle (hObject=0x154) returned 1 [0093.536] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpFilePart=0x0) returned 0x6d [0093.537] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.anonymous", lpFilePart=0x0) returned 0x77 [0093.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.537] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b33230, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6b0b350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1 [0093.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.anonymous")) returned 1 [0093.537] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpFilePart=0x0) returned 0x6f [0093.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.538] GetFileType (hFile=0x154) returned 0x1 [0093.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.538] GetFileType (hFile=0x154) returned 0x1 [0093.538] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x33d6 [0093.538] ReadFile (in: hFile=0x154, lpBuffer=0x1a359f0, nNumberOfBytesToRead=0x33d6, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a359f0*, lpNumberOfBytesRead=0x2ae390*=0x33d6, lpOverlapped=0x0) returned 1 [0093.545] CloseHandle (hObject=0x154) returned 1 [0093.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpFilePart=0x0) returned 0x6f [0093.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.559] GetFileType (hFile=0x154) returned 0x1 [0093.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.559] GetFileType (hFile=0x154) returned 0x1 [0093.559] WriteFile (in: hFile=0x154, lpBuffer=0x1a92b3c*, nNumberOfBytesToWrite=0x33e0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a92b3c*, lpNumberOfBytesWritten=0x2ae384*=0x33e0, lpOverlapped=0x0) returned 1 [0093.560] CloseHandle (hObject=0x154) returned 1 [0093.560] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpFilePart=0x0) returned 0x6f [0093.560] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0093.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.560] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76f07790, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6b57610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x33e0)) returned 1 [0093.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.anonymous")) returned 1 [0093.561] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpFilePart=0x0) returned 0x6f [0093.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.561] GetFileType (hFile=0x154) returned 0x1 [0093.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.561] GetFileType (hFile=0x154) returned 0x1 [0093.561] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x43a3 [0093.562] ReadFile (in: hFile=0x154, lpBuffer=0x1a96508, nNumberOfBytesToRead=0x43a3, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a96508*, lpNumberOfBytesRead=0x2ae390*=0x43a3, lpOverlapped=0x0) returned 1 [0093.563] CloseHandle (hObject=0x154) returned 1 [0093.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpFilePart=0x0) returned 0x6f [0093.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.576] GetFileType (hFile=0x154) returned 0x1 [0093.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.576] GetFileType (hFile=0x154) returned 0x1 [0093.576] WriteFile (in: hFile=0x154, lpBuffer=0x1af8564*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1af8564*, lpNumberOfBytesWritten=0x2ae384*=0x43b0, lpOverlapped=0x0) returned 1 [0093.578] CloseHandle (hObject=0x154) returned 1 [0093.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpFilePart=0x0) returned 0x6f [0093.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0093.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.578] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86c89e90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6b7d770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x43b0)) returned 1 [0093.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.anonymous")) returned 1 [0093.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpFilePart=0x0) returned 0x6e [0093.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.582] GetFileType (hFile=0x154) returned 0x1 [0093.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.582] GetFileType (hFile=0x154) returned 0x1 [0093.582] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x36bd [0093.582] ReadFile (in: hFile=0x154, lpBuffer=0x1afcefc, nNumberOfBytesToRead=0x36bd, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1afcefc*, lpNumberOfBytesRead=0x2ae390*=0x36bd, lpOverlapped=0x0) returned 1 [0093.592] CloseHandle (hObject=0x154) returned 1 [0093.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpFilePart=0x0) returned 0x6e [0093.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.606] GetFileType (hFile=0x154) returned 0x1 [0093.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.606] GetFileType (hFile=0x154) returned 0x1 [0093.606] WriteFile (in: hFile=0x154, lpBuffer=0x1b5aea8*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b5aea8*, lpNumberOfBytesWritten=0x2ae384*=0x36c0, lpOverlapped=0x0) returned 1 [0093.607] CloseHandle (hObject=0x154) returned 1 [0093.607] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpFilePart=0x0) returned 0x6e [0093.607] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.anonymous", lpFilePart=0x0) returned 0x78 [0093.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.607] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77038290, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6bc9a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x36c0)) returned 1 [0093.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.anonymous")) returned 1 [0093.608] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpFilePart=0x0) returned 0x6f [0093.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.609] GetFileType (hFile=0x154) returned 0x1 [0093.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.609] GetFileType (hFile=0x154) returned 0x1 [0093.609] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3d22 [0093.609] ReadFile (in: hFile=0x154, lpBuffer=0x1b5eb50, nNumberOfBytesToRead=0x3d22, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b5eb50*, lpNumberOfBytesRead=0x2ae390*=0x3d22, lpOverlapped=0x0) returned 1 [0093.610] CloseHandle (hObject=0x154) returned 1 [0093.652] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpFilePart=0x0) returned 0x6f [0093.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.655] GetFileType (hFile=0x154) returned 0x1 [0093.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.655] GetFileType (hFile=0x154) returned 0x1 [0093.655] WriteFile (in: hFile=0x154, lpBuffer=0x19bedf0*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19bedf0*, lpNumberOfBytesWritten=0x2ae384*=0x3d30, lpOverlapped=0x0) returned 1 [0093.657] CloseHandle (hObject=0x154) returned 1 [0093.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpFilePart=0x0) returned 0x6f [0093.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0093.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.657] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x770aa6b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6c3be50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d30)) returned 1 [0093.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.anonymous")) returned 1 [0093.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpFilePart=0x0) returned 0x6b [0093.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.659] GetFileType (hFile=0x154) returned 0x1 [0093.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.659] GetFileType (hFile=0x154) returned 0x1 [0093.659] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x42af [0093.659] ReadFile (in: hFile=0x154, lpBuffer=0x19c30fc, nNumberOfBytesToRead=0x42af, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19c30fc*, lpNumberOfBytesRead=0x2ae390*=0x42af, lpOverlapped=0x0) returned 1 [0093.663] CloseHandle (hObject=0x154) returned 1 [0093.678] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpFilePart=0x0) returned 0x6b [0093.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.679] GetFileType (hFile=0x154) returned 0x1 [0093.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.679] GetFileType (hFile=0x154) returned 0x1 [0093.680] WriteFile (in: hFile=0x154, lpBuffer=0x1a24c58*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a24c58*, lpNumberOfBytesWritten=0x2ae384*=0x42b0, lpOverlapped=0x0) returned 1 [0093.681] CloseHandle (hObject=0x154) returned 1 [0093.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpFilePart=0x0) returned 0x6b [0093.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.anonymous", lpFilePart=0x0) returned 0x75 [0093.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x770d0810, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6c61fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x42b0)) returned 1 [0093.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.anonymous")) returned 1 [0093.682] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpFilePart=0x0) returned 0x6f [0093.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.682] GetFileType (hFile=0x154) returned 0x1 [0093.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.683] GetFileType (hFile=0x154) returned 0x1 [0093.683] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x4139 [0093.683] ReadFile (in: hFile=0x154, lpBuffer=0x1a294cc, nNumberOfBytesToRead=0x4139, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a294cc*, lpNumberOfBytesRead=0x2ae390*=0x4139, lpOverlapped=0x0) returned 1 [0093.684] CloseHandle (hObject=0x154) returned 1 [0093.696] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpFilePart=0x0) returned 0x6f [0093.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.697] GetFileType (hFile=0x154) returned 0x1 [0093.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.697] GetFileType (hFile=0x154) returned 0x1 [0093.697] WriteFile (in: hFile=0x154, lpBuffer=0x1a8a8f8*, nNumberOfBytesToWrite=0x4140, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a8a8f8*, lpNumberOfBytesWritten=0x2ae384*=0x4140, lpOverlapped=0x0) returned 1 [0093.699] CloseHandle (hObject=0x154) returned 1 [0093.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpFilePart=0x0) returned 0x6f [0093.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0093.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.699] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x770d0810, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6c88110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4140)) returned 1 [0093.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.anonymous")) returned 1 [0093.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpFilePart=0x0) returned 0x71 [0093.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.700] GetFileType (hFile=0x154) returned 0x1 [0093.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.700] GetFileType (hFile=0x154) returned 0x1 [0093.700] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3e01 [0093.700] ReadFile (in: hFile=0x154, lpBuffer=0x1a8f02c, nNumberOfBytesToRead=0x3e01, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a8f02c*, lpNumberOfBytesRead=0x2ae390*=0x3e01, lpOverlapped=0x0) returned 1 [0093.702] CloseHandle (hObject=0x154) returned 1 [0093.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpFilePart=0x0) returned 0x71 [0093.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.715] GetFileType (hFile=0x154) returned 0x1 [0093.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.715] GetFileType (hFile=0x154) returned 0x1 [0093.715] WriteFile (in: hFile=0x154, lpBuffer=0x1aef468*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aef468*, lpNumberOfBytesWritten=0x2ae384*=0x3e10, lpOverlapped=0x0) returned 1 [0093.717] CloseHandle (hObject=0x154) returned 1 [0093.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpFilePart=0x0) returned 0x71 [0093.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.anonymous", lpFilePart=0x0) returned 0x7b [0093.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.717] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7737e0d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6cd43d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e10)) returned 1 [0093.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.anonymous")) returned 1 [0093.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpFilePart=0x0) returned 0x73 [0093.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.718] GetFileType (hFile=0x154) returned 0x1 [0093.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.718] GetFileType (hFile=0x154) returned 0x1 [0093.718] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x20e8 [0093.718] ReadFile (in: hFile=0x154, lpBuffer=0x1af3888, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1af3888*, lpNumberOfBytesRead=0x2ae390*=0x20e8, lpOverlapped=0x0) returned 1 [0093.728] CloseHandle (hObject=0x154) returned 1 [0093.740] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpFilePart=0x0) returned 0x73 [0093.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.741] GetFileType (hFile=0x154) returned 0x1 [0093.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.741] GetFileType (hFile=0x154) returned 0x1 [0093.741] WriteFile (in: hFile=0x154, lpBuffer=0x1b4ab20*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b4ab20*, lpNumberOfBytesWritten=0x2ae384*=0x20f0, lpOverlapped=0x0) returned 1 [0093.742] CloseHandle (hObject=0x154) returned 1 [0093.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpFilePart=0x0) returned 0x73 [0093.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.anonymous", lpFilePart=0x0) returned 0x7d [0093.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.742] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3dce00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8784ab30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6cfa530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20f0)) returned 1 [0093.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.anonymous")) returned 1 [0093.743] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpFilePart=0x0) returned 0x6e [0093.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.743] GetFileType (hFile=0x154) returned 0x1 [0093.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.743] GetFileType (hFile=0x154) returned 0x1 [0093.744] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3e72 [0093.744] ReadFile (in: hFile=0x154, lpBuffer=0x1b4d220, nNumberOfBytesToRead=0x3e72, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b4d220*, lpNumberOfBytesRead=0x2ae390*=0x3e72, lpOverlapped=0x0) returned 1 [0093.765] CloseHandle (hObject=0x154) returned 1 [0093.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpFilePart=0x0) returned 0x6e [0093.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.805] GetFileType (hFile=0x154) returned 0x1 [0093.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.805] GetFileType (hFile=0x154) returned 0x1 [0093.805] WriteFile (in: hFile=0x154, lpBuffer=0x19ad9d4*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19ad9d4*, lpNumberOfBytesWritten=0x2ae384*=0x3e80, lpOverlapped=0x0) returned 1 [0093.807] CloseHandle (hObject=0x154) returned 1 [0093.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpFilePart=0x0) returned 0x6e [0093.807] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.anonymous", lpFilePart=0x0) returned 0x78 [0093.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.807] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88ba1df0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6d92ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e80)) returned 1 [0093.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.anonymous")) returned 1 [0093.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpFilePart=0x0) returned 0x6c [0093.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.808] GetFileType (hFile=0x154) returned 0x1 [0093.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.808] GetFileType (hFile=0x154) returned 0x1 [0093.808] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x139a [0093.809] ReadFile (in: hFile=0x154, lpBuffer=0x19b1e30, nNumberOfBytesToRead=0x139a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19b1e30*, lpNumberOfBytesRead=0x2ae390*=0x139a, lpOverlapped=0x0) returned 1 [0093.840] CloseHandle (hObject=0x154) returned 1 [0093.852] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpFilePart=0x0) returned 0x6c [0093.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.853] GetFileType (hFile=0x154) returned 0x1 [0093.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.853] GetFileType (hFile=0x154) returned 0x1 [0093.853] WriteFile (in: hFile=0x154, lpBuffer=0x1a04e3c*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a04e3c*, lpNumberOfBytesWritten=0x2ae384*=0x13a0, lpOverlapped=0x0) returned 1 [0093.854] CloseHandle (hObject=0x154) returned 1 [0093.854] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpFilePart=0x0) returned 0x6c [0093.854] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.anonymous", lpFilePart=0x0) returned 0x76 [0093.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.854] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88c604d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6e04ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13a0)) returned 1 [0093.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.anonymous")) returned 1 [0093.855] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpFilePart=0x0) returned 0x6b [0093.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.855] GetFileType (hFile=0x154) returned 0x1 [0093.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.855] GetFileType (hFile=0x154) returned 0x1 [0093.856] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xe65 [0093.856] ReadFile (in: hFile=0x154, lpBuffer=0x1a07614, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a07614*, lpNumberOfBytesRead=0x2ae390*=0xe65, lpOverlapped=0x0) returned 1 [0093.865] CloseHandle (hObject=0x154) returned 1 [0093.890] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpFilePart=0x0) returned 0x6b [0093.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.891] GetFileType (hFile=0x154) returned 0x1 [0093.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.891] GetFileType (hFile=0x154) returned 0x1 [0093.892] WriteFile (in: hFile=0x154, lpBuffer=0x1a59da4*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a59da4*, lpNumberOfBytesWritten=0x2ae358*=0xe70, lpOverlapped=0x0) returned 1 [0093.893] CloseHandle (hObject=0x154) returned 1 [0093.893] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpFilePart=0x0) returned 0x6b [0093.893] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.anonymous", lpFilePart=0x0) returned 0x75 [0093.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.893] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8be11010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6e772f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe70)) returned 1 [0093.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.anonymous")) returned 1 [0093.893] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpFilePart=0x0) returned 0x6e [0093.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.894] GetFileType (hFile=0x154) returned 0x1 [0093.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.894] GetFileType (hFile=0x154) returned 0x1 [0093.894] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3b3f [0093.894] ReadFile (in: hFile=0x154, lpBuffer=0x1a5b204, nNumberOfBytesToRead=0x3b3f, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a5b204*, lpNumberOfBytesRead=0x2ae390*=0x3b3f, lpOverlapped=0x0) returned 1 [0093.937] CloseHandle (hObject=0x154) returned 1 [0093.950] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpFilePart=0x0) returned 0x6e [0093.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.951] GetFileType (hFile=0x154) returned 0x1 [0093.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.951] GetFileType (hFile=0x154) returned 0x1 [0093.951] WriteFile (in: hFile=0x154, lpBuffer=0x1aba830*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aba830*, lpNumberOfBytesWritten=0x2ae384*=0x3b40, lpOverlapped=0x0) returned 1 [0093.952] CloseHandle (hObject=0x154) returned 1 [0093.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpFilePart=0x0) returned 0x6e [0093.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.anonymous", lpFilePart=0x0) returned 0x78 [0093.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.953] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7b9dcb30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6f0f870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b40)) returned 1 [0093.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.anonymous")) returned 1 [0093.953] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpFilePart=0x0) returned 0x6e [0093.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.954] GetFileType (hFile=0x154) returned 0x1 [0093.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.954] GetFileType (hFile=0x154) returned 0x1 [0093.954] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x443a [0093.954] ReadFile (in: hFile=0x154, lpBuffer=0x1abe954, nNumberOfBytesToRead=0x443a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1abe954*, lpNumberOfBytesRead=0x2ae390*=0x443a, lpOverlapped=0x0) returned 1 [0093.967] CloseHandle (hObject=0x154) returned 1 [0093.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpFilePart=0x0) returned 0x6e [0093.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0093.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.980] GetFileType (hFile=0x154) returned 0x1 [0093.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0093.980] GetFileType (hFile=0x154) returned 0x1 [0093.980] WriteFile (in: hFile=0x154, lpBuffer=0x1b20c80*, nNumberOfBytesToWrite=0x4440, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b20c80*, lpNumberOfBytesWritten=0x2ae384*=0x4440, lpOverlapped=0x0) returned 1 [0093.981] CloseHandle (hObject=0x154) returned 1 [0093.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpFilePart=0x0) returned 0x6e [0093.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.anonymous", lpFilePart=0x0) returned 0x78 [0093.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0093.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x80ea9af0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6f5bb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4440)) returned 1 [0093.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0093.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.anonymous")) returned 1 [0093.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpFilePart=0x0) returned 0x6f [0093.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0093.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0093.983] GetFileType (hFile=0x154) returned 0x1 [0093.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0093.983] GetFileType (hFile=0x154) returned 0x1 [0093.983] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x12f5 [0093.983] ReadFile (in: hFile=0x154, lpBuffer=0x1b256a8, nNumberOfBytesToRead=0x12f5, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b256a8*, lpNumberOfBytesRead=0x2ae390*=0x12f5, lpOverlapped=0x0) returned 1 [0093.996] CloseHandle (hObject=0x154) returned 1 [0094.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpFilePart=0x0) returned 0x6f [0094.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.009] GetFileType (hFile=0x154) returned 0x1 [0094.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.009] GetFileType (hFile=0x154) returned 0x1 [0094.009] WriteFile (in: hFile=0x154, lpBuffer=0x1b78394*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b78394*, lpNumberOfBytesWritten=0x2ae384*=0x1300, lpOverlapped=0x0) returned 1 [0094.010] CloseHandle (hObject=0x154) returned 1 [0094.010] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpFilePart=0x0) returned 0x6f [0094.011] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0094.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x81e48b50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd6f81c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1300)) returned 1 [0094.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.anonymous")) returned 1 [0094.011] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpFilePart=0x0) returned 0x6c [0094.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.012] GetFileType (hFile=0x154) returned 0x1 [0094.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.012] GetFileType (hFile=0x154) returned 0x1 [0094.012] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x43c8 [0094.012] ReadFile (in: hFile=0x154, lpBuffer=0x1b79c74, nNumberOfBytesToRead=0x43c8, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b79c74*, lpNumberOfBytesRead=0x2ae390*=0x43c8, lpOverlapped=0x0) returned 1 [0094.028] CloseHandle (hObject=0x154) returned 1 [0094.066] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpFilePart=0x0) returned 0x6c [0094.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.067] GetFileType (hFile=0x154) returned 0x1 [0094.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.067] GetFileType (hFile=0x154) returned 0x1 [0094.067] WriteFile (in: hFile=0x154, lpBuffer=0x19dc280*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19dc280*, lpNumberOfBytesWritten=0x2ae384*=0x43d0, lpOverlapped=0x0) returned 1 [0094.069] CloseHandle (hObject=0x154) returned 1 [0094.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpFilePart=0x0) returned 0x6c [0094.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.anonymous", lpFilePart=0x0) returned 0x76 [0094.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.069] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x903b1390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd701a210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x43d0)) returned 1 [0094.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.anonymous")) returned 1 [0094.070] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpFilePart=0x0) returned 0x75 [0094.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.071] GetFileType (hFile=0x154) returned 0x1 [0094.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.071] GetFileType (hFile=0x154) returned 0x1 [0094.071] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3ad9 [0094.071] ReadFile (in: hFile=0x154, lpBuffer=0x19e0c3c, nNumberOfBytesToRead=0x3ad9, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19e0c3c*, lpNumberOfBytesRead=0x2ae390*=0x3ad9, lpOverlapped=0x0) returned 1 [0094.082] CloseHandle (hObject=0x154) returned 1 [0094.096] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpFilePart=0x0) returned 0x75 [0094.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.098] GetFileType (hFile=0x154) returned 0x1 [0094.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.098] GetFileType (hFile=0x154) returned 0x1 [0094.098] WriteFile (in: hFile=0x154, lpBuffer=0x1a40088*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a40088*, lpNumberOfBytesWritten=0x2ae384*=0x3ae0, lpOverlapped=0x0) returned 1 [0094.099] CloseHandle (hObject=0x154) returned 1 [0094.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpFilePart=0x0) returned 0x75 [0094.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.anonymous", lpFilePart=0x0) returned 0x7f [0094.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.099] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90495bd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd70664d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ae0)) returned 1 [0094.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.anonymous")) returned 1 [0094.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpFilePart=0x0) returned 0x71 [0094.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.101] GetFileType (hFile=0x154) returned 0x1 [0094.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.101] GetFileType (hFile=0x154) returned 0x1 [0094.101] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x37a7 [0094.101] ReadFile (in: hFile=0x154, lpBuffer=0x1a44198, nNumberOfBytesToRead=0x37a7, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a44198*, lpNumberOfBytesRead=0x2ae390*=0x37a7, lpOverlapped=0x0) returned 1 [0094.117] CloseHandle (hObject=0x154) returned 1 [0094.131] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpFilePart=0x0) returned 0x71 [0094.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.132] GetFileType (hFile=0x154) returned 0x1 [0094.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.132] GetFileType (hFile=0x154) returned 0x1 [0094.132] WriteFile (in: hFile=0x154, lpBuffer=0x1aa25f4*, nNumberOfBytesToWrite=0x37b0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aa25f4*, lpNumberOfBytesWritten=0x2ae384*=0x37b0, lpOverlapped=0x0) returned 1 [0094.133] CloseHandle (hObject=0x154) returned 1 [0094.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpFilePart=0x0) returned 0x71 [0094.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.anonymous", lpFilePart=0x0) returned 0x7b [0094.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.134] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x906aaf10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd70b2790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x37b0)) returned 1 [0094.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.anonymous")) returned 1 [0094.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpFilePart=0x0) returned 0x6f [0094.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.159] GetFileType (hFile=0x154) returned 0x1 [0094.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.159] GetFileType (hFile=0x154) returned 0x1 [0094.159] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3983 [0094.159] ReadFile (in: hFile=0x154, lpBuffer=0x1aa63a4, nNumberOfBytesToRead=0x3983, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aa63a4*, lpNumberOfBytesRead=0x2ae390*=0x3983, lpOverlapped=0x0) returned 1 [0094.164] CloseHandle (hObject=0x154) returned 1 [0094.177] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpFilePart=0x0) returned 0x6f [0094.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.178] GetFileType (hFile=0x154) returned 0x1 [0094.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.178] GetFileType (hFile=0x154) returned 0x1 [0094.178] WriteFile (in: hFile=0x154, lpBuffer=0x1b05160*, nNumberOfBytesToWrite=0x3990, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b05160*, lpNumberOfBytesWritten=0x2ae384*=0x3990, lpOverlapped=0x0) returned 1 [0094.181] CloseHandle (hObject=0x154) returned 1 [0094.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpFilePart=0x0) returned 0x6f [0094.181] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0094.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.181] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x827a81f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7124bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3990)) returned 1 [0094.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.anonymous")) returned 1 [0094.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpFilePart=0x0) returned 0x6e [0094.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.183] GetFileType (hFile=0x154) returned 0x1 [0094.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.183] GetFileType (hFile=0x154) returned 0x1 [0094.183] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3a97 [0094.184] ReadFile (in: hFile=0x154, lpBuffer=0x1b090d8, nNumberOfBytesToRead=0x3a97, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b090d8*, lpNumberOfBytesRead=0x2ae390*=0x3a97, lpOverlapped=0x0) returned 1 [0094.284] CloseHandle (hObject=0x154) returned 1 [0094.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpFilePart=0x0) returned 0x6e [0094.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.299] GetFileType (hFile=0x154) returned 0x1 [0094.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.299] GetFileType (hFile=0x154) returned 0x1 [0094.299] WriteFile (in: hFile=0x154, lpBuffer=0x1b683e4*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b683e4*, lpNumberOfBytesWritten=0x2ae384*=0x3aa0, lpOverlapped=0x0) returned 1 [0094.301] CloseHandle (hObject=0x154) returned 1 [0094.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpFilePart=0x0) returned 0x6e [0094.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.anonymous", lpFilePart=0x0) returned 0x78 [0094.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6efb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90743490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd72556b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0)) returned 1 [0094.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.anonymous")) returned 1 [0094.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpFilePart=0x0) returned 0x6f [0094.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.303] GetFileType (hFile=0x154) returned 0x1 [0094.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.303] GetFileType (hFile=0x154) returned 0x1 [0094.303] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x42fa [0094.303] ReadFile (in: hFile=0x154, lpBuffer=0x1b6c46c, nNumberOfBytesToRead=0x42fa, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b6c46c*, lpNumberOfBytesRead=0x2ae390*=0x42fa, lpOverlapped=0x0) returned 1 [0094.305] CloseHandle (hObject=0x154) returned 1 [0094.346] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpFilePart=0x0) returned 0x6f [0094.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.348] GetFileType (hFile=0x154) returned 0x1 [0094.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.348] GetFileType (hFile=0x154) returned 0x1 [0094.348] WriteFile (in: hFile=0x154, lpBuffer=0x19ce068*, nNumberOfBytesToWrite=0x4300, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19ce068*, lpNumberOfBytesWritten=0x2ae384*=0x4300, lpOverlapped=0x0) returned 1 [0094.349] CloseHandle (hObject=0x154) returned 1 [0094.349] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpFilePart=0x0) returned 0x6f [0094.349] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.anonymous", lpFilePart=0x0) returned 0x79 [0094.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.349] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x827a81f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd72c7ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4300)) returned 1 [0094.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.anonymous")) returned 1 [0094.350] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpFilePart=0x0) returned 0x79 [0094.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0094.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.350] GetFileType (hFile=0x154) returned 0x1 [0094.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0094.350] GetFileType (hFile=0x154) returned 0x1 [0094.350] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x4127 [0094.351] ReadFile (in: hFile=0x154, lpBuffer=0x19d297c, nNumberOfBytesToRead=0x4127, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19d297c*, lpNumberOfBytesRead=0x2ae390*=0x4127, lpOverlapped=0x0) returned 1 [0094.372] CloseHandle (hObject=0x154) returned 1 [0094.385] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpFilePart=0x0) returned 0x79 [0094.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0094.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.387] GetFileType (hFile=0x154) returned 0x1 [0094.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0094.387] GetFileType (hFile=0x154) returned 0x1 [0094.387] WriteFile (in: hFile=0x154, lpBuffer=0x1a33d58*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a33d58*, lpNumberOfBytesWritten=0x2ae384*=0x4130, lpOverlapped=0x0) returned 1 [0094.389] CloseHandle (hObject=0x154) returned 1 [0094.389] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpFilePart=0x0) returned 0x79 [0094.389] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.anonymous", lpFilePart=0x0) returned 0x83 [0094.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0094.389] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da02800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x921be950, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7339ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4130)) returned 1 [0094.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0094.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.anonymous")) returned 1 [0094.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0094.390] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates", lpFilePart=0x0) returned 0x60 [0094.390] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpFilePart=0x0) returned 0x61 [0094.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0094.404] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.404] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.405] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0094.405] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0094.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0094.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0094.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates", lpFilePart=0x0) returned 0x60 [0094.407] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpFilePart=0x0) returned 0x61 [0094.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0094.409] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.409] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.410] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0094.411] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0094.411] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0094.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0094.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0094.412] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3", lpFilePart=0x0) returned 0x52 [0094.412] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpFilePart=0x0) returned 0x53 [0094.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0094.442] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.444] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.445] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.446] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.447] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.448] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.449] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.450] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.451] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.452] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.453] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.453] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.453] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.453] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.453] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0094.453] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0094.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0094.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0094.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0094.454] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3", lpFilePart=0x0) returned 0x52 [0094.454] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpFilePart=0x0) returned 0x53 [0094.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0094.455] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.456] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.457] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.458] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.459] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.460] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.461] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0094.462] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0094.462] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0094.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0094.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0094.463] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x65 [0094.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.465] GetFileType (hFile=0x154) returned 0x1 [0094.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.465] GetFileType (hFile=0x154) returned 0x1 [0094.465] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xbe8 [0094.465] ReadFile (in: hFile=0x154, lpBuffer=0x1a52c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a52c30*, lpNumberOfBytesRead=0x2ae404*=0xbe8, lpOverlapped=0x0) returned 1 [0094.473] CloseHandle (hObject=0x154) returned 1 [0094.485] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x65 [0094.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.487] GetFileType (hFile=0x154) returned 0x1 [0094.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.487] GetFileType (hFile=0x154) returned 0x1 [0094.487] WriteFile (in: hFile=0x154, lpBuffer=0x1aa4744*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aa4744*, lpNumberOfBytesWritten=0x2ae3cc*=0xbf0, lpOverlapped=0x0) returned 1 [0094.488] CloseHandle (hObject=0x154) returned 1 [0094.488] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x65 [0094.488] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.anonymous", lpFilePart=0x0) returned 0x6f [0094.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.488] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x764e9a10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd741e730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0094.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.anonymous")) returned 1 [0094.489] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x69 [0094.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.489] GetFileType (hFile=0x154) returned 0x1 [0094.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.489] GetFileType (hFile=0x154) returned 0x1 [0094.489] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x924 [0094.489] ReadFile (in: hFile=0x154, lpBuffer=0x1aa64bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa64bc*, lpNumberOfBytesRead=0x2ae404*=0x924, lpOverlapped=0x0) returned 1 [0094.499] CloseHandle (hObject=0x154) returned 1 [0094.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x69 [0094.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.514] GetFileType (hFile=0x154) returned 0x1 [0094.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.514] GetFileType (hFile=0x154) returned 0x1 [0094.514] WriteFile (in: hFile=0x154, lpBuffer=0x1af7224*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1af7224*, lpNumberOfBytesWritten=0x2ae3cc*=0x930, lpOverlapped=0x0) returned 1 [0094.516] CloseHandle (hObject=0x154) returned 1 [0094.516] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x69 [0094.516] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.anonymous", lpFilePart=0x0) returned 0x73 [0094.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.517] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x857b5e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd746a9f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x930)) returned 1 [0094.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.anonymous")) returned 1 [0094.518] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpFilePart=0x0) returned 0x60 [0094.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.518] GetFileType (hFile=0x154) returned 0x1 [0094.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.518] GetFileType (hFile=0x154) returned 0x1 [0094.518] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xae8 [0094.518] ReadFile (in: hFile=0x154, lpBuffer=0x1af9154, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af9154*, lpNumberOfBytesRead=0x2ae404*=0xae8, lpOverlapped=0x0) returned 1 [0094.535] CloseHandle (hObject=0x154) returned 1 [0094.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpFilePart=0x0) returned 0x60 [0094.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.558] GetFileType (hFile=0x154) returned 0x1 [0094.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.558] GetFileType (hFile=0x154) returned 0x1 [0094.558] WriteFile (in: hFile=0x154, lpBuffer=0x1b4a754*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b4a754*, lpNumberOfBytesWritten=0x2ae3cc*=0xaf0, lpOverlapped=0x0) returned 1 [0094.560] CloseHandle (hObject=0x154) returned 1 [0094.561] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpFilePart=0x0) returned 0x60 [0094.561] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.anonymous", lpFilePart=0x0) returned 0x6a [0094.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.561] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x769d2770, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd74dce10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaf0)) returned 1 [0094.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.anonymous")) returned 1 [0094.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpFilePart=0x0) returned 0x60 [0094.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.562] GetFileType (hFile=0x154) returned 0x1 [0094.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.562] GetFileType (hFile=0x154) returned 0x1 [0094.563] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x161d [0094.563] ReadFile (in: hFile=0x154, lpBuffer=0x1b4bb78, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b4bb78*, lpNumberOfBytesRead=0x2ae404*=0x161d, lpOverlapped=0x0) returned 1 [0094.565] CloseHandle (hObject=0x154) returned 1 [0094.580] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpFilePart=0x0) returned 0x60 [0094.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.582] GetFileType (hFile=0x154) returned 0x1 [0094.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.582] GetFileType (hFile=0x154) returned 0x1 [0094.582] WriteFile (in: hFile=0x154, lpBuffer=0x199c458*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x199c458*, lpNumberOfBytesWritten=0x2ae3f8*=0x1620, lpOverlapped=0x0) returned 1 [0094.584] CloseHandle (hObject=0x154) returned 1 [0094.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpFilePart=0x0) returned 0x60 [0094.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.anonymous", lpFilePart=0x0) returned 0x6a [0094.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.584] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7502f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1620)) returned 1 [0094.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.anonymous")) returned 1 [0094.585] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpFilePart=0x0) returned 0x61 [0094.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.586] GetFileType (hFile=0x154) returned 0x1 [0094.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.586] GetFileType (hFile=0x154) returned 0x1 [0094.586] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x7dd3 [0094.586] ReadFile (in: hFile=0x154, lpBuffer=0x199dfdc, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x199dfdc*, lpNumberOfBytesRead=0x2ae404*=0x7dd3, lpOverlapped=0x0) returned 1 [0094.603] CloseHandle (hObject=0x154) returned 1 [0094.653] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpFilePart=0x0) returned 0x61 [0094.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.655] GetFileType (hFile=0x154) returned 0x1 [0094.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.655] GetFileType (hFile=0x154) returned 0x1 [0094.655] WriteFile (in: hFile=0x154, lpBuffer=0x1a12328*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a12328*, lpNumberOfBytesWritten=0x2ae3f8*=0x7de0, lpOverlapped=0x0) returned 1 [0094.657] CloseHandle (hObject=0x154) returned 1 [0094.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpFilePart=0x0) returned 0x61 [0094.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.anonymous", lpFilePart=0x0) returned 0x6b [0094.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.658] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd75c1650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7de0)) returned 1 [0094.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.anonymous")) returned 1 [0094.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpFilePart=0x0) returned 0x60 [0094.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.659] GetFileType (hFile=0x154) returned 0x1 [0094.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.659] GetFileType (hFile=0x154) returned 0x1 [0094.660] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x132a [0094.660] ReadFile (in: hFile=0x154, lpBuffer=0x1a1a66c, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1a66c*, lpNumberOfBytesRead=0x2ae404*=0x132a, lpOverlapped=0x0) returned 1 [0094.662] CloseHandle (hObject=0x154) returned 1 [0094.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpFilePart=0x0) returned 0x60 [0094.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.681] GetFileType (hFile=0x154) returned 0x1 [0094.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.682] GetFileType (hFile=0x154) returned 0x1 [0094.682] WriteFile (in: hFile=0x154, lpBuffer=0x1a6d448*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a6d448*, lpNumberOfBytesWritten=0x2ae3f8*=0x1330, lpOverlapped=0x0) returned 1 [0094.683] CloseHandle (hObject=0x154) returned 1 [0094.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpFilePart=0x0) returned 0x60 [0094.684] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.anonymous", lpFilePart=0x0) returned 0x6a [0094.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.684] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd760d910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1330)) returned 1 [0094.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.anonymous")) returned 1 [0094.685] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x67 [0094.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.685] GetFileType (hFile=0x154) returned 0x1 [0094.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.685] GetFileType (hFile=0x154) returned 0x1 [0094.685] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x167bd [0094.686] ReadFile (in: hFile=0x154, lpBuffer=0x154eb220, nNumberOfBytesToRead=0x167bd, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x154eb220*, lpNumberOfBytesRead=0x2ae404*=0x167bd, lpOverlapped=0x0) returned 1 [0094.689] CloseHandle (hObject=0x154) returned 1 [0094.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x67 [0094.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.721] GetFileType (hFile=0x154) returned 0x1 [0094.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.721] GetFileType (hFile=0x154) returned 0x1 [0094.721] WriteFile (in: hFile=0x154, lpBuffer=0x1555b920*, nNumberOfBytesToWrite=0x167c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1555b920*, lpNumberOfBytesWritten=0x2ae3f8*=0x167c0, lpOverlapped=0x0) returned 1 [0094.724] CloseHandle (hObject=0x154) returned 1 [0094.724] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x67 [0094.725] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.anonymous", lpFilePart=0x0) returned 0x71 [0094.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.725] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7659bd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x167c0)) returned 1 [0094.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.anonymous")) returned 1 [0094.726] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6c [0094.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.726] GetFileType (hFile=0x154) returned 0x1 [0094.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.726] GetFileType (hFile=0x154) returned 0x1 [0094.726] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4ebb [0094.726] ReadFile (in: hFile=0x154, lpBuffer=0x1abc0b4, nNumberOfBytesToRead=0x4ebb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1abc0b4*, lpNumberOfBytesRead=0x2ae404*=0x4ebb, lpOverlapped=0x0) returned 1 [0094.744] CloseHandle (hObject=0x154) returned 1 [0094.762] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6c [0094.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.764] GetFileType (hFile=0x154) returned 0x1 [0094.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.764] GetFileType (hFile=0x154) returned 0x1 [0094.764] WriteFile (in: hFile=0x154, lpBuffer=0x1b21860*, nNumberOfBytesToWrite=0x4ec0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b21860*, lpNumberOfBytesWritten=0x2ae3f8*=0x4ec0, lpOverlapped=0x0) returned 1 [0094.766] CloseHandle (hObject=0x154) returned 1 [0094.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6c [0094.766] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.anonymous", lpFilePart=0x0) returned 0x76 [0094.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.766] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd76cbff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ec0)) returned 1 [0094.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.anonymous")) returned 1 [0094.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpFilePart=0x0) returned 0x6c [0094.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.767] GetFileType (hFile=0x154) returned 0x1 [0094.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.767] GetFileType (hFile=0x154) returned 0x1 [0094.767] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x40f [0094.767] ReadFile (in: hFile=0x154, lpBuffer=0x1b27144, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b27144*, lpNumberOfBytesRead=0x2ae404*=0x40f, lpOverlapped=0x0) returned 1 [0094.769] CloseHandle (hObject=0x154) returned 1 [0094.781] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpFilePart=0x0) returned 0x6c [0094.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.786] GetFileType (hFile=0x154) returned 0x1 [0094.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.786] GetFileType (hFile=0x154) returned 0x1 [0094.786] WriteFile (in: hFile=0x154, lpBuffer=0x1b76510*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b76510*, lpNumberOfBytesWritten=0x2ae3cc*=0x410, lpOverlapped=0x0) returned 1 [0094.787] CloseHandle (hObject=0x154) returned 1 [0094.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpFilePart=0x0) returned 0x6c [0094.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.anonymous", lpFilePart=0x0) returned 0x76 [0094.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.787] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd76f2150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x410)) returned 1 [0094.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.anonymous")) returned 1 [0094.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x62 [0094.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.788] GetFileType (hFile=0x154) returned 0x1 [0094.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.788] GetFileType (hFile=0x154) returned 0x1 [0094.788] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5690 [0094.788] ReadFile (in: hFile=0x154, lpBuffer=0x1b7796c, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7796c*, lpNumberOfBytesRead=0x2ae404*=0x5690, lpOverlapped=0x0) returned 1 [0094.790] CloseHandle (hObject=0x154) returned 1 [0094.842] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x62 [0094.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.844] GetFileType (hFile=0x154) returned 0x1 [0094.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.844] GetFileType (hFile=0x154) returned 0x1 [0094.844] WriteFile (in: hFile=0x154, lpBuffer=0x19e3540*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19e3540*, lpNumberOfBytesWritten=0x2ae3f8*=0x56a0, lpOverlapped=0x0) returned 1 [0094.846] CloseHandle (hObject=0x154) returned 1 [0094.846] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x62 [0094.846] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.anonymous", lpFilePart=0x0) returned 0x6c [0094.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.846] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd778a6d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x56a0)) returned 1 [0094.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.anonymous")) returned 1 [0094.847] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpFilePart=0x0) returned 0x60 [0094.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.848] GetFileType (hFile=0x154) returned 0x1 [0094.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.848] GetFileType (hFile=0x154) returned 0x1 [0094.848] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x6a [0094.848] ReadFile (in: hFile=0x154, lpBuffer=0x19e91cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e91cc*, lpNumberOfBytesRead=0x2ae404*=0x6a, lpOverlapped=0x0) returned 1 [0094.849] CloseHandle (hObject=0x154) returned 1 [0094.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpFilePart=0x0) returned 0x60 [0094.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0094.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.868] GetFileType (hFile=0x154) returned 0x1 [0094.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0094.868] GetFileType (hFile=0x154) returned 0x1 [0094.868] WriteFile (in: hFile=0x154, lpBuffer=0x1a37320*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a37320*, lpNumberOfBytesWritten=0x2ae3cc*=0x70, lpOverlapped=0x0) returned 1 [0094.881] CloseHandle (hObject=0x154) returned 1 [0094.882] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpFilePart=0x0) returned 0x60 [0094.882] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.anonymous", lpFilePart=0x0) returned 0x6a [0094.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0094.882] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2133af00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd77d6990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0094.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0094.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.anonymous")) returned 1 [0094.882] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x65 [0094.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0094.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0094.883] GetFileType (hFile=0x154) returned 0x1 [0094.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0094.883] GetFileType (hFile=0x154) returned 0x1 [0094.883] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x21a6 [0094.883] ReadFile (in: hFile=0x154, lpBuffer=0x1a38740, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a38740*, lpNumberOfBytesRead=0x2ae404*=0x21a6, lpOverlapped=0x0) returned 1 [0095.224] CloseHandle (hObject=0x154) returned 1 [0095.266] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x65 [0095.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.268] GetFileType (hFile=0x154) returned 0x1 [0095.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.268] GetFileType (hFile=0x154) returned 0x1 [0095.268] WriteFile (in: hFile=0x154, lpBuffer=0x1a8fd9c*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a8fd9c*, lpNumberOfBytesWritten=0x2ae3f8*=0x21b0, lpOverlapped=0x0) returned 1 [0095.270] CloseHandle (hObject=0x154) returned 1 [0095.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x65 [0095.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.anonymous", lpFilePart=0x0) returned 0x6f [0095.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7b8ebf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21b0)) returned 1 [0095.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.anonymous")) returned 1 [0095.271] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x64 [0095.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.271] GetFileType (hFile=0x154) returned 0x1 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.272] GetFileType (hFile=0x154) returned 0x1 [0095.272] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3d57 [0095.272] ReadFile (in: hFile=0x154, lpBuffer=0x1a924e8, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a924e8*, lpNumberOfBytesRead=0x2ae404*=0x3d57, lpOverlapped=0x0) returned 1 [0095.281] CloseHandle (hObject=0x154) returned 1 [0095.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x64 [0095.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.305] GetFileType (hFile=0x154) returned 0x1 [0095.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.306] GetFileType (hFile=0x154) returned 0x1 [0095.306] WriteFile (in: hFile=0x154, lpBuffer=0x1af25b4*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1af25b4*, lpNumberOfBytesWritten=0x2ae3f8*=0x3d60, lpOverlapped=0x0) returned 1 [0095.307] CloseHandle (hObject=0x154) returned 1 [0095.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x64 [0095.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.anonymous", lpFilePart=0x0) returned 0x6e [0095.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7c01010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d60)) returned 1 [0095.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.anonymous")) returned 1 [0095.309] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpFilePart=0x0) returned 0x61 [0095.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.309] GetFileType (hFile=0x154) returned 0x1 [0095.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.309] GetFileType (hFile=0x154) returned 0x1 [0095.309] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1845 [0095.309] ReadFile (in: hFile=0x154, lpBuffer=0x1af68a0, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af68a0*, lpNumberOfBytesRead=0x2ae404*=0x1845, lpOverlapped=0x0) returned 1 [0095.313] CloseHandle (hObject=0x154) returned 1 [0095.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpFilePart=0x0) returned 0x61 [0095.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.333] GetFileType (hFile=0x154) returned 0x1 [0095.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.334] GetFileType (hFile=0x154) returned 0x1 [0095.334] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b01c*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b4b01c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1850, lpOverlapped=0x0) returned 1 [0095.335] CloseHandle (hObject=0x154) returned 1 [0095.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpFilePart=0x0) returned 0x61 [0095.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.anonymous", lpFilePart=0x0) returned 0x6b [0095.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.335] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7c27170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1850)) returned 1 [0095.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.anonymous")) returned 1 [0095.336] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x63 [0095.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.336] GetFileType (hFile=0x154) returned 0x1 [0095.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.336] GetFileType (hFile=0x154) returned 0x1 [0095.336] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5141 [0095.336] ReadFile (in: hFile=0x154, lpBuffer=0x1b4cddc, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b4cddc*, lpNumberOfBytesRead=0x2ae404*=0x5141, lpOverlapped=0x0) returned 1 [0095.341] CloseHandle (hObject=0x154) returned 1 [0095.380] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x63 [0095.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.382] GetFileType (hFile=0x154) returned 0x1 [0095.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.382] GetFileType (hFile=0x154) returned 0x1 [0095.382] WriteFile (in: hFile=0x154, lpBuffer=0x19b2d28*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19b2d28*, lpNumberOfBytesWritten=0x2ae3f8*=0x5150, lpOverlapped=0x0) returned 1 [0095.383] CloseHandle (hObject=0x154) returned 1 [0095.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x63 [0095.383] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.anonymous", lpFilePart=0x0) returned 0x6d [0095.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.383] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7c99590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5150)) returned 1 [0095.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.anonymous")) returned 1 [0095.385] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x66 [0095.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.386] GetFileType (hFile=0x154) returned 0x1 [0095.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.386] GetFileType (hFile=0x154) returned 0x1 [0095.386] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x193c [0095.386] ReadFile (in: hFile=0x154, lpBuffer=0x19b8408, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19b8408*, lpNumberOfBytesRead=0x2ae404*=0x193c, lpOverlapped=0x0) returned 1 [0095.393] CloseHandle (hObject=0x154) returned 1 [0095.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x66 [0095.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.406] GetFileType (hFile=0x154) returned 0x1 [0095.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.407] GetFileType (hFile=0x154) returned 0x1 [0095.407] WriteFile (in: hFile=0x154, lpBuffer=0x1a0d030*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a0d030*, lpNumberOfBytesWritten=0x2ae3f8*=0x1940, lpOverlapped=0x0) returned 1 [0095.408] CloseHandle (hObject=0x154) returned 1 [0095.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x66 [0095.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.anonymous", lpFilePart=0x0) returned 0x70 [0095.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.408] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a28890, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7ce5850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0095.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.anonymous")) returned 1 [0095.409] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x64 [0095.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.409] GetFileType (hFile=0x154) returned 0x1 [0095.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.410] GetFileType (hFile=0x154) returned 0x1 [0095.410] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3c64 [0095.410] ReadFile (in: hFile=0x154, lpBuffer=0x1a0ef1c, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a0ef1c*, lpNumberOfBytesRead=0x2ae404*=0x3c64, lpOverlapped=0x0) returned 1 [0095.411] CloseHandle (hObject=0x154) returned 1 [0095.424] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x64 [0095.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.426] GetFileType (hFile=0x154) returned 0x1 [0095.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.426] GetFileType (hFile=0x154) returned 0x1 [0095.426] WriteFile (in: hFile=0x154, lpBuffer=0x1a6eb34*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a6eb34*, lpNumberOfBytesWritten=0x2ae3f8*=0x3c70, lpOverlapped=0x0) returned 1 [0095.427] CloseHandle (hObject=0x154) returned 1 [0095.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x64 [0095.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.anonymous", lpFilePart=0x0) returned 0x6e [0095.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.428] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c80030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7d0b9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c70)) returned 1 [0095.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.anonymous")) returned 1 [0095.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpFilePart=0x0) returned 0x62 [0095.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.429] GetFileType (hFile=0x154) returned 0x1 [0095.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.429] GetFileType (hFile=0x154) returned 0x1 [0095.429] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x171 [0095.429] ReadFile (in: hFile=0x154, lpBuffer=0x1a72eb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a72eb4*, lpNumberOfBytesRead=0x2ae404*=0x171, lpOverlapped=0x0) returned 1 [0095.430] CloseHandle (hObject=0x154) returned 1 [0095.443] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpFilePart=0x0) returned 0x62 [0095.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.444] GetFileType (hFile=0x154) returned 0x1 [0095.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.445] GetFileType (hFile=0x154) returned 0x1 [0095.445] WriteFile (in: hFile=0x154, lpBuffer=0x1ac1594*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ac1594*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0095.446] CloseHandle (hObject=0x154) returned 1 [0095.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpFilePart=0x0) returned 0x62 [0095.446] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.anonymous", lpFilePart=0x0) returned 0x6c [0095.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.446] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b33230, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7d31b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0095.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.anonymous")) returned 1 [0095.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpFilePart=0x0) returned 0x67 [0095.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.447] GetFileType (hFile=0x154) returned 0x1 [0095.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.447] GetFileType (hFile=0x154) returned 0x1 [0095.447] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x176 [0095.447] ReadFile (in: hFile=0x154, lpBuffer=0x1ac2b4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac2b4c*, lpNumberOfBytesRead=0x2ae404*=0x176, lpOverlapped=0x0) returned 1 [0095.448] CloseHandle (hObject=0x154) returned 1 [0095.460] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpFilePart=0x0) returned 0x67 [0095.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.462] GetFileType (hFile=0x154) returned 0x1 [0095.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.462] GetFileType (hFile=0x154) returned 0x1 [0095.462] WriteFile (in: hFile=0x154, lpBuffer=0x1b1123c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b1123c*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0095.463] CloseHandle (hObject=0x154) returned 1 [0095.463] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpFilePart=0x0) returned 0x67 [0095.463] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.anonymous", lpFilePart=0x0) returned 0x71 [0095.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.463] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7d7ddd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0095.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.anonymous")) returned 1 [0095.464] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpFilePart=0x0) returned 0x61 [0095.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.479] GetFileType (hFile=0x154) returned 0x1 [0095.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.479] GetFileType (hFile=0x154) returned 0x1 [0095.479] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb5 [0095.479] ReadFile (in: hFile=0x154, lpBuffer=0x1b12734, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b12734*, lpNumberOfBytesRead=0x2ae404*=0xb5, lpOverlapped=0x0) returned 1 [0095.480] CloseHandle (hObject=0x154) returned 1 [0095.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpFilePart=0x0) returned 0x61 [0095.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.496] GetFileType (hFile=0x154) returned 0x1 [0095.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.496] GetFileType (hFile=0x154) returned 0x1 [0095.496] WriteFile (in: hFile=0x154, lpBuffer=0x1b60930*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b60930*, lpNumberOfBytesWritten=0x2ae3cc*=0xc0, lpOverlapped=0x0) returned 1 [0095.497] CloseHandle (hObject=0x154) returned 1 [0095.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpFilePart=0x0) returned 0x61 [0095.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.anonymous", lpFilePart=0x0) returned 0x6b [0095.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.498] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7dca090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0095.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.anonymous")) returned 1 [0095.499] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpFilePart=0x0) returned 0x66 [0095.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.499] GetFileType (hFile=0x154) returned 0x1 [0095.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.499] GetFileType (hFile=0x154) returned 0x1 [0095.499] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb7 [0095.499] ReadFile (in: hFile=0x154, lpBuffer=0x1b61e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b61e18*, lpNumberOfBytesRead=0x2ae404*=0xb7, lpOverlapped=0x0) returned 1 [0095.501] CloseHandle (hObject=0x154) returned 1 [0095.539] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpFilePart=0x0) returned 0x66 [0095.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.540] GetFileType (hFile=0x154) returned 0x1 [0095.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.540] GetFileType (hFile=0x154) returned 0x1 [0095.540] WriteFile (in: hFile=0x154, lpBuffer=0x19aafc8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19aafc8*, lpNumberOfBytesWritten=0x2ae3cc*=0xc0, lpOverlapped=0x0) returned 1 [0095.541] CloseHandle (hObject=0x154) returned 1 [0095.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpFilePart=0x0) returned 0x66 [0095.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.anonymous", lpFilePart=0x0) returned 0x70 [0095.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.542] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7e3c4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0095.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.anonymous")) returned 1 [0095.542] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpFilePart=0x0) returned 0x63 [0095.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.543] GetFileType (hFile=0x154) returned 0x1 [0095.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.543] GetFileType (hFile=0x154) returned 0x1 [0095.543] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x171 [0095.543] ReadFile (in: hFile=0x154, lpBuffer=0x19ac584, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ac584*, lpNumberOfBytesRead=0x2ae404*=0x171, lpOverlapped=0x0) returned 1 [0095.544] CloseHandle (hObject=0x154) returned 1 [0095.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpFilePart=0x0) returned 0x63 [0095.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.558] GetFileType (hFile=0x154) returned 0x1 [0095.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.558] GetFileType (hFile=0x154) returned 0x1 [0095.558] WriteFile (in: hFile=0x154, lpBuffer=0x19fac68*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19fac68*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0095.559] CloseHandle (hObject=0x154) returned 1 [0095.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpFilePart=0x0) returned 0x63 [0095.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.anonymous", lpFilePart=0x0) returned 0x6d [0095.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.559] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7e62610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0095.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.anonymous")) returned 1 [0095.560] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpFilePart=0x0) returned 0x68 [0095.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.560] GetFileType (hFile=0x154) returned 0x1 [0095.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.560] GetFileType (hFile=0x154) returned 0x1 [0095.560] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x244 [0095.560] ReadFile (in: hFile=0x154, lpBuffer=0x19fc2f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fc2f0*, lpNumberOfBytesRead=0x2ae404*=0x244, lpOverlapped=0x0) returned 1 [0095.572] CloseHandle (hObject=0x154) returned 1 [0095.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpFilePart=0x0) returned 0x68 [0095.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.585] GetFileType (hFile=0x154) returned 0x1 [0095.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.585] GetFileType (hFile=0x154) returned 0x1 [0095.585] WriteFile (in: hFile=0x154, lpBuffer=0x1a4adf4*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a4adf4*, lpNumberOfBytesWritten=0x2ae3cc*=0x250, lpOverlapped=0x0) returned 1 [0095.586] CloseHandle (hObject=0x154) returned 1 [0095.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpFilePart=0x0) returned 0x68 [0095.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.anonymous", lpFilePart=0x0) returned 0x72 [0095.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.586] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2264dc00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7e88770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0095.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.anonymous")) returned 1 [0095.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0095.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.588] GetFileType (hFile=0x154) returned 0x1 [0095.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.588] GetFileType (hFile=0x154) returned 0x1 [0095.588] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x45d [0095.588] ReadFile (in: hFile=0x154, lpBuffer=0x1a4c728, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a4c728*, lpNumberOfBytesRead=0x2ae404*=0x45d, lpOverlapped=0x0) returned 1 [0095.590] CloseHandle (hObject=0x154) returned 1 [0095.602] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0095.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.603] GetFileType (hFile=0x154) returned 0x1 [0095.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.603] GetFileType (hFile=0x154) returned 0x1 [0095.603] WriteFile (in: hFile=0x154, lpBuffer=0x1a9bc6c*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a9bc6c*, lpNumberOfBytesWritten=0x2ae3cc*=0x460, lpOverlapped=0x0) returned 1 [0095.604] CloseHandle (hObject=0x154) returned 1 [0095.604] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0095.605] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.anonymous", lpFilePart=0x0) returned 0x70 [0095.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.605] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23960900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7ed4a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0095.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.anonymous")) returned 1 [0095.605] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0095.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.606] GetFileType (hFile=0x154) returned 0x1 [0095.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.606] GetFileType (hFile=0x154) returned 0x1 [0095.606] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x850 [0095.606] ReadFile (in: hFile=0x154, lpBuffer=0x1a9d924, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a9d924*, lpNumberOfBytesRead=0x2ae404*=0x850, lpOverlapped=0x0) returned 1 [0095.615] CloseHandle (hObject=0x154) returned 1 [0095.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0095.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.635] GetFileType (hFile=0x154) returned 0x1 [0095.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.635] GetFileType (hFile=0x154) returned 0x1 [0095.635] WriteFile (in: hFile=0x154, lpBuffer=0x1aee288*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aee288*, lpNumberOfBytesWritten=0x2ae3cc*=0x860, lpOverlapped=0x0) returned 1 [0095.637] CloseHandle (hObject=0x154) returned 1 [0095.637] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0095.637] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.anonymous", lpFilePart=0x0) returned 0x75 [0095.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23960900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7f20cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0095.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.anonymous")) returned 1 [0095.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0095.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.640] GetFileType (hFile=0x154) returned 0x1 [0095.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.640] GetFileType (hFile=0x154) returned 0x1 [0095.640] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ed [0095.640] ReadFile (in: hFile=0x154, lpBuffer=0x1aef9e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aef9e8*, lpNumberOfBytesRead=0x2ae404*=0x2ed, lpOverlapped=0x0) returned 1 [0095.642] CloseHandle (hObject=0x154) returned 1 [0095.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0095.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.662] GetFileType (hFile=0x154) returned 0x1 [0095.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.662] GetFileType (hFile=0x154) returned 0x1 [0095.662] WriteFile (in: hFile=0x154, lpBuffer=0x1b3e800*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3e800*, lpNumberOfBytesWritten=0x2ae3cc*=0x2f0, lpOverlapped=0x0) returned 1 [0095.663] CloseHandle (hObject=0x154) returned 1 [0095.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0095.663] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.anonymous", lpFilePart=0x0) returned 0x71 [0095.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.663] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23960900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7f46e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0095.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.anonymous")) returned 1 [0095.665] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0095.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.665] GetFileType (hFile=0x154) returned 0x1 [0095.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.665] GetFileType (hFile=0x154) returned 0x1 [0095.665] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc94 [0095.665] ReadFile (in: hFile=0x154, lpBuffer=0x1b408f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b408f4*, lpNumberOfBytesRead=0x2ae404*=0xc94, lpOverlapped=0x0) returned 1 [0095.667] CloseHandle (hObject=0x154) returned 1 [0095.685] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0095.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.687] GetFileType (hFile=0x154) returned 0x1 [0095.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.687] GetFileType (hFile=0x154) returned 0x1 [0095.687] WriteFile (in: hFile=0x154, lpBuffer=0x1b9278c*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b9278c*, lpNumberOfBytesWritten=0x2ae3cc*=0xca0, lpOverlapped=0x0) returned 1 [0095.688] CloseHandle (hObject=0x154) returned 1 [0095.688] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0095.688] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.anonymous", lpFilePart=0x0) returned 0x73 [0095.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23960900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd7f93110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xca0)) returned 1 [0095.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.anonymous")) returned 1 [0095.689] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpFilePart=0x0) returned 0x65 [0095.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.693] GetFileType (hFile=0x154) returned 0x1 [0095.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.693] GetFileType (hFile=0x154) returned 0x1 [0095.693] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc7c [0095.693] ReadFile (in: hFile=0x154, lpBuffer=0x1b94864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b94864*, lpNumberOfBytesRead=0x2ae404*=0xc7c, lpOverlapped=0x0) returned 1 [0095.707] CloseHandle (hObject=0x154) returned 1 [0095.746] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpFilePart=0x0) returned 0x65 [0095.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.749] GetFileType (hFile=0x154) returned 0x1 [0095.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.749] GetFileType (hFile=0x154) returned 0x1 [0095.749] WriteFile (in: hFile=0x154, lpBuffer=0x19e61f4*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19e61f4*, lpNumberOfBytesWritten=0x2ae3cc*=0xc80, lpOverlapped=0x0) returned 1 [0095.752] CloseHandle (hObject=0x154) returned 1 [0095.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpFilePart=0x0) returned 0x65 [0095.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.anonymous", lpFilePart=0x0) returned 0x6f [0095.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.752] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23960900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd802b690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1 [0095.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.anonymous")) returned 1 [0095.753] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0095.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.754] GetFileType (hFile=0x154) returned 0x1 [0095.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.754] GetFileType (hFile=0x154) returned 0x1 [0095.754] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x7ee [0095.754] ReadFile (in: hFile=0x154, lpBuffer=0x19e7e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e7e68*, lpNumberOfBytesRead=0x2ae404*=0x7ee, lpOverlapped=0x0) returned 1 [0095.755] CloseHandle (hObject=0x154) returned 1 [0095.769] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0095.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.770] GetFileType (hFile=0x154) returned 0x1 [0095.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.770] GetFileType (hFile=0x154) returned 0x1 [0095.770] WriteFile (in: hFile=0x154, lpBuffer=0x1a3858c*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a3858c*, lpNumberOfBytesWritten=0x2ae3cc*=0x7f0, lpOverlapped=0x0) returned 1 [0095.771] CloseHandle (hObject=0x154) returned 1 [0095.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0095.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0095.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.772] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23960900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd80517f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7f0)) returned 1 [0095.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.anonymous")) returned 1 [0095.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0095.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.773] GetFileType (hFile=0x154) returned 0x1 [0095.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.773] GetFileType (hFile=0x154) returned 0x1 [0095.773] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x856 [0095.773] ReadFile (in: hFile=0x154, lpBuffer=0x1a3a260, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3a260*, lpNumberOfBytesRead=0x2ae404*=0x856, lpOverlapped=0x0) returned 1 [0095.774] CloseHandle (hObject=0x154) returned 1 [0095.786] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0095.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.788] GetFileType (hFile=0x154) returned 0x1 [0095.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.788] GetFileType (hFile=0x154) returned 0x1 [0095.788] WriteFile (in: hFile=0x154, lpBuffer=0x1a8abbc*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a8abbc*, lpNumberOfBytesWritten=0x2ae3cc*=0x860, lpOverlapped=0x0) returned 1 [0095.789] CloseHandle (hObject=0x154) returned 1 [0095.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0095.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0095.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.789] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c73600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8077950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0095.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.anonymous")) returned 1 [0095.790] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0095.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.791] GetFileType (hFile=0x154) returned 0x1 [0095.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.791] GetFileType (hFile=0x154) returned 0x1 [0095.791] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x46fe [0095.791] ReadFile (in: hFile=0x154, lpBuffer=0x1a8c034, nNumberOfBytesToRead=0x46fe, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8c034*, lpNumberOfBytesRead=0x2ae404*=0x46fe, lpOverlapped=0x0) returned 1 [0095.793] CloseHandle (hObject=0x154) returned 1 [0095.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0095.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.807] GetFileType (hFile=0x154) returned 0x1 [0095.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.807] GetFileType (hFile=0x154) returned 0x1 [0095.807] WriteFile (in: hFile=0x154, lpBuffer=0x1aef120*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aef120*, lpNumberOfBytesWritten=0x2ae3f8*=0x4700, lpOverlapped=0x0) returned 1 [0095.809] CloseHandle (hObject=0x154) returned 1 [0095.809] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0095.809] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.anonymous", lpFilePart=0x0) returned 0x76 [0095.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.809] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c73600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd80c3c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4700)) returned 1 [0095.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.anonymous")) returned 1 [0095.810] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0095.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.810] GetFileType (hFile=0x154) returned 0x1 [0095.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.810] GetFileType (hFile=0x154) returned 0x1 [0095.810] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x612 [0095.810] ReadFile (in: hFile=0x154, lpBuffer=0x1af4440, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af4440*, lpNumberOfBytesRead=0x2ae404*=0x612, lpOverlapped=0x0) returned 1 [0095.812] CloseHandle (hObject=0x154) returned 1 [0095.825] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0095.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.826] GetFileType (hFile=0x154) returned 0x1 [0095.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.826] GetFileType (hFile=0x154) returned 0x1 [0095.826] WriteFile (in: hFile=0x154, lpBuffer=0x1b44260*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b44260*, lpNumberOfBytesWritten=0x2ae3cc*=0x620, lpOverlapped=0x0) returned 1 [0095.827] CloseHandle (hObject=0x154) returned 1 [0095.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0095.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0095.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.828] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c73600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd80e9d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x620)) returned 1 [0095.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.anonymous")) returned 1 [0095.829] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0095.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.829] GetFileType (hFile=0x154) returned 0x1 [0095.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.829] GetFileType (hFile=0x154) returned 0x1 [0095.829] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ee3 [0095.829] ReadFile (in: hFile=0x154, lpBuffer=0x1b456fc, nNumberOfBytesToRead=0x2ee3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b456fc*, lpNumberOfBytesRead=0x2ae404*=0x2ee3, lpOverlapped=0x0) returned 1 [0095.853] CloseHandle (hObject=0x154) returned 1 [0095.891] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0095.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.893] GetFileType (hFile=0x154) returned 0x1 [0095.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.893] GetFileType (hFile=0x154) returned 0x1 [0095.893] WriteFile (in: hFile=0x154, lpBuffer=0x198666c*, nNumberOfBytesToWrite=0x2ef0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x198666c*, lpNumberOfBytesWritten=0x2ae3f8*=0x2ef0, lpOverlapped=0x0) returned 1 [0095.894] CloseHandle (hObject=0x154) returned 1 [0095.895] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0095.895] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.anonymous", lpFilePart=0x0) returned 0x79 [0095.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.895] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd81822f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ef0)) returned 1 [0095.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.anonymous")) returned 1 [0095.895] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0095.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.896] GetFileType (hFile=0x154) returned 0x1 [0095.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.896] GetFileType (hFile=0x154) returned 0x1 [0095.896] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x638 [0095.896] ReadFile (in: hFile=0x154, lpBuffer=0x198a1dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x198a1dc*, lpNumberOfBytesRead=0x2ae404*=0x638, lpOverlapped=0x0) returned 1 [0095.898] CloseHandle (hObject=0x154) returned 1 [0095.947] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0095.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.948] GetFileType (hFile=0x154) returned 0x1 [0095.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.948] GetFileType (hFile=0x154) returned 0x1 [0095.949] WriteFile (in: hFile=0x154, lpBuffer=0x19da214*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19da214*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0095.950] CloseHandle (hObject=0x154) returned 1 [0095.950] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0095.950] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x7d [0095.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.950] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd821a870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0095.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.anonymous")) returned 1 [0095.951] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpFilePart=0x0) returned 0x66 [0095.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.951] GetFileType (hFile=0x154) returned 0x1 [0095.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.951] GetFileType (hFile=0x154) returned 0x1 [0095.951] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1313 [0095.951] ReadFile (in: hFile=0x154, lpBuffer=0x19db6a4, nNumberOfBytesToRead=0x1313, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19db6a4*, lpNumberOfBytesRead=0x2ae404*=0x1313, lpOverlapped=0x0) returned 1 [0095.952] CloseHandle (hObject=0x154) returned 1 [0095.965] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpFilePart=0x0) returned 0x66 [0095.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.967] GetFileType (hFile=0x154) returned 0x1 [0095.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.967] GetFileType (hFile=0x154) returned 0x1 [0095.967] WriteFile (in: hFile=0x154, lpBuffer=0x1a2e430*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a2e430*, lpNumberOfBytesWritten=0x2ae3f8*=0x1320, lpOverlapped=0x0) returned 1 [0095.969] CloseHandle (hObject=0x154) returned 1 [0095.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpFilePart=0x0) returned 0x66 [0095.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.anonymous", lpFilePart=0x0) returned 0x70 [0095.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0095.969] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd82409d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1320)) returned 1 [0095.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0095.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.anonymous")) returned 1 [0095.971] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpFilePart=0x0) returned 0x69 [0095.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0095.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.971] GetFileType (hFile=0x154) returned 0x1 [0095.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0095.971] GetFileType (hFile=0x154) returned 0x1 [0095.971] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa89 [0095.971] ReadFile (in: hFile=0x154, lpBuffer=0x1a307a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a307a8*, lpNumberOfBytesRead=0x2ae404*=0xa89, lpOverlapped=0x0) returned 1 [0095.975] CloseHandle (hObject=0x154) returned 1 [0095.994] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpFilePart=0x0) returned 0x69 [0095.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0095.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0095.998] GetFileType (hFile=0x154) returned 0x1 [0095.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0095.998] GetFileType (hFile=0x154) returned 0x1 [0095.998] WriteFile (in: hFile=0x154, lpBuffer=0x1a81bec*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a81bec*, lpNumberOfBytesWritten=0x2ae3cc*=0xa90, lpOverlapped=0x0) returned 1 [0096.002] CloseHandle (hObject=0x154) returned 1 [0096.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpFilePart=0x0) returned 0x69 [0096.002] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.anonymous", lpFilePart=0x0) returned 0x73 [0096.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.002] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e343d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd828cc90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa90)) returned 1 [0096.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.anonymous")) returned 1 [0096.003] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpFilePart=0x0) returned 0x65 [0096.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.005] GetFileType (hFile=0x154) returned 0x1 [0096.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.005] GetFileType (hFile=0x154) returned 0x1 [0096.005] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1bfb [0096.005] ReadFile (in: hFile=0x154, lpBuffer=0x1a8303c, nNumberOfBytesToRead=0x1bfb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8303c*, lpNumberOfBytesRead=0x2ae404*=0x1bfb, lpOverlapped=0x0) returned 1 [0096.017] CloseHandle (hObject=0x154) returned 1 [0096.029] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpFilePart=0x0) returned 0x65 [0096.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.031] GetFileType (hFile=0x154) returned 0x1 [0096.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.031] GetFileType (hFile=0x154) returned 0x1 [0096.031] WriteFile (in: hFile=0x154, lpBuffer=0x1ad8a28*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ad8a28*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c00, lpOverlapped=0x0) returned 1 [0096.033] CloseHandle (hObject=0x154) returned 1 [0096.033] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpFilePart=0x0) returned 0x65 [0096.033] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.anonymous", lpFilePart=0x0) returned 0x6f [0096.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.033] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd82d8f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0096.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.anonymous")) returned 1 [0096.037] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0096.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.038] GetFileType (hFile=0x154) returned 0x1 [0096.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.038] GetFileType (hFile=0x154) returned 0x1 [0096.038] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x30074 [0096.039] ReadFile (in: hFile=0x154, lpBuffer=0x15572100, nNumberOfBytesToRead=0x30074, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x15572100*, lpNumberOfBytesRead=0x2ae404*=0x30074, lpOverlapped=0x0) returned 1 [0096.060] CloseHandle (hObject=0x154) returned 1 [0096.088] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0096.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.092] GetFileType (hFile=0x154) returned 0x1 [0096.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.092] GetFileType (hFile=0x154) returned 0x1 [0096.092] WriteFile (in: hFile=0x154, lpBuffer=0x156623b0*, nNumberOfBytesToWrite=0x30080, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x156623b0*, lpNumberOfBytesWritten=0x2ae3f8*=0x30080, lpOverlapped=0x0) returned 1 [0096.098] CloseHandle (hObject=0x154) returned 1 [0096.098] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0096.098] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.anonymous", lpFilePart=0x0) returned 0x6e [0096.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.098] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c42a00, ftCreationTime.dwHighDateTime=0x1c9ff01, ftLastAccessTime.dwLowDateTime=0x8d142170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd83714d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30080)) returned 1 [0096.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.anonymous")) returned 1 [0096.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0096.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.101] GetFileType (hFile=0x154) returned 0x1 [0096.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.101] GetFileType (hFile=0x154) returned 0x1 [0096.101] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x350 [0096.101] ReadFile (in: hFile=0x154, lpBuffer=0x1b282f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b282f0*, lpNumberOfBytesRead=0x2ae404*=0x350, lpOverlapped=0x0) returned 1 [0096.119] CloseHandle (hObject=0x154) returned 1 [0096.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0096.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.139] GetFileType (hFile=0x154) returned 0x1 [0096.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.139] GetFileType (hFile=0x154) returned 0x1 [0096.139] WriteFile (in: hFile=0x154, lpBuffer=0x1b77338*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b77338*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0096.140] CloseHandle (hObject=0x154) returned 1 [0096.140] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0096.140] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.anonymous", lpFilePart=0x0) returned 0x6e [0096.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.140] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd83e38f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0096.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.anonymous")) returned 1 [0096.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0096.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.143] GetFileType (hFile=0x154) returned 0x1 [0096.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.143] GetFileType (hFile=0x154) returned 0x1 [0096.143] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x34f [0096.143] ReadFile (in: hFile=0x154, lpBuffer=0x1b78acc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b78acc*, lpNumberOfBytesRead=0x2ae404*=0x34f, lpOverlapped=0x0) returned 1 [0096.166] CloseHandle (hObject=0x154) returned 1 [0096.217] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0096.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.219] GetFileType (hFile=0x154) returned 0x1 [0096.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.219] GetFileType (hFile=0x154) returned 0x1 [0096.219] WriteFile (in: hFile=0x154, lpBuffer=0x19c1cac*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c1cac*, lpNumberOfBytesWritten=0x2ae3cc*=0x350, lpOverlapped=0x0) returned 1 [0096.221] CloseHandle (hObject=0x154) returned 1 [0096.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0096.221] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.anonymous", lpFilePart=0x0) returned 0x6f [0096.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.221] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd84a1fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0096.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.anonymous")) returned 1 [0096.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0096.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.223] GetFileType (hFile=0x154) returned 0x1 [0096.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.223] GetFileType (hFile=0x154) returned 0x1 [0096.223] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x365 [0096.223] ReadFile (in: hFile=0x154, lpBuffer=0x19c3464, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c3464*, lpNumberOfBytesRead=0x2ae404*=0x365, lpOverlapped=0x0) returned 1 [0096.225] CloseHandle (hObject=0x154) returned 1 [0096.242] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0096.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.244] GetFileType (hFile=0x154) returned 0x1 [0096.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.244] GetFileType (hFile=0x154) returned 0x1 [0096.244] WriteFile (in: hFile=0x154, lpBuffer=0x1a1264c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1264c*, lpNumberOfBytesWritten=0x2ae3cc*=0x370, lpOverlapped=0x0) returned 1 [0096.246] CloseHandle (hObject=0x154) returned 1 [0096.246] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0096.246] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.anonymous", lpFilePart=0x0) returned 0x6c [0096.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.246] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd84ee290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0096.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.anonymous")) returned 1 [0096.247] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0096.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.247] GetFileType (hFile=0x154) returned 0x1 [0096.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.247] GetFileType (hFile=0x154) returned 0x1 [0096.247] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x34f [0096.247] ReadFile (in: hFile=0x154, lpBuffer=0x1a13dc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a13dc4*, lpNumberOfBytesRead=0x2ae404*=0x34f, lpOverlapped=0x0) returned 1 [0096.257] CloseHandle (hObject=0x154) returned 1 [0096.274] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0096.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.276] GetFileType (hFile=0x154) returned 0x1 [0096.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.276] GetFileType (hFile=0x154) returned 0x1 [0096.276] WriteFile (in: hFile=0x154, lpBuffer=0x1a62da4*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a62da4*, lpNumberOfBytesWritten=0x2ae3cc*=0x350, lpOverlapped=0x0) returned 1 [0096.277] CloseHandle (hObject=0x154) returned 1 [0096.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0096.277] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.anonymous", lpFilePart=0x0) returned 0x6b [0096.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.277] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd853a550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0096.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.anonymous")) returned 1 [0096.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0096.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.279] GetFileType (hFile=0x154) returned 0x1 [0096.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.279] GetFileType (hFile=0x154) returned 0x1 [0096.280] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3ee [0096.280] ReadFile (in: hFile=0x154, lpBuffer=0x1a645c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a645c4*, lpNumberOfBytesRead=0x2ae404*=0x3ee, lpOverlapped=0x0) returned 1 [0096.283] CloseHandle (hObject=0x154) returned 1 [0096.300] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0096.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.304] GetFileType (hFile=0x154) returned 0x1 [0096.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.304] GetFileType (hFile=0x154) returned 0x1 [0096.304] WriteFile (in: hFile=0x154, lpBuffer=0x1ab38d8*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ab38d8*, lpNumberOfBytesWritten=0x2ae3cc*=0x3f0, lpOverlapped=0x0) returned 1 [0096.307] CloseHandle (hObject=0x154) returned 1 [0096.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0096.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.anonymous", lpFilePart=0x0) returned 0x70 [0096.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.307] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5669c00, ftCreationTime.dwHighDateTime=0x1ca039f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8586810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0096.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.anonymous")) returned 1 [0096.308] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x65 [0096.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.309] GetFileType (hFile=0x154) returned 0x1 [0096.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.309] GetFileType (hFile=0x154) returned 0x1 [0096.309] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x37a [0096.309] ReadFile (in: hFile=0x154, lpBuffer=0x1ab50a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab50a4*, lpNumberOfBytesRead=0x2ae404*=0x37a, lpOverlapped=0x0) returned 1 [0096.311] CloseHandle (hObject=0x154) returned 1 [0096.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x65 [0096.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.330] GetFileType (hFile=0x154) returned 0x1 [0096.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.330] GetFileType (hFile=0x154) returned 0x1 [0096.331] WriteFile (in: hFile=0x154, lpBuffer=0x1b04188*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b04188*, lpNumberOfBytesWritten=0x2ae3cc*=0x380, lpOverlapped=0x0) returned 1 [0096.332] CloseHandle (hObject=0x154) returned 1 [0096.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x65 [0096.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.anonymous", lpFilePart=0x0) returned 0x6f [0096.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.332] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bee4400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd85ac970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0096.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.anonymous")) returned 1 [0096.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0096.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.335] GetFileType (hFile=0x154) returned 0x1 [0096.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.335] GetFileType (hFile=0x154) returned 0x1 [0096.335] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35f [0096.335] ReadFile (in: hFile=0x154, lpBuffer=0x1b0593c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b0593c*, lpNumberOfBytesRead=0x2ae404*=0x35f, lpOverlapped=0x0) returned 1 [0096.346] CloseHandle (hObject=0x154) returned 1 [0096.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0096.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.360] GetFileType (hFile=0x154) returned 0x1 [0096.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.360] GetFileType (hFile=0x154) returned 0x1 [0096.360] WriteFile (in: hFile=0x154, lpBuffer=0x1b5498c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b5498c*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0096.361] CloseHandle (hObject=0x154) returned 1 [0096.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0096.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.anonymous", lpFilePart=0x0) returned 0x73 [0096.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.362] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd85f8c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0096.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.anonymous")) returned 1 [0096.362] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0096.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.363] GetFileType (hFile=0x154) returned 0x1 [0096.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.363] GetFileType (hFile=0x154) returned 0x1 [0096.363] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35d [0096.363] ReadFile (in: hFile=0x154, lpBuffer=0x1b56158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b56158*, lpNumberOfBytesRead=0x2ae404*=0x35d, lpOverlapped=0x0) returned 1 [0096.365] CloseHandle (hObject=0x154) returned 1 [0096.405] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0096.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.406] GetFileType (hFile=0x154) returned 0x1 [0096.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.406] GetFileType (hFile=0x154) returned 0x1 [0096.406] WriteFile (in: hFile=0x154, lpBuffer=0x19a6048*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a6048*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0096.407] CloseHandle (hObject=0x154) returned 1 [0096.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0096.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.anonymous", lpFilePart=0x0) returned 0x73 [0096.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.408] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd866b050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0096.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.anonymous")) returned 1 [0096.409] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpFilePart=0x0) returned 0x61 [0096.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.409] GetFileType (hFile=0x154) returned 0x1 [0096.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.410] GetFileType (hFile=0x154) returned 0x1 [0096.410] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x354 [0096.410] ReadFile (in: hFile=0x154, lpBuffer=0x19a77e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a77e8*, lpNumberOfBytesRead=0x2ae404*=0x354, lpOverlapped=0x0) returned 1 [0096.411] CloseHandle (hObject=0x154) returned 1 [0096.423] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpFilePart=0x0) returned 0x61 [0096.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.425] GetFileType (hFile=0x154) returned 0x1 [0096.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.425] GetFileType (hFile=0x154) returned 0x1 [0096.425] WriteFile (in: hFile=0x154, lpBuffer=0x19f697c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19f697c*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0096.426] CloseHandle (hObject=0x154) returned 1 [0096.426] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpFilePart=0x0) returned 0x61 [0096.426] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.anonymous", lpFilePart=0x0) returned 0x6b [0096.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.426] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd86911b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0096.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.anonymous")) returned 1 [0096.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0096.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.427] GetFileType (hFile=0x154) returned 0x1 [0096.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.427] GetFileType (hFile=0x154) returned 0x1 [0096.427] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x352 [0096.427] ReadFile (in: hFile=0x154, lpBuffer=0x19f80f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f80f0*, lpNumberOfBytesRead=0x2ae404*=0x352, lpOverlapped=0x0) returned 1 [0096.449] CloseHandle (hObject=0x154) returned 1 [0096.462] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0096.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.463] GetFileType (hFile=0x154) returned 0x1 [0096.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.464] GetFileType (hFile=0x154) returned 0x1 [0096.464] WriteFile (in: hFile=0x154, lpBuffer=0x1a47130*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a47130*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0096.465] CloseHandle (hObject=0x154) returned 1 [0096.465] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0096.465] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.anonymous", lpFilePart=0x0) returned 0x6c [0096.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.465] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd87035d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0096.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.anonymous")) returned 1 [0096.466] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0096.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.466] GetFileType (hFile=0x154) returned 0x1 [0096.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.467] GetFileType (hFile=0x154) returned 0x1 [0096.467] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x373 [0096.467] ReadFile (in: hFile=0x154, lpBuffer=0x1a488d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a488d0*, lpNumberOfBytesRead=0x2ae404*=0x373, lpOverlapped=0x0) returned 1 [0096.468] CloseHandle (hObject=0x154) returned 1 [0096.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0096.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.482] GetFileType (hFile=0x154) returned 0x1 [0096.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.482] GetFileType (hFile=0x154) returned 0x1 [0096.482] WriteFile (in: hFile=0x154, lpBuffer=0x1a979b0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a979b0*, lpNumberOfBytesWritten=0x2ae3cc*=0x380, lpOverlapped=0x0) returned 1 [0096.483] CloseHandle (hObject=0x154) returned 1 [0096.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0096.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.anonymous", lpFilePart=0x0) returned 0x6c [0096.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.483] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8729730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0096.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.anonymous")) returned 1 [0096.484] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpFilePart=0x0) returned 0x64 [0096.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.485] GetFileType (hFile=0x154) returned 0x1 [0096.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.485] GetFileType (hFile=0x154) returned 0x1 [0096.485] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35c [0096.485] ReadFile (in: hFile=0x154, lpBuffer=0x1a99140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a99140*, lpNumberOfBytesRead=0x2ae404*=0x35c, lpOverlapped=0x0) returned 1 [0096.487] CloseHandle (hObject=0x154) returned 1 [0096.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpFilePart=0x0) returned 0x64 [0096.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.501] GetFileType (hFile=0x154) returned 0x1 [0096.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.501] GetFileType (hFile=0x154) returned 0x1 [0096.501] WriteFile (in: hFile=0x154, lpBuffer=0x1ae817c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae817c*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0096.503] CloseHandle (hObject=0x154) returned 1 [0096.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpFilePart=0x0) returned 0x64 [0096.503] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.anonymous", lpFilePart=0x0) returned 0x6e [0096.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7100, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd874f890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0096.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.anonymous")) returned 1 [0096.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x68 [0096.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0096.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.504] GetFileType (hFile=0x154) returned 0x1 [0096.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0096.504] GetFileType (hFile=0x154) returned 0x1 [0096.504] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd78 [0096.504] ReadFile (in: hFile=0x154, lpBuffer=0x1aea3c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aea3c4*, lpNumberOfBytesRead=0x2ae404*=0xd78, lpOverlapped=0x0) returned 1 [0096.546] CloseHandle (hObject=0x154) returned 1 [0096.558] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x68 [0096.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0096.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.561] GetFileType (hFile=0x154) returned 0x1 [0096.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0096.562] GetFileType (hFile=0x154) returned 0x1 [0096.562] WriteFile (in: hFile=0x154, lpBuffer=0x1b3c6b4*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3c6b4*, lpNumberOfBytesWritten=0x2ae3cc*=0xd80, lpOverlapped=0x0) returned 1 [0096.564] CloseHandle (hObject=0x154) returned 1 [0096.564] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x68 [0096.564] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.anonymous", lpFilePart=0x0) returned 0x72 [0096.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0096.565] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e509e00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x851e8870, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd87e7e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd80)) returned 1 [0096.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.anonymous")) returned 1 [0096.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0096.565] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles", lpFilePart=0x0) returned 0x5e [0096.565] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpFilePart=0x0) returned 0x5f [0096.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0096.567] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.568] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.568] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.568] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.568] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.568] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.568] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.569] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.570] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.571] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.572] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.573] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.573] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0096.573] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0096.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0096.574] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles", lpFilePart=0x0) returned 0x5e [0096.574] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpFilePart=0x0) returned 0x5f [0096.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0096.575] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.575] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.575] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.575] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.576] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.577] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.578] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.579] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.580] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.580] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.580] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.580] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.580] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0096.580] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0096.580] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0096.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0096.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.581] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana", lpFilePart=0x0) returned 0x68 [0096.582] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpFilePart=0x0) returned 0x69 [0096.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.584] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.584] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana", lpFilePart=0x0) returned 0x68 [0096.584] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpFilePart=0x0) returned 0x69 [0096.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.584] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.584] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.584] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.585] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.585] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.585] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue", lpFilePart=0x0) returned 0x67 [0096.585] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpFilePart=0x0) returned 0x68 [0096.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.585] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.586] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.586] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.586] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.586] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.586] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.586] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue", lpFilePart=0x0) returned 0x67 [0096.586] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpFilePart=0x0) returned 0x68 [0096.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.586] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.587] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.587] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.587] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.587] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.587] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.587] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay", lpFilePart=0x0) returned 0x65 [0096.588] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpFilePart=0x0) returned 0x66 [0096.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.589] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.589] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.589] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.589] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.589] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.589] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay", lpFilePart=0x0) returned 0x65 [0096.589] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpFilePart=0x0) returned 0x66 [0096.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.590] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.590] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.590] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.590] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.590] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.590] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange", lpFilePart=0x0) returned 0x6b [0096.590] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpFilePart=0x0) returned 0x6c [0096.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.594] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.594] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.594] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.594] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.594] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.594] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.594] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange", lpFilePart=0x0) returned 0x6b [0096.594] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpFilePart=0x0) returned 0x6c [0096.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.595] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.595] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.595] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.595] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.595] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.595] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.595] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x7a [0096.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.596] GetFileType (hFile=0x154) returned 0x1 [0096.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.596] GetFileType (hFile=0x154) returned 0x1 [0096.596] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x143 [0096.596] ReadFile (in: hFile=0x154, lpBuffer=0x1b55980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b55980*, lpNumberOfBytesRead=0x2ae31c*=0x143, lpOverlapped=0x0) returned 1 [0096.597] CloseHandle (hObject=0x154) returned 1 [0096.635] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x7a [0096.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.637] GetFileType (hFile=0x154) returned 0x1 [0096.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.637] GetFileType (hFile=0x154) returned 0x1 [0096.637] WriteFile (in: hFile=0x154, lpBuffer=0x19a7744*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19a7744*, lpNumberOfBytesWritten=0x2ae2e4*=0x150, lpOverlapped=0x0) returned 1 [0096.638] CloseHandle (hObject=0x154) returned 1 [0096.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x7a [0096.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.anonymous", lpFilePart=0x0) returned 0x84 [0096.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.638] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f86300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8840b7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd88a64f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0096.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.anonymous")) returned 1 [0096.641] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpFilePart=0x0) returned 0x76 [0096.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.642] GetFileType (hFile=0x154) returned 0x1 [0096.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.642] GetFileType (hFile=0x154) returned 0x1 [0096.642] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xb9 [0096.642] ReadFile (in: hFile=0x154, lpBuffer=0x19a8cdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19a8cdc*, lpNumberOfBytesRead=0x2ae31c*=0xb9, lpOverlapped=0x0) returned 1 [0096.643] CloseHandle (hObject=0x154) returned 1 [0096.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpFilePart=0x0) returned 0x76 [0096.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.658] GetFileType (hFile=0x154) returned 0x1 [0096.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.658] GetFileType (hFile=0x154) returned 0x1 [0096.658] WriteFile (in: hFile=0x154, lpBuffer=0x19f7054*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19f7054*, lpNumberOfBytesWritten=0x2ae2e4*=0xc0, lpOverlapped=0x0) returned 1 [0096.659] CloseHandle (hObject=0x154) returned 1 [0096.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpFilePart=0x0) returned 0x76 [0096.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.anonymous", lpFilePart=0x0) returned 0x80 [0096.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f86300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77d9be50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd88cc650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0096.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.anonymous")) returned 1 [0096.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpFilePart=0x0) returned 0x77 [0096.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.661] GetFileType (hFile=0x154) returned 0x1 [0096.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.661] GetFileType (hFile=0x154) returned 0x1 [0096.661] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x155 [0096.662] ReadFile (in: hFile=0x154, lpBuffer=0x19f8670, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19f8670*, lpNumberOfBytesRead=0x2ae31c*=0x155, lpOverlapped=0x0) returned 1 [0096.663] CloseHandle (hObject=0x154) returned 1 [0096.677] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpFilePart=0x0) returned 0x77 [0096.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.678] GetFileType (hFile=0x154) returned 0x1 [0096.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.678] GetFileType (hFile=0x154) returned 0x1 [0096.678] WriteFile (in: hFile=0x154, lpBuffer=0x1a46ccc*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a46ccc*, lpNumberOfBytesWritten=0x2ae2e4*=0x160, lpOverlapped=0x0) returned 1 [0096.680] CloseHandle (hObject=0x154) returned 1 [0096.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpFilePart=0x0) returned 0x77 [0096.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.anonymous", lpFilePart=0x0) returned 0x81 [0096.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.680] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f86300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8840b7d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8918910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1 [0096.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.anonymous")) returned 1 [0096.681] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpFilePart=0x0) returned 0x76 [0096.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.681] GetFileType (hFile=0x154) returned 0x1 [0096.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.681] GetFileType (hFile=0x154) returned 0x1 [0096.681] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xde [0096.681] ReadFile (in: hFile=0x154, lpBuffer=0x1a48270, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a48270*, lpNumberOfBytesRead=0x2ae31c*=0xde, lpOverlapped=0x0) returned 1 [0096.682] CloseHandle (hObject=0x154) returned 1 [0096.694] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpFilePart=0x0) returned 0x76 [0096.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.696] GetFileType (hFile=0x154) returned 0x1 [0096.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.696] GetFileType (hFile=0x154) returned 0x1 [0096.696] WriteFile (in: hFile=0x154, lpBuffer=0x1a964c8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a964c8*, lpNumberOfBytesWritten=0x2ae2e4*=0xe0, lpOverlapped=0x0) returned 1 [0096.697] CloseHandle (hObject=0x154) returned 1 [0096.697] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpFilePart=0x0) returned 0x76 [0096.697] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.anonymous", lpFilePart=0x0) returned 0x80 [0096.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.698] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f86300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77d9be50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd893ea70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0096.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.anonymous")) returned 1 [0096.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.699] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow", lpFilePart=0x0) returned 0x6b [0096.699] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpFilePart=0x0) returned 0x6c [0096.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.699] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.700] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.700] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.700] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.700] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.700] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow", lpFilePart=0x0) returned 0x6b [0096.700] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpFilePart=0x0) returned 0x6c [0096.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.701] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.701] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert", lpFilePart=0x0) returned 0x65 [0096.701] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpFilePart=0x0) returned 0x66 [0096.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.703] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.703] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert", lpFilePart=0x0) returned 0x65 [0096.703] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpFilePart=0x0) returned 0x66 [0096.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.704] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.704] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.705] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck", lpFilePart=0x0) returned 0x68 [0096.705] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpFilePart=0x0) returned 0x69 [0096.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.708] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.708] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.709] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.709] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.709] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.709] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.709] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck", lpFilePart=0x0) returned 0x68 [0096.709] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpFilePart=0x0) returned 0x69 [0096.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.709] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.709] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.710] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.710] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.710] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.710] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.710] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime", lpFilePart=0x0) returned 0x63 [0096.710] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpFilePart=0x0) returned 0x64 [0096.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.711] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.711] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.711] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.711] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.711] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.711] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime", lpFilePart=0x0) returned 0x63 [0096.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpFilePart=0x0) returned 0x64 [0096.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.712] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.712] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.712] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.712] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.712] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.712] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis", lpFilePart=0x0) returned 0x64 [0096.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpFilePart=0x0) returned 0x65 [0096.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.714] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.714] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.714] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.714] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.714] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.714] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.714] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis", lpFilePart=0x0) returned 0x64 [0096.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpFilePart=0x0) returned 0x65 [0096.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.715] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.715] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.715] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.715] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.715] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.715] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.715] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate", lpFilePart=0x0) returned 0x64 [0096.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpFilePart=0x0) returned 0x65 [0096.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.716] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.716] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.716] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.716] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.716] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.716] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate", lpFilePart=0x0) returned 0x64 [0096.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpFilePart=0x0) returned 0x65 [0096.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.716] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.716] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.717] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.717] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.717] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.717] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue", lpFilePart=0x0) returned 0x67 [0096.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpFilePart=0x0) returned 0x68 [0096.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.718] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.718] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.718] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.718] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.718] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.718] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.718] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue", lpFilePart=0x0) returned 0x67 [0096.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpFilePart=0x0) returned 0x68 [0096.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0096.718] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.719] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.719] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.719] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.719] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.719] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0096.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.719] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x76 [0096.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.720] GetFileType (hFile=0x154) returned 0x1 [0096.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.720] GetFileType (hFile=0x154) returned 0x1 [0096.720] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x1afa [0096.720] ReadFile (in: hFile=0x154, lpBuffer=0x1aa96e8, nNumberOfBytesToRead=0x1afa, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1aa96e8*, lpNumberOfBytesRead=0x2ae31c*=0x1afa, lpOverlapped=0x0) returned 1 [0096.724] CloseHandle (hObject=0x154) returned 1 [0096.736] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x76 [0096.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.739] GetFileType (hFile=0x154) returned 0x1 [0096.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.739] GetFileType (hFile=0x154) returned 0x1 [0096.739] WriteFile (in: hFile=0x154, lpBuffer=0x1afebd4*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x1afebd4*, lpNumberOfBytesWritten=0x2ae310*=0x1b00, lpOverlapped=0x0) returned 1 [0096.742] CloseHandle (hObject=0x154) returned 1 [0096.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x76 [0096.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.anonymous", lpFilePart=0x0) returned 0x80 [0096.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.742] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88431930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd89b0e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b00)) returned 1 [0096.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.anonymous")) returned 1 [0096.743] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpFilePart=0x0) returned 0x73 [0096.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.743] GetFileType (hFile=0x154) returned 0x1 [0096.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.743] GetFileType (hFile=0x154) returned 0x1 [0096.743] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x155 [0096.743] ReadFile (in: hFile=0x154, lpBuffer=0x1b00e6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b00e6c*, lpNumberOfBytesRead=0x2ae31c*=0x155, lpOverlapped=0x0) returned 1 [0096.744] CloseHandle (hObject=0x154) returned 1 [0096.756] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpFilePart=0x0) returned 0x73 [0096.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.758] GetFileType (hFile=0x154) returned 0x1 [0096.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.758] GetFileType (hFile=0x154) returned 0x1 [0096.760] CloseHandle (hObject=0x154) returned 1 [0096.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpFilePart=0x0) returned 0x73 [0096.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.anonymous", lpFilePart=0x0) returned 0x7d [0096.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.760] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77dc1fb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd89d6ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1 [0096.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.anonymous")) returned 1 [0096.761] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpFilePart=0x0) returned 0x72 [0096.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.761] GetFileType (hFile=0x154) returned 0x1 [0096.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.761] GetFileType (hFile=0x154) returned 0x1 [0096.761] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xde [0096.761] ReadFile (in: hFile=0x154, lpBuffer=0x1b50a44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b50a44*, lpNumberOfBytesRead=0x2ae31c*=0xde, lpOverlapped=0x0) returned 1 [0096.763] CloseHandle (hObject=0x154) returned 1 [0096.800] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpFilePart=0x0) returned 0x72 [0096.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.802] GetFileType (hFile=0x154) returned 0x1 [0096.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.802] GetFileType (hFile=0x154) returned 0x1 [0096.802] WriteFile (in: hFile=0x154, lpBuffer=0x199f850*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x199f850*, lpNumberOfBytesWritten=0x2ae2e4*=0xe0, lpOverlapped=0x0) returned 1 [0096.803] CloseHandle (hObject=0x154) returned 1 [0096.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpFilePart=0x0) returned 0x72 [0096.803] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.anonymous", lpFilePart=0x0) returned 0x7c [0096.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88431930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8a232b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0096.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.anonymous")) returned 1 [0096.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.814] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen", lpFilePart=0x0) returned 0x6a [0096.814] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpFilePart=0x0) returned 0x6b [0096.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.815] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.815] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.815] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.815] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.815] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.815] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.815] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen", lpFilePart=0x0) returned 0x6a [0096.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpFilePart=0x0) returned 0x6b [0096.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.816] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.816] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.816] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.816] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.816] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.816] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.816] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2", lpFilePart=0x0) returned 0x63 [0096.817] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpFilePart=0x0) returned 0x64 [0096.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.817] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.818] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.818] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.818] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.818] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.818] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.818] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2", lpFilePart=0x0) returned 0x63 [0096.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpFilePart=0x0) returned 0x64 [0096.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0096.819] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.819] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.819] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.819] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.819] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.819] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.819] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0096.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x72 [0096.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.820] GetFileType (hFile=0x154) returned 0x1 [0096.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.820] GetFileType (hFile=0x154) returned 0x1 [0096.820] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xe9 [0096.820] ReadFile (in: hFile=0x154, lpBuffer=0x19a66c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19a66c8*, lpNumberOfBytesRead=0x2ae31c*=0xe9, lpOverlapped=0x0) returned 1 [0096.822] CloseHandle (hObject=0x154) returned 1 [0096.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x72 [0096.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.835] GetFileType (hFile=0x154) returned 0x1 [0096.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.836] GetFileType (hFile=0x154) returned 0x1 [0096.836] WriteFile (in: hFile=0x154, lpBuffer=0x19f4aa0*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19f4aa0*, lpNumberOfBytesWritten=0x2ae2e4*=0xf0, lpOverlapped=0x0) returned 1 [0096.837] CloseHandle (hObject=0x154) returned 1 [0096.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x72 [0096.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.anonymous", lpFilePart=0x0) returned 0x7c [0096.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.837] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88431930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8a956d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0096.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.anonymous")) returned 1 [0096.838] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpFilePart=0x0) returned 0x6e [0096.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.839] GetFileType (hFile=0x154) returned 0x1 [0096.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.839] GetFileType (hFile=0x154) returned 0x1 [0096.839] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xcbd [0096.839] ReadFile (in: hFile=0x154, lpBuffer=0x19f6bfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19f6bfc*, lpNumberOfBytesRead=0x2ae31c*=0xcbd, lpOverlapped=0x0) returned 1 [0096.841] CloseHandle (hObject=0x154) returned 1 [0096.854] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpFilePart=0x0) returned 0x6e [0096.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.856] GetFileType (hFile=0x154) returned 0x1 [0096.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.856] GetFileType (hFile=0x154) returned 0x1 [0096.856] WriteFile (in: hFile=0x154, lpBuffer=0x1a48b20*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a48b20*, lpNumberOfBytesWritten=0x2ae2e4*=0xcc0, lpOverlapped=0x0) returned 1 [0096.857] CloseHandle (hObject=0x154) returned 1 [0096.857] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpFilePart=0x0) returned 0x6e [0096.857] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.anonymous", lpFilePart=0x0) returned 0x78 [0096.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.857] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88431930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8abb830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcc0)) returned 1 [0096.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.anonymous")) returned 1 [0096.860] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpFilePart=0x0) returned 0x6f [0096.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.860] GetFileType (hFile=0x154) returned 0x1 [0096.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.860] GetFileType (hFile=0x154) returned 0x1 [0096.860] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x1ce [0096.860] ReadFile (in: hFile=0x154, lpBuffer=0x1a4a174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a4a174*, lpNumberOfBytesRead=0x2ae31c*=0x1ce, lpOverlapped=0x0) returned 1 [0096.861] CloseHandle (hObject=0x154) returned 1 [0096.873] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpFilePart=0x0) returned 0x6f [0096.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.875] GetFileType (hFile=0x154) returned 0x1 [0096.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.875] GetFileType (hFile=0x154) returned 0x1 [0096.875] WriteFile (in: hFile=0x154, lpBuffer=0x1a989e8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a989e8*, lpNumberOfBytesWritten=0x2ae2e4*=0x1d0, lpOverlapped=0x0) returned 1 [0096.876] CloseHandle (hObject=0x154) returned 1 [0096.876] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpFilePart=0x0) returned 0x6f [0096.876] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.anonymous", lpFilePart=0x0) returned 0x79 [0096.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.876] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77dc1fb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8ae1990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1 [0096.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.anonymous")) returned 1 [0096.877] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpFilePart=0x0) returned 0x6e [0096.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.878] GetFileType (hFile=0x154) returned 0x1 [0096.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.878] GetFileType (hFile=0x154) returned 0x1 [0096.878] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x108 [0096.878] ReadFile (in: hFile=0x154, lpBuffer=0x1a99f74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a99f74*, lpNumberOfBytesRead=0x2ae31c*=0x108, lpOverlapped=0x0) returned 1 [0096.881] CloseHandle (hObject=0x154) returned 1 [0096.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpFilePart=0x0) returned 0x6e [0096.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.907] GetFileType (hFile=0x154) returned 0x1 [0096.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.907] GetFileType (hFile=0x154) returned 0x1 [0096.907] WriteFile (in: hFile=0x154, lpBuffer=0x1ae842c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1ae842c*, lpNumberOfBytesWritten=0x2ae2e4*=0x110, lpOverlapped=0x0) returned 1 [0096.910] CloseHandle (hObject=0x154) returned 1 [0096.910] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpFilePart=0x0) returned 0x6e [0096.910] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.anonymous", lpFilePart=0x0) returned 0x78 [0096.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.910] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298bea00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77dc1fb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8b2dc50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0096.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.anonymous")) returned 1 [0096.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.911] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl", lpFilePart=0x0) returned 0x64 [0096.911] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpFilePart=0x0) returned 0x65 [0096.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee58 [0096.911] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.911] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.911] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.912] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.912] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.912] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.912] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0096.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0096.912] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl", lpFilePart=0x0) returned 0x64 [0096.912] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpFilePart=0x0) returned 0x65 [0096.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee58 [0096.912] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.913] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.913] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.913] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.913] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0096.914] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0096.915] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0096.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0096.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0096.915] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x73 [0096.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.915] GetFileType (hFile=0x154) returned 0x1 [0096.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.915] GetFileType (hFile=0x154) returned 0x1 [0096.915] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x32f [0096.915] ReadFile (in: hFile=0x154, lpBuffer=0x1aec9f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1aec9f0*, lpNumberOfBytesRead=0x2ae31c*=0x32f, lpOverlapped=0x0) returned 1 [0096.919] CloseHandle (hObject=0x154) returned 1 [0096.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x73 [0096.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0096.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.935] GetFileType (hFile=0x154) returned 0x1 [0096.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0096.935] GetFileType (hFile=0x154) returned 0x1 [0096.935] WriteFile (in: hFile=0x154, lpBuffer=0x1b3b954*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1b3b954*, lpNumberOfBytesWritten=0x2ae2e4*=0x330, lpOverlapped=0x0) returned 1 [0096.937] CloseHandle (hObject=0x154) returned 1 [0096.937] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x73 [0096.937] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.anonymous", lpFilePart=0x0) returned 0x7d [0096.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0096.937] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8b79f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0096.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0096.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.anonymous")) returned 1 [0096.938] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpFilePart=0x0) returned 0x6f [0096.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0096.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0096.938] GetFileType (hFile=0x154) returned 0x1 [0096.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0096.938] GetFileType (hFile=0x154) returned 0x1 [0096.938] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x6993 [0096.938] ReadFile (in: hFile=0x154, lpBuffer=0x1b3cde4, nNumberOfBytesToRead=0x6993, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b3cde4*, lpNumberOfBytesRead=0x2ae31c*=0x6993, lpOverlapped=0x0) returned 1 [0096.958] CloseHandle (hObject=0x154) returned 1 [0097.028] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpFilePart=0x0) returned 0x6f [0097.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0097.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.030] GetFileType (hFile=0x154) returned 0x1 [0097.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0097.030] GetFileType (hFile=0x154) returned 0x1 [0097.030] WriteFile (in: hFile=0x154, lpBuffer=0x19b2010*, nNumberOfBytesToWrite=0x69a0, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x19b2010*, lpNumberOfBytesWritten=0x2ae310*=0x69a0, lpOverlapped=0x0) returned 1 [0097.032] CloseHandle (hObject=0x154) returned 1 [0097.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpFilePart=0x0) returned 0x6f [0097.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.anonymous", lpFilePart=0x0) returned 0x79 [0097.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0097.033] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88431930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8c5e750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x69a0)) returned 1 [0097.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0097.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.anonymous")) returned 1 [0097.035] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpFilePart=0x0) returned 0x70 [0097.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0097.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.036] GetFileType (hFile=0x154) returned 0x1 [0097.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0097.036] GetFileType (hFile=0x154) returned 0x1 [0097.036] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x155 [0097.036] ReadFile (in: hFile=0x154, lpBuffer=0x19b90fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19b90fc*, lpNumberOfBytesRead=0x2ae31c*=0x155, lpOverlapped=0x0) returned 1 [0097.037] CloseHandle (hObject=0x154) returned 1 [0097.055] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpFilePart=0x0) returned 0x70 [0097.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0097.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.057] GetFileType (hFile=0x154) returned 0x1 [0097.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0097.057] GetFileType (hFile=0x154) returned 0x1 [0097.057] WriteFile (in: hFile=0x154, lpBuffer=0x1a078a8*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a078a8*, lpNumberOfBytesWritten=0x2ae2e4*=0x160, lpOverlapped=0x0) returned 1 [0097.058] CloseHandle (hObject=0x154) returned 1 [0097.059] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpFilePart=0x0) returned 0x70 [0097.059] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.anonymous", lpFilePart=0x0) returned 0x7a [0097.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0097.059] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8caaa10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1 [0097.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0097.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.anonymous")) returned 1 [0097.060] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpFilePart=0x0) returned 0x6f [0097.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0097.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.060] GetFileType (hFile=0x154) returned 0x1 [0097.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0097.060] GetFileType (hFile=0x154) returned 0x1 [0097.060] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xde [0097.061] ReadFile (in: hFile=0x154, lpBuffer=0x1a08e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a08e18*, lpNumberOfBytesRead=0x2ae31c*=0xde, lpOverlapped=0x0) returned 1 [0097.062] CloseHandle (hObject=0x154) returned 1 [0097.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpFilePart=0x0) returned 0x6f [0097.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0097.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.083] GetFileType (hFile=0x154) returned 0x1 [0097.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0097.083] GetFileType (hFile=0x154) returned 0x1 [0097.083] WriteFile (in: hFile=0x154, lpBuffer=0x1a57060*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a57060*, lpNumberOfBytesWritten=0x2ae2e4*=0xe0, lpOverlapped=0x0) returned 1 [0097.085] CloseHandle (hObject=0x154) returned 1 [0097.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpFilePart=0x0) returned 0x6f [0097.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.anonymous", lpFilePart=0x0) returned 0x79 [0097.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0097.085] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abd1700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8cf6cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0097.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0097.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.anonymous")) returned 1 [0097.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0097.089] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4", lpFilePart=0x0) returned 0x52 [0097.089] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpFilePart=0x0) returned 0x53 [0097.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0097.110] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.114] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.115] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.116] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.117] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.117] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.117] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.117] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.117] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.117] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.118] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.119] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.120] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.121] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.122] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.123] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0097.123] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0097.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0097.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0097.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0097.125] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4", lpFilePart=0x0) returned 0x52 [0097.125] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpFilePart=0x0) returned 0x53 [0097.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0097.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.126] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.127] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.128] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.129] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.130] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.131] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.131] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.131] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.131] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.131] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.131] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.132] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.133] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0097.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0097.134] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0097.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0097.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0097.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x65 [0097.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.136] GetFileType (hFile=0x154) returned 0x1 [0097.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.137] GetFileType (hFile=0x154) returned 0x1 [0097.137] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xbe8 [0097.137] ReadFile (in: hFile=0x154, lpBuffer=0x1a6f0f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6f0f4*, lpNumberOfBytesRead=0x2ae404*=0xbe8, lpOverlapped=0x0) returned 1 [0097.169] CloseHandle (hObject=0x154) returned 1 [0097.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x65 [0097.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.185] GetFileType (hFile=0x154) returned 0x1 [0097.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.185] GetFileType (hFile=0x154) returned 0x1 [0097.185] WriteFile (in: hFile=0x154, lpBuffer=0x1ac0c08*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ac0c08*, lpNumberOfBytesWritten=0x2ae3cc*=0xbf0, lpOverlapped=0x0) returned 1 [0097.186] CloseHandle (hObject=0x154) returned 1 [0097.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpFilePart=0x0) returned 0x65 [0097.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.anonymous", lpFilePart=0x0) returned 0x6f [0097.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.186] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e509e00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x857b5e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8ddb510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0097.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.anonymous")) returned 1 [0097.187] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x69 [0097.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.187] GetFileType (hFile=0x154) returned 0x1 [0097.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.187] GetFileType (hFile=0x154) returned 0x1 [0097.187] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x924 [0097.187] ReadFile (in: hFile=0x154, lpBuffer=0x1ac2980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac2980*, lpNumberOfBytesRead=0x2ae404*=0x924, lpOverlapped=0x0) returned 1 [0097.205] CloseHandle (hObject=0x154) returned 1 [0097.222] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x69 [0097.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.224] GetFileType (hFile=0x154) returned 0x1 [0097.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.224] GetFileType (hFile=0x154) returned 0x1 [0097.224] WriteFile (in: hFile=0x154, lpBuffer=0x1b136e8*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b136e8*, lpNumberOfBytesWritten=0x2ae3cc*=0x930, lpOverlapped=0x0) returned 1 [0097.226] CloseHandle (hObject=0x154) returned 1 [0097.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpFilePart=0x0) returned 0x69 [0097.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.anonymous", lpFilePart=0x0) returned 0x73 [0097.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e509e00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x764e9a10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8e4d930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x930)) returned 1 [0097.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.anonymous")) returned 1 [0097.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpFilePart=0x0) returned 0x60 [0097.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.228] GetFileType (hFile=0x154) returned 0x1 [0097.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.228] GetFileType (hFile=0x154) returned 0x1 [0097.228] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xae8 [0097.228] ReadFile (in: hFile=0x154, lpBuffer=0x1b15618, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b15618*, lpNumberOfBytesRead=0x2ae404*=0xae8, lpOverlapped=0x0) returned 1 [0097.266] CloseHandle (hObject=0x154) returned 1 [0097.284] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpFilePart=0x0) returned 0x60 [0097.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.286] GetFileType (hFile=0x154) returned 0x1 [0097.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.287] GetFileType (hFile=0x154) returned 0x1 [0097.287] WriteFile (in: hFile=0x154, lpBuffer=0x1b66c18*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b66c18*, lpNumberOfBytesWritten=0x2ae3cc*=0xaf0, lpOverlapped=0x0) returned 1 [0097.289] CloseHandle (hObject=0x154) returned 1 [0097.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpFilePart=0x0) returned 0x60 [0097.289] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.anonymous", lpFilePart=0x0) returned 0x6a [0097.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e509e00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x85da9510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8ee5eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaf0)) returned 1 [0097.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.anonymous")) returned 1 [0097.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpFilePart=0x0) returned 0x60 [0097.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.291] GetFileType (hFile=0x154) returned 0x1 [0097.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.291] GetFileType (hFile=0x154) returned 0x1 [0097.291] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x161d [0097.291] ReadFile (in: hFile=0x154, lpBuffer=0x1b6803c, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6803c*, lpNumberOfBytesRead=0x2ae404*=0x161d, lpOverlapped=0x0) returned 1 [0097.319] CloseHandle (hObject=0x154) returned 1 [0097.370] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpFilePart=0x0) returned 0x60 [0097.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.372] GetFileType (hFile=0x154) returned 0x1 [0097.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.372] GetFileType (hFile=0x154) returned 0x1 [0097.372] WriteFile (in: hFile=0x154, lpBuffer=0x19cea50*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19cea50*, lpNumberOfBytesWritten=0x2ae3f8*=0x1620, lpOverlapped=0x0) returned 1 [0097.374] CloseHandle (hObject=0x154) returned 1 [0097.374] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpFilePart=0x0) returned 0x60 [0097.374] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.anonymous", lpFilePart=0x0) returned 0x6a [0097.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.374] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e509e00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8fa4590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1620)) returned 1 [0097.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.anonymous")) returned 1 [0097.375] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpFilePart=0x0) returned 0x61 [0097.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.375] GetFileType (hFile=0x154) returned 0x1 [0097.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.375] GetFileType (hFile=0x154) returned 0x1 [0097.376] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x7dd3 [0097.376] ReadFile (in: hFile=0x154, lpBuffer=0x19d05d4, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19d05d4*, lpNumberOfBytesRead=0x2ae404*=0x7dd3, lpOverlapped=0x0) returned 1 [0097.378] CloseHandle (hObject=0x154) returned 1 [0097.397] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpFilePart=0x0) returned 0x61 [0097.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.399] GetFileType (hFile=0x154) returned 0x1 [0097.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.399] GetFileType (hFile=0x154) returned 0x1 [0097.399] WriteFile (in: hFile=0x154, lpBuffer=0x1a44a7c*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a44a7c*, lpNumberOfBytesWritten=0x2ae3f8*=0x7de0, lpOverlapped=0x0) returned 1 [0097.401] CloseHandle (hObject=0x154) returned 1 [0097.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpFilePart=0x0) returned 0x61 [0097.402] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.anonymous", lpFilePart=0x0) returned 0x6b [0097.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.402] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e509e00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd8ff0850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7de0)) returned 1 [0097.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.anonymous")) returned 1 [0097.403] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpFilePart=0x0) returned 0x60 [0097.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.403] GetFileType (hFile=0x154) returned 0x1 [0097.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.403] GetFileType (hFile=0x154) returned 0x1 [0097.403] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x132a [0097.403] ReadFile (in: hFile=0x154, lpBuffer=0x1a4cdc0, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a4cdc0*, lpNumberOfBytesRead=0x2ae404*=0x132a, lpOverlapped=0x0) returned 1 [0097.405] CloseHandle (hObject=0x154) returned 1 [0097.423] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpFilePart=0x0) returned 0x60 [0097.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.425] GetFileType (hFile=0x154) returned 0x1 [0097.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.425] GetFileType (hFile=0x154) returned 0x1 [0097.425] WriteFile (in: hFile=0x154, lpBuffer=0x1a9fb9c*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a9fb9c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1330, lpOverlapped=0x0) returned 1 [0097.427] CloseHandle (hObject=0x154) returned 1 [0097.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpFilePart=0x0) returned 0x60 [0097.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.anonymous", lpFilePart=0x0) returned 0x6a [0097.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.427] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd90169b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1330)) returned 1 [0097.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.anonymous")) returned 1 [0097.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x67 [0097.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.429] GetFileType (hFile=0x154) returned 0x1 [0097.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.429] GetFileType (hFile=0x154) returned 0x1 [0097.429] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x167bd [0097.430] ReadFile (in: hFile=0x154, lpBuffer=0x15692450, nNumberOfBytesToRead=0x167bd, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x15692450*, lpNumberOfBytesRead=0x2ae404*=0x167bd, lpOverlapped=0x0) returned 1 [0097.447] CloseHandle (hObject=0x154) returned 1 [0097.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x67 [0097.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.476] GetFileType (hFile=0x154) returned 0x1 [0097.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.476] GetFileType (hFile=0x154) returned 0x1 [0097.476] WriteFile (in: hFile=0x154, lpBuffer=0xb24fb78*, nNumberOfBytesToWrite=0x167c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0xb24fb78*, lpNumberOfBytesWritten=0x2ae3f8*=0x167c0, lpOverlapped=0x0) returned 1 [0097.479] CloseHandle (hObject=0x154) returned 1 [0097.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpFilePart=0x0) returned 0x67 [0097.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.anonymous", lpFilePart=0x0) returned 0x71 [0097.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.479] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c33d70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd90aef30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x167c0)) returned 1 [0097.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.anonymous")) returned 1 [0097.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6c [0097.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.481] GetFileType (hFile=0x154) returned 0x1 [0097.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.481] GetFileType (hFile=0x154) returned 0x1 [0097.481] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4ebb [0097.481] ReadFile (in: hFile=0x154, lpBuffer=0x1aee808, nNumberOfBytesToRead=0x4ebb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aee808*, lpNumberOfBytesRead=0x2ae404*=0x4ebb, lpOverlapped=0x0) returned 1 [0097.483] CloseHandle (hObject=0x154) returned 1 [0097.500] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6c [0097.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.503] GetFileType (hFile=0x154) returned 0x1 [0097.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.503] GetFileType (hFile=0x154) returned 0x1 [0097.503] WriteFile (in: hFile=0x154, lpBuffer=0x1b53fb4*, nNumberOfBytesToWrite=0x4ec0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b53fb4*, lpNumberOfBytesWritten=0x2ae3f8*=0x4ec0, lpOverlapped=0x0) returned 1 [0097.504] CloseHandle (hObject=0x154) returned 1 [0097.504] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpFilePart=0x0) returned 0x6c [0097.505] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.anonymous", lpFilePart=0x0) returned 0x76 [0097.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd90d5090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ec0)) returned 1 [0097.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.anonymous")) returned 1 [0097.506] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpFilePart=0x0) returned 0x6c [0097.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.506] GetFileType (hFile=0x154) returned 0x1 [0097.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.506] GetFileType (hFile=0x154) returned 0x1 [0097.507] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x40f [0097.507] ReadFile (in: hFile=0x154, lpBuffer=0x1b59898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b59898*, lpNumberOfBytesRead=0x2ae404*=0x40f, lpOverlapped=0x0) returned 1 [0097.508] CloseHandle (hObject=0x154) returned 1 [0097.545] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpFilePart=0x0) returned 0x6c [0097.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.546] GetFileType (hFile=0x154) returned 0x1 [0097.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.546] GetFileType (hFile=0x154) returned 0x1 [0097.547] WriteFile (in: hFile=0x154, lpBuffer=0x19a7a7c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a7a7c*, lpNumberOfBytesWritten=0x2ae3cc*=0x410, lpOverlapped=0x0) returned 1 [0097.548] CloseHandle (hObject=0x154) returned 1 [0097.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpFilePart=0x0) returned 0x6c [0097.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.anonymous", lpFilePart=0x0) returned 0x76 [0097.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.548] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd91474b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x410)) returned 1 [0097.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.anonymous")) returned 1 [0097.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x62 [0097.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.549] GetFileType (hFile=0x154) returned 0x1 [0097.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.549] GetFileType (hFile=0x154) returned 0x1 [0097.549] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5690 [0097.549] ReadFile (in: hFile=0x154, lpBuffer=0x19a8ed8, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a8ed8*, lpNumberOfBytesRead=0x2ae404*=0x5690, lpOverlapped=0x0) returned 1 [0097.564] CloseHandle (hObject=0x154) returned 1 [0097.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x62 [0097.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.585] GetFileType (hFile=0x154) returned 0x1 [0097.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.585] GetFileType (hFile=0x154) returned 0x1 [0097.585] WriteFile (in: hFile=0x154, lpBuffer=0x1a10f3c*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a10f3c*, lpNumberOfBytesWritten=0x2ae3f8*=0x56a0, lpOverlapped=0x0) returned 1 [0097.587] CloseHandle (hObject=0x154) returned 1 [0097.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpFilePart=0x0) returned 0x62 [0097.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.anonymous", lpFilePart=0x0) returned 0x6c [0097.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.588] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd91b98d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x56a0)) returned 1 [0097.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.anonymous")) returned 1 [0097.589] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpFilePart=0x0) returned 0x60 [0097.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.589] GetFileType (hFile=0x154) returned 0x1 [0097.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.589] GetFileType (hFile=0x154) returned 0x1 [0097.589] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x6a [0097.589] ReadFile (in: hFile=0x154, lpBuffer=0x1a16bc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a16bc8*, lpNumberOfBytesRead=0x2ae404*=0x6a, lpOverlapped=0x0) returned 1 [0097.591] CloseHandle (hObject=0x154) returned 1 [0097.611] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpFilePart=0x0) returned 0x60 [0097.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.613] GetFileType (hFile=0x154) returned 0x1 [0097.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.613] GetFileType (hFile=0x154) returned 0x1 [0097.613] WriteFile (in: hFile=0x154, lpBuffer=0x1a64d1c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a64d1c*, lpNumberOfBytesWritten=0x2ae3cc*=0x70, lpOverlapped=0x0) returned 1 [0097.616] CloseHandle (hObject=0x154) returned 1 [0097.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpFilePart=0x0) returned 0x60 [0097.616] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.anonymous", lpFilePart=0x0) returned 0x6a [0097.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.617] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9205b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0097.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.anonymous")) returned 1 [0097.618] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x65 [0097.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.618] GetFileType (hFile=0x154) returned 0x1 [0097.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.618] GetFileType (hFile=0x154) returned 0x1 [0097.618] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x21a6 [0097.618] ReadFile (in: hFile=0x154, lpBuffer=0x1a6613c, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6613c*, lpNumberOfBytesRead=0x2ae404*=0x21a6, lpOverlapped=0x0) returned 1 [0097.620] CloseHandle (hObject=0x154) returned 1 [0097.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x65 [0097.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.640] GetFileType (hFile=0x154) returned 0x1 [0097.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.640] GetFileType (hFile=0x154) returned 0x1 [0097.640] WriteFile (in: hFile=0x154, lpBuffer=0x1abd798*, nNumberOfBytesToWrite=0x21b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1abd798*, lpNumberOfBytesWritten=0x2ae3f8*=0x21b0, lpOverlapped=0x0) returned 1 [0097.642] CloseHandle (hObject=0x154) returned 1 [0097.642] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpFilePart=0x0) returned 0x65 [0097.642] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.anonymous", lpFilePart=0x0) returned 0x6f [0097.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.642] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a02730, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd922bcf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21b0)) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.anonymous")) returned 1 [0097.645] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x64 [0097.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.645] GetFileType (hFile=0x154) returned 0x1 [0097.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.645] GetFileType (hFile=0x154) returned 0x1 [0097.645] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3d57 [0097.646] ReadFile (in: hFile=0x154, lpBuffer=0x1abfee4, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1abfee4*, lpNumberOfBytesRead=0x2ae404*=0x3d57, lpOverlapped=0x0) returned 1 [0097.648] CloseHandle (hObject=0x154) returned 1 [0097.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x64 [0097.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.669] GetFileType (hFile=0x154) returned 0x1 [0097.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.669] GetFileType (hFile=0x154) returned 0x1 [0097.669] WriteFile (in: hFile=0x154, lpBuffer=0x1b1ffb0*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b1ffb0*, lpNumberOfBytesWritten=0x2ae3f8*=0x3d60, lpOverlapped=0x0) returned 1 [0097.671] CloseHandle (hObject=0x154) returned 1 [0097.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpFilePart=0x0) returned 0x64 [0097.671] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.anonymous", lpFilePart=0x0) returned 0x6e [0097.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.671] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a28890, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9277fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d60)) returned 1 [0097.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.anonymous")) returned 1 [0097.672] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpFilePart=0x0) returned 0x61 [0097.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.672] GetFileType (hFile=0x154) returned 0x1 [0097.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.672] GetFileType (hFile=0x154) returned 0x1 [0097.672] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1845 [0097.673] ReadFile (in: hFile=0x154, lpBuffer=0x1b2429c, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b2429c*, lpNumberOfBytesRead=0x2ae404*=0x1845, lpOverlapped=0x0) returned 1 [0097.674] CloseHandle (hObject=0x154) returned 1 [0097.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpFilePart=0x0) returned 0x61 [0097.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.688] GetFileType (hFile=0x154) returned 0x1 [0097.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.688] GetFileType (hFile=0x154) returned 0x1 [0097.688] WriteFile (in: hFile=0x154, lpBuffer=0x1b78a18*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b78a18*, lpNumberOfBytesWritten=0x2ae3f8*=0x1850, lpOverlapped=0x0) returned 1 [0097.689] CloseHandle (hObject=0x154) returned 1 [0097.690] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpFilePart=0x0) returned 0x61 [0097.690] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.anonymous", lpFilePart=0x0) returned 0x6b [0097.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.690] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c59ed0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd929e110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1850)) returned 1 [0097.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.anonymous")) returned 1 [0097.690] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x63 [0097.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.691] GetFileType (hFile=0x154) returned 0x1 [0097.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.691] GetFileType (hFile=0x154) returned 0x1 [0097.691] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5141 [0097.691] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a7d8, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7a7d8*, lpNumberOfBytesRead=0x2ae404*=0x5141, lpOverlapped=0x0) returned 1 [0097.692] CloseHandle (hObject=0x154) returned 1 [0097.731] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x63 [0097.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.732] GetFileType (hFile=0x154) returned 0x1 [0097.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.732] GetFileType (hFile=0x154) returned 0x1 [0097.732] WriteFile (in: hFile=0x154, lpBuffer=0x19e5950*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19e5950*, lpNumberOfBytesWritten=0x2ae3f8*=0x5150, lpOverlapped=0x0) returned 1 [0097.734] CloseHandle (hObject=0x154) returned 1 [0097.734] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpFilePart=0x0) returned 0x63 [0097.734] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.anonymous", lpFilePart=0x0) returned 0x6d [0097.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.734] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c80030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9310530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5150)) returned 1 [0097.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.anonymous")) returned 1 [0097.735] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x66 [0097.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.735] GetFileType (hFile=0x154) returned 0x1 [0097.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.735] GetFileType (hFile=0x154) returned 0x1 [0097.735] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x193c [0097.735] ReadFile (in: hFile=0x154, lpBuffer=0x19eb030, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19eb030*, lpNumberOfBytesRead=0x2ae404*=0x193c, lpOverlapped=0x0) returned 1 [0097.737] CloseHandle (hObject=0x154) returned 1 [0097.749] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x66 [0097.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.750] GetFileType (hFile=0x154) returned 0x1 [0097.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.750] GetFileType (hFile=0x154) returned 0x1 [0097.750] WriteFile (in: hFile=0x154, lpBuffer=0x1a3fdb4*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a3fdb4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1940, lpOverlapped=0x0) returned 1 [0097.752] CloseHandle (hObject=0x154) returned 1 [0097.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpFilePart=0x0) returned 0x66 [0097.752] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.anonymous", lpFilePart=0x0) returned 0x70 [0097.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.752] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76c80030, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9336690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0097.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.anonymous")) returned 1 [0097.753] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x64 [0097.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.753] GetFileType (hFile=0x154) returned 0x1 [0097.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.753] GetFileType (hFile=0x154) returned 0x1 [0097.753] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3c64 [0097.753] ReadFile (in: hFile=0x154, lpBuffer=0x1a41ca0, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a41ca0*, lpNumberOfBytesRead=0x2ae404*=0x3c64, lpOverlapped=0x0) returned 1 [0097.754] CloseHandle (hObject=0x154) returned 1 [0097.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x64 [0097.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.768] GetFileType (hFile=0x154) returned 0x1 [0097.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.768] GetFileType (hFile=0x154) returned 0x1 [0097.768] WriteFile (in: hFile=0x154, lpBuffer=0x1aa18b8*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aa18b8*, lpNumberOfBytesWritten=0x2ae3f8*=0x3c70, lpOverlapped=0x0) returned 1 [0097.770] CloseHandle (hObject=0x154) returned 1 [0097.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpFilePart=0x0) returned 0x64 [0097.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.anonymous", lpFilePart=0x0) returned 0x6e [0097.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.770] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86a28890, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd935c7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c70)) returned 1 [0097.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.anonymous")) returned 1 [0097.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpFilePart=0x0) returned 0x62 [0097.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.771] GetFileType (hFile=0x154) returned 0x1 [0097.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.771] GetFileType (hFile=0x154) returned 0x1 [0097.771] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x171 [0097.771] ReadFile (in: hFile=0x154, lpBuffer=0x1aa5c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa5c38*, lpNumberOfBytesRead=0x2ae404*=0x171, lpOverlapped=0x0) returned 1 [0097.772] CloseHandle (hObject=0x154) returned 1 [0097.784] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpFilePart=0x0) returned 0x62 [0097.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.786] GetFileType (hFile=0x154) returned 0x1 [0097.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.786] GetFileType (hFile=0x154) returned 0x1 [0097.786] WriteFile (in: hFile=0x154, lpBuffer=0x1af4318*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1af4318*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0097.787] CloseHandle (hObject=0x154) returned 1 [0097.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpFilePart=0x0) returned 0x62 [0097.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.anonymous", lpFilePart=0x0) returned 0x6c [0097.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.787] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f81cb00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b33230, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd93a8ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0097.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.anonymous")) returned 1 [0097.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpFilePart=0x0) returned 0x67 [0097.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.788] GetFileType (hFile=0x154) returned 0x1 [0097.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.788] GetFileType (hFile=0x154) returned 0x1 [0097.788] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x176 [0097.789] ReadFile (in: hFile=0x154, lpBuffer=0x1af58d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af58d0*, lpNumberOfBytesRead=0x2ae404*=0x176, lpOverlapped=0x0) returned 1 [0097.790] CloseHandle (hObject=0x154) returned 1 [0097.801] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpFilePart=0x0) returned 0x67 [0097.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.803] GetFileType (hFile=0x154) returned 0x1 [0097.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.803] GetFileType (hFile=0x154) returned 0x1 [0097.803] WriteFile (in: hFile=0x154, lpBuffer=0x1b43fc0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b43fc0*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0097.804] CloseHandle (hObject=0x154) returned 1 [0097.804] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpFilePart=0x0) returned 0x67 [0097.804] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.anonymous", lpFilePart=0x0) returned 0x71 [0097.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.804] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd93cec10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0097.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.anonymous")) returned 1 [0097.805] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpFilePart=0x0) returned 0x61 [0097.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.805] GetFileType (hFile=0x154) returned 0x1 [0097.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.805] GetFileType (hFile=0x154) returned 0x1 [0097.805] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb5 [0097.806] ReadFile (in: hFile=0x154, lpBuffer=0x1b454b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b454b8*, lpNumberOfBytesRead=0x2ae404*=0xb5, lpOverlapped=0x0) returned 1 [0097.807] CloseHandle (hObject=0x154) returned 1 [0097.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpFilePart=0x0) returned 0x61 [0097.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.820] GetFileType (hFile=0x154) returned 0x1 [0097.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.820] GetFileType (hFile=0x154) returned 0x1 [0097.820] WriteFile (in: hFile=0x154, lpBuffer=0x1b936b4*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b936b4*, lpNumberOfBytesWritten=0x2ae3cc*=0xc0, lpOverlapped=0x0) returned 1 [0097.821] CloseHandle (hObject=0x154) returned 1 [0097.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpFilePart=0x0) returned 0x61 [0097.821] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.anonymous", lpFilePart=0x0) returned 0x6b [0097.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.821] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd93f4d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0097.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.anonymous")) returned 1 [0097.822] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpFilePart=0x0) returned 0x66 [0097.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.822] GetFileType (hFile=0x154) returned 0x1 [0097.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.822] GetFileType (hFile=0x154) returned 0x1 [0097.822] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb7 [0097.823] ReadFile (in: hFile=0x154, lpBuffer=0x1b94b9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b94b9c*, lpNumberOfBytesRead=0x2ae404*=0xb7, lpOverlapped=0x0) returned 1 [0097.824] CloseHandle (hObject=0x154) returned 1 [0097.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpFilePart=0x0) returned 0x66 [0097.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.864] GetFileType (hFile=0x154) returned 0x1 [0097.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.864] GetFileType (hFile=0x154) returned 0x1 [0097.864] WriteFile (in: hFile=0x154, lpBuffer=0x19ddd00*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19ddd00*, lpNumberOfBytesWritten=0x2ae3cc*=0xc0, lpOverlapped=0x0) returned 1 [0097.865] CloseHandle (hObject=0x154) returned 1 [0097.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpFilePart=0x0) returned 0x66 [0097.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.anonymous", lpFilePart=0x0) returned 0x70 [0097.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.866] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76db0b30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9467190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0097.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.anonymous")) returned 1 [0097.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpFilePart=0x0) returned 0x63 [0097.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.867] GetFileType (hFile=0x154) returned 0x1 [0097.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.867] GetFileType (hFile=0x154) returned 0x1 [0097.867] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x171 [0097.867] ReadFile (in: hFile=0x154, lpBuffer=0x19df2bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19df2bc*, lpNumberOfBytesRead=0x2ae404*=0x171, lpOverlapped=0x0) returned 1 [0097.869] CloseHandle (hObject=0x154) returned 1 [0097.893] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpFilePart=0x0) returned 0x63 [0097.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.896] GetFileType (hFile=0x154) returned 0x1 [0097.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.896] GetFileType (hFile=0x154) returned 0x1 [0097.896] WriteFile (in: hFile=0x154, lpBuffer=0x1a2dafc*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a2dafc*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0097.899] CloseHandle (hObject=0x154) returned 1 [0097.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpFilePart=0x0) returned 0x63 [0097.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.anonymous", lpFilePart=0x0) returned 0x6d [0097.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.899] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd94b3450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0097.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.anonymous")) returned 1 [0097.900] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpFilePart=0x0) returned 0x68 [0097.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.900] GetFileType (hFile=0x154) returned 0x1 [0097.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.900] GetFileType (hFile=0x154) returned 0x1 [0097.900] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x244 [0097.901] ReadFile (in: hFile=0x154, lpBuffer=0x1a2f184, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a2f184*, lpNumberOfBytesRead=0x2ae404*=0x244, lpOverlapped=0x0) returned 1 [0097.902] CloseHandle (hObject=0x154) returned 1 [0097.914] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpFilePart=0x0) returned 0x68 [0097.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.915] GetFileType (hFile=0x154) returned 0x1 [0097.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.915] GetFileType (hFile=0x154) returned 0x1 [0097.915] WriteFile (in: hFile=0x154, lpBuffer=0x1a7dc88*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a7dc88*, lpNumberOfBytesWritten=0x2ae3cc*=0x250, lpOverlapped=0x0) returned 1 [0097.916] CloseHandle (hObject=0x154) returned 1 [0097.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpFilePart=0x0) returned 0x68 [0097.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.anonymous", lpFilePart=0x0) returned 0x72 [0097.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.916] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86b59390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd94d95b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0097.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.anonymous")) returned 1 [0097.917] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0097.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.917] GetFileType (hFile=0x154) returned 0x1 [0097.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.918] GetFileType (hFile=0x154) returned 0x1 [0097.918] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x45f [0097.918] ReadFile (in: hFile=0x154, lpBuffer=0x1a7f5bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a7f5bc*, lpNumberOfBytesRead=0x2ae404*=0x45f, lpOverlapped=0x0) returned 1 [0097.919] CloseHandle (hObject=0x154) returned 1 [0097.931] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0097.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.932] GetFileType (hFile=0x154) returned 0x1 [0097.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.932] GetFileType (hFile=0x154) returned 0x1 [0097.933] WriteFile (in: hFile=0x154, lpBuffer=0x1aceb00*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aceb00*, lpNumberOfBytesWritten=0x2ae3cc*=0x460, lpOverlapped=0x0) returned 1 [0097.934] CloseHandle (hObject=0x154) returned 1 [0097.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0097.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.anonymous", lpFilePart=0x0) returned 0x70 [0097.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.934] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd94ff710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0097.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.anonymous")) returned 1 [0097.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0097.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.935] GetFileType (hFile=0x154) returned 0x1 [0097.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.935] GetFileType (hFile=0x154) returned 0x1 [0097.935] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x852 [0097.935] ReadFile (in: hFile=0x154, lpBuffer=0x1ad07bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad07bc*, lpNumberOfBytesRead=0x2ae404*=0x852, lpOverlapped=0x0) returned 1 [0097.936] CloseHandle (hObject=0x154) returned 1 [0097.948] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0097.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.950] GetFileType (hFile=0x154) returned 0x1 [0097.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.950] GetFileType (hFile=0x154) returned 0x1 [0097.950] WriteFile (in: hFile=0x154, lpBuffer=0x1b21120*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b21120*, lpNumberOfBytesWritten=0x2ae3cc*=0x860, lpOverlapped=0x0) returned 1 [0097.951] CloseHandle (hObject=0x154) returned 1 [0097.951] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0097.951] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.anonymous", lpFilePart=0x0) returned 0x75 [0097.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.951] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b2f800, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9525870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0097.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.anonymous")) returned 1 [0097.952] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0097.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.952] GetFileType (hFile=0x154) returned 0x1 [0097.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.952] GetFileType (hFile=0x154) returned 0x1 [0097.952] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ef [0097.952] ReadFile (in: hFile=0x154, lpBuffer=0x1b22880, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b22880*, lpNumberOfBytesRead=0x2ae404*=0x2ef, lpOverlapped=0x0) returned 1 [0097.954] CloseHandle (hObject=0x154) returned 1 [0097.966] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0097.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0097.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.967] GetFileType (hFile=0x154) returned 0x1 [0097.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0097.967] GetFileType (hFile=0x154) returned 0x1 [0097.967] WriteFile (in: hFile=0x154, lpBuffer=0x1b71698*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b71698*, lpNumberOfBytesWritten=0x2ae3cc*=0x2f0, lpOverlapped=0x0) returned 1 [0097.969] CloseHandle (hObject=0x154) returned 1 [0097.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0097.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.anonymous", lpFilePart=0x0) returned 0x71 [0097.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0097.969] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd954b9d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0097.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0097.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.anonymous")) returned 1 [0097.969] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0097.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0097.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0097.970] GetFileType (hFile=0x154) returned 0x1 [0097.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0097.970] GetFileType (hFile=0x154) returned 0x1 [0097.970] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x115a [0097.970] ReadFile (in: hFile=0x154, lpBuffer=0x1b72aec, nNumberOfBytesToRead=0x115a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b72aec*, lpNumberOfBytesRead=0x2ae404*=0x115a, lpOverlapped=0x0) returned 1 [0097.971] CloseHandle (hObject=0x154) returned 1 [0098.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0098.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.010] GetFileType (hFile=0x154) returned 0x1 [0098.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.010] GetFileType (hFile=0x154) returned 0x1 [0098.010] WriteFile (in: hFile=0x154, lpBuffer=0x19c603c*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19c603c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1160, lpOverlapped=0x0) returned 1 [0098.011] CloseHandle (hObject=0x154) returned 1 [0098.012] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0098.012] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.anonymous", lpFilePart=0x0) returned 0x73 [0098.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.012] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd95bddf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1160)) returned 1 [0098.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.anonymous")) returned 1 [0098.012] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpFilePart=0x0) returned 0x65 [0098.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.013] GetFileType (hFile=0x154) returned 0x1 [0098.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.013] GetFileType (hFile=0x154) returned 0x1 [0098.013] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd9c [0098.013] ReadFile (in: hFile=0x154, lpBuffer=0x19c850c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c850c*, lpNumberOfBytesRead=0x2ae404*=0xd9c, lpOverlapped=0x0) returned 1 [0098.023] CloseHandle (hObject=0x154) returned 1 [0098.037] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpFilePart=0x0) returned 0x65 [0098.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.038] GetFileType (hFile=0x154) returned 0x1 [0098.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.038] GetFileType (hFile=0x154) returned 0x1 [0098.038] WriteFile (in: hFile=0x154, lpBuffer=0x1a1a9e8*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1a9e8*, lpNumberOfBytesWritten=0x2ae3cc*=0xda0, lpOverlapped=0x0) returned 1 [0098.039] CloseHandle (hObject=0x154) returned 1 [0098.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpFilePart=0x0) returned 0x65 [0098.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.anonymous", lpFilePart=0x0) returned 0x6f [0098.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.040] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd960a0b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xda0)) returned 1 [0098.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.anonymous")) returned 1 [0098.040] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0098.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.041] GetFileType (hFile=0x154) returned 0x1 [0098.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.041] GetFileType (hFile=0x154) returned 0x1 [0098.041] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x7f0 [0098.041] ReadFile (in: hFile=0x154, lpBuffer=0x1a1c65c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1c65c*, lpNumberOfBytesRead=0x2ae404*=0x7f0, lpOverlapped=0x0) returned 1 [0098.042] CloseHandle (hObject=0x154) returned 1 [0098.055] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0098.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.056] GetFileType (hFile=0x154) returned 0x1 [0098.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.057] GetFileType (hFile=0x154) returned 0x1 [0098.057] WriteFile (in: hFile=0x154, lpBuffer=0x1a6cddc*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6cddc*, lpNumberOfBytesWritten=0x2ae3cc*=0x800, lpOverlapped=0x0) returned 1 [0098.058] CloseHandle (hObject=0x154) returned 1 [0098.058] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0098.058] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0098.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.058] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9630210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1 [0098.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.anonymous")) returned 1 [0098.064] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0098.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.064] GetFileType (hFile=0x154) returned 0x1 [0098.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.064] GetFileType (hFile=0x154) returned 0x1 [0098.064] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x858 [0098.064] ReadFile (in: hFile=0x154, lpBuffer=0x1a6eab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6eab0*, lpNumberOfBytesRead=0x2ae404*=0x858, lpOverlapped=0x0) returned 1 [0098.066] CloseHandle (hObject=0x154) returned 1 [0098.078] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0098.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.079] GetFileType (hFile=0x154) returned 0x1 [0098.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.079] GetFileType (hFile=0x154) returned 0x1 [0098.079] WriteFile (in: hFile=0x154, lpBuffer=0x1abf408*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1abf408*, lpNumberOfBytesWritten=0x2ae3cc*=0x860, lpOverlapped=0x0) returned 1 [0098.080] CloseHandle (hObject=0x154) returned 1 [0098.080] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0098.080] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0098.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.080] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9656370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0098.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.anonymous")) returned 1 [0098.081] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0098.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.081] GetFileType (hFile=0x154) returned 0x1 [0098.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.081] GetFileType (hFile=0x154) returned 0x1 [0098.081] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x46a3 [0098.082] ReadFile (in: hFile=0x154, lpBuffer=0x1ac0880, nNumberOfBytesToRead=0x46a3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac0880*, lpNumberOfBytesRead=0x2ae404*=0x46a3, lpOverlapped=0x0) returned 1 [0098.083] CloseHandle (hObject=0x154) returned 1 [0098.096] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0098.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.097] GetFileType (hFile=0x154) returned 0x1 [0098.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.098] GetFileType (hFile=0x154) returned 0x1 [0098.098] WriteFile (in: hFile=0x154, lpBuffer=0x1b237dc*, nNumberOfBytesToWrite=0x46b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b237dc*, lpNumberOfBytesWritten=0x2ae3f8*=0x46b0, lpOverlapped=0x0) returned 1 [0098.099] CloseHandle (hObject=0x154) returned 1 [0098.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0098.099] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.anonymous", lpFilePart=0x0) returned 0x76 [0098.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.099] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd96a2630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x46b0)) returned 1 [0098.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.anonymous")) returned 1 [0098.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0098.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.101] GetFileType (hFile=0x154) returned 0x1 [0098.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.101] GetFileType (hFile=0x154) returned 0x1 [0098.101] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x612 [0098.101] ReadFile (in: hFile=0x154, lpBuffer=0x1b28aac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b28aac*, lpNumberOfBytesRead=0x2ae404*=0x612, lpOverlapped=0x0) returned 1 [0098.102] CloseHandle (hObject=0x154) returned 1 [0098.115] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0098.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.116] GetFileType (hFile=0x154) returned 0x1 [0098.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.116] GetFileType (hFile=0x154) returned 0x1 [0098.116] WriteFile (in: hFile=0x154, lpBuffer=0x1b788cc*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b788cc*, lpNumberOfBytesWritten=0x2ae3cc*=0x620, lpOverlapped=0x0) returned 1 [0098.117] CloseHandle (hObject=0x154) returned 1 [0098.117] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0098.117] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0098.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.117] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e42500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd96c8790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x620)) returned 1 [0098.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.anonymous")) returned 1 [0098.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0098.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.119] GetFileType (hFile=0x154) returned 0x1 [0098.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.119] GetFileType (hFile=0x154) returned 0x1 [0098.119] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1499 [0098.119] ReadFile (in: hFile=0x154, lpBuffer=0x1b79d68, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b79d68*, lpNumberOfBytesRead=0x2ae404*=0x1499, lpOverlapped=0x0) returned 1 [0098.137] CloseHandle (hObject=0x154) returned 1 [0098.191] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0098.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.194] GetFileType (hFile=0x154) returned 0x1 [0098.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.194] GetFileType (hFile=0x154) returned 0x1 [0098.194] WriteFile (in: hFile=0x154, lpBuffer=0x19cd5a4*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19cd5a4*, lpNumberOfBytesWritten=0x2ae3f8*=0x14a0, lpOverlapped=0x0) returned 1 [0098.195] CloseHandle (hObject=0x154) returned 1 [0098.195] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0098.195] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.anonymous", lpFilePart=0x0) returned 0x79 [0098.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390b3300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e343d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9786e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14a0)) returned 1 [0098.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.anonymous")) returned 1 [0098.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0098.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.201] GetFileType (hFile=0x154) returned 0x1 [0098.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.201] GetFileType (hFile=0x154) returned 0x1 [0098.201] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x638 [0098.201] ReadFile (in: hFile=0x154, lpBuffer=0x19cf6c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cf6c4*, lpNumberOfBytesRead=0x2ae404*=0x638, lpOverlapped=0x0) returned 1 [0098.225] CloseHandle (hObject=0x154) returned 1 [0098.239] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0098.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.240] GetFileType (hFile=0x154) returned 0x1 [0098.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.240] GetFileType (hFile=0x154) returned 0x1 [0098.241] WriteFile (in: hFile=0x154, lpBuffer=0x1a1f6fc*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1f6fc*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0098.242] CloseHandle (hObject=0x154) returned 1 [0098.242] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0098.242] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x7d [0098.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.242] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390b3300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd97f9290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0098.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.anonymous")) returned 1 [0098.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpFilePart=0x0) returned 0x66 [0098.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.243] GetFileType (hFile=0x154) returned 0x1 [0098.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.243] GetFileType (hFile=0x154) returned 0x1 [0098.243] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x164a [0098.243] ReadFile (in: hFile=0x154, lpBuffer=0x1a20b8c, nNumberOfBytesToRead=0x164a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a20b8c*, lpNumberOfBytesRead=0x2ae404*=0x164a, lpOverlapped=0x0) returned 1 [0098.244] CloseHandle (hObject=0x154) returned 1 [0098.257] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpFilePart=0x0) returned 0x66 [0098.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.258] GetFileType (hFile=0x154) returned 0x1 [0098.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.258] GetFileType (hFile=0x154) returned 0x1 [0098.258] WriteFile (in: hFile=0x154, lpBuffer=0x1a74908*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a74908*, lpNumberOfBytesWritten=0x2ae3f8*=0x1650, lpOverlapped=0x0) returned 1 [0098.259] CloseHandle (hObject=0x154) returned 1 [0098.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpFilePart=0x0) returned 0x66 [0098.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.anonymous", lpFilePart=0x0) returned 0x70 [0098.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.260] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390b3300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd981f3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1650)) returned 1 [0098.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.anonymous")) returned 1 [0098.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpFilePart=0x0) returned 0x69 [0098.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.261] GetFileType (hFile=0x154) returned 0x1 [0098.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.261] GetFileType (hFile=0x154) returned 0x1 [0098.261] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xadf [0098.261] ReadFile (in: hFile=0x154, lpBuffer=0x1a77004, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a77004*, lpNumberOfBytesRead=0x2ae404*=0xadf, lpOverlapped=0x0) returned 1 [0098.286] CloseHandle (hObject=0x154) returned 1 [0098.298] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpFilePart=0x0) returned 0x69 [0098.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.299] GetFileType (hFile=0x154) returned 0x1 [0098.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.300] GetFileType (hFile=0x154) returned 0x1 [0098.300] WriteFile (in: hFile=0x154, lpBuffer=0x1ac85d4*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ac85d4*, lpNumberOfBytesWritten=0x2ae3cc*=0xae0, lpOverlapped=0x0) returned 1 [0098.301] CloseHandle (hObject=0x154) returned 1 [0098.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpFilePart=0x0) returned 0x69 [0098.301] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.anonymous", lpFilePart=0x0) returned 0x73 [0098.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390b3300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x884a3d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd986b6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xae0)) returned 1 [0098.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.anonymous")) returned 1 [0098.302] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpFilePart=0x0) returned 0x65 [0098.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.302] GetFileType (hFile=0x154) returned 0x1 [0098.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.302] GetFileType (hFile=0x154) returned 0x1 [0098.303] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1bfb [0098.303] ReadFile (in: hFile=0x154, lpBuffer=0x1ac9a24, nNumberOfBytesToRead=0x1bfb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac9a24*, lpNumberOfBytesRead=0x2ae404*=0x1bfb, lpOverlapped=0x0) returned 1 [0098.306] CloseHandle (hObject=0x154) returned 1 [0098.318] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpFilePart=0x0) returned 0x65 [0098.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.321] GetFileType (hFile=0x154) returned 0x1 [0098.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.321] GetFileType (hFile=0x154) returned 0x1 [0098.321] WriteFile (in: hFile=0x154, lpBuffer=0x1b1f410*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b1f410*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c00, lpOverlapped=0x0) returned 1 [0098.324] CloseHandle (hObject=0x154) returned 1 [0098.324] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpFilePart=0x0) returned 0x65 [0098.324] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.anonymous", lpFilePart=0x0) returned 0x6f [0098.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.324] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390b3300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e343d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd98b7970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0098.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.anonymous")) returned 1 [0098.325] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0098.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.326] GetFileType (hFile=0x154) returned 0x1 [0098.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.326] GetFileType (hFile=0x154) returned 0x1 [0098.326] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa52f [0098.326] ReadFile (in: hFile=0x154, lpBuffer=0x1b215d8, nNumberOfBytesToRead=0xa52f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b215d8*, lpNumberOfBytesRead=0x2ae404*=0xa52f, lpOverlapped=0x0) returned 1 [0098.327] CloseHandle (hObject=0x154) returned 1 [0098.343] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0098.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.345] GetFileType (hFile=0x154) returned 0x1 [0098.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.345] GetFileType (hFile=0x154) returned 0x1 [0098.345] WriteFile (in: hFile=0x154, lpBuffer=0x19b4c48*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19b4c48*, lpNumberOfBytesWritten=0x2ae3f8*=0xa530, lpOverlapped=0x0) returned 1 [0098.347] CloseHandle (hObject=0x154) returned 1 [0098.347] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0098.347] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.anonymous", lpFilePart=0x0) returned 0x6e [0098.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.347] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390b3300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d1682d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd98ddad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa530)) returned 1 [0098.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.anonymous")) returned 1 [0098.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0098.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.348] GetFileType (hFile=0x154) returned 0x1 [0098.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.348] GetFileType (hFile=0x154) returned 0x1 [0098.348] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x350 [0098.348] ReadFile (in: hFile=0x154, lpBuffer=0x19bfa80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19bfa80*, lpNumberOfBytesRead=0x2ae404*=0x350, lpOverlapped=0x0) returned 1 [0098.359] CloseHandle (hObject=0x154) returned 1 [0098.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0098.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.397] GetFileType (hFile=0x154) returned 0x1 [0098.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.397] GetFileType (hFile=0x154) returned 0x1 [0098.397] WriteFile (in: hFile=0x154, lpBuffer=0x1a0ec24*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a0ec24*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0098.399] CloseHandle (hObject=0x154) returned 1 [0098.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0098.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.anonymous", lpFilePart=0x0) returned 0x6e [0098.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.399] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9976050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0098.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.anonymous")) returned 1 [0098.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0098.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.400] GetFileType (hFile=0x154) returned 0x1 [0098.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.400] GetFileType (hFile=0x154) returned 0x1 [0098.400] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x34f [0098.400] ReadFile (in: hFile=0x154, lpBuffer=0x1a103b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a103b8*, lpNumberOfBytesRead=0x2ae404*=0x34f, lpOverlapped=0x0) returned 1 [0098.417] CloseHandle (hObject=0x154) returned 1 [0098.430] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0098.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.431] GetFileType (hFile=0x154) returned 0x1 [0098.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.431] GetFileType (hFile=0x154) returned 0x1 [0098.431] WriteFile (in: hFile=0x154, lpBuffer=0x1a5f3a8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a5f3a8*, lpNumberOfBytesWritten=0x2ae3cc*=0x350, lpOverlapped=0x0) returned 1 [0098.432] CloseHandle (hObject=0x154) returned 1 [0098.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0098.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.anonymous", lpFilePart=0x0) returned 0x6f [0098.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.432] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd99c2310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0098.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.anonymous")) returned 1 [0098.433] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0098.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.433] GetFileType (hFile=0x154) returned 0x1 [0098.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.433] GetFileType (hFile=0x154) returned 0x1 [0098.434] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x365 [0098.434] ReadFile (in: hFile=0x154, lpBuffer=0x1a60b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a60b60*, lpNumberOfBytesRead=0x2ae404*=0x365, lpOverlapped=0x0) returned 1 [0098.446] CloseHandle (hObject=0x154) returned 1 [0098.458] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0098.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.460] GetFileType (hFile=0x154) returned 0x1 [0098.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.460] GetFileType (hFile=0x154) returned 0x1 [0098.460] WriteFile (in: hFile=0x154, lpBuffer=0x1aafbec*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aafbec*, lpNumberOfBytesWritten=0x2ae3cc*=0x370, lpOverlapped=0x0) returned 1 [0098.461] CloseHandle (hObject=0x154) returned 1 [0098.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0098.461] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.anonymous", lpFilePart=0x0) returned 0x6c [0098.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.461] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9a0e5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0098.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.anonymous")) returned 1 [0098.462] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0098.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.462] GetFileType (hFile=0x154) returned 0x1 [0098.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.462] GetFileType (hFile=0x154) returned 0x1 [0098.462] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x34f [0098.462] ReadFile (in: hFile=0x154, lpBuffer=0x1ab1364, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab1364*, lpNumberOfBytesRead=0x2ae404*=0x34f, lpOverlapped=0x0) returned 1 [0098.464] CloseHandle (hObject=0x154) returned 1 [0098.476] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0098.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.477] GetFileType (hFile=0x154) returned 0x1 [0098.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.477] GetFileType (hFile=0x154) returned 0x1 [0098.477] WriteFile (in: hFile=0x154, lpBuffer=0x1b00344*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b00344*, lpNumberOfBytesWritten=0x2ae3cc*=0x350, lpOverlapped=0x0) returned 1 [0098.478] CloseHandle (hObject=0x154) returned 1 [0098.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0098.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.anonymous", lpFilePart=0x0) returned 0x6b [0098.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.479] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9a34730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0098.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.anonymous")) returned 1 [0098.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0098.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.480] GetFileType (hFile=0x154) returned 0x1 [0098.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.480] GetFileType (hFile=0x154) returned 0x1 [0098.480] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3ec [0098.480] ReadFile (in: hFile=0x154, lpBuffer=0x1b01b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b01b60*, lpNumberOfBytesRead=0x2ae404*=0x3ec, lpOverlapped=0x0) returned 1 [0098.483] CloseHandle (hObject=0x154) returned 1 [0098.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0098.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.497] GetFileType (hFile=0x154) returned 0x1 [0098.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.497] GetFileType (hFile=0x154) returned 0x1 [0098.497] WriteFile (in: hFile=0x154, lpBuffer=0x1b50e74*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b50e74*, lpNumberOfBytesWritten=0x2ae3cc*=0x3f0, lpOverlapped=0x0) returned 1 [0098.498] CloseHandle (hObject=0x154) returned 1 [0098.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0098.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.anonymous", lpFilePart=0x0) returned 0x70 [0098.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.498] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9a5a890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0098.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.anonymous")) returned 1 [0098.499] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x65 [0098.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.499] GetFileType (hFile=0x154) returned 0x1 [0098.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.499] GetFileType (hFile=0x154) returned 0x1 [0098.499] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x37a [0098.500] ReadFile (in: hFile=0x154, lpBuffer=0x1b52640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b52640*, lpNumberOfBytesRead=0x2ae404*=0x37a, lpOverlapped=0x0) returned 1 [0098.502] CloseHandle (hObject=0x154) returned 1 [0098.521] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x65 [0098.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.523] GetFileType (hFile=0x154) returned 0x1 [0098.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.523] GetFileType (hFile=0x154) returned 0x1 [0098.523] WriteFile (in: hFile=0x154, lpBuffer=0x1ba1724*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ba1724*, lpNumberOfBytesWritten=0x2ae3cc*=0x380, lpOverlapped=0x0) returned 1 [0098.524] CloseHandle (hObject=0x154) returned 1 [0098.524] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpFilePart=0x0) returned 0x65 [0098.524] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.anonymous", lpFilePart=0x0) returned 0x6f [0098.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.525] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9aa6b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0098.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.anonymous")) returned 1 [0098.526] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0098.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.526] GetFileType (hFile=0x154) returned 0x1 [0098.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.526] GetFileType (hFile=0x154) returned 0x1 [0098.526] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35f [0098.526] ReadFile (in: hFile=0x154, lpBuffer=0x1ba2ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ba2ed8*, lpNumberOfBytesRead=0x2ae404*=0x35f, lpOverlapped=0x0) returned 1 [0098.545] CloseHandle (hObject=0x154) returned 1 [0098.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0098.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.562] GetFileType (hFile=0x154) returned 0x1 [0098.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.562] GetFileType (hFile=0x154) returned 0x1 [0098.562] WriteFile (in: hFile=0x154, lpBuffer=0x1bf1f28*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1bf1f28*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0098.565] CloseHandle (hObject=0x154) returned 1 [0098.565] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0098.565] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.anonymous", lpFilePart=0x0) returned 0x73 [0098.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.565] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9af2e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0098.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.anonymous")) returned 1 [0098.566] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpFilePart=0x0) returned 0x64 [0098.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.566] GetFileType (hFile=0x154) returned 0x1 [0098.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.566] GetFileType (hFile=0x154) returned 0x1 [0098.566] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xf1 [0098.566] ReadFile (in: hFile=0x154, lpBuffer=0x1bf3474, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1bf3474*, lpNumberOfBytesRead=0x2ae404*=0xf1, lpOverlapped=0x0) returned 1 [0098.567] CloseHandle (hObject=0x154) returned 1 [0098.589] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpFilePart=0x0) returned 0x64 [0098.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.591] GetFileType (hFile=0x154) returned 0x1 [0098.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.592] GetFileType (hFile=0x154) returned 0x1 [0098.592] WriteFile (in: hFile=0x154, lpBuffer=0x1c41700*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1c41700*, lpNumberOfBytesWritten=0x2ae3cc*=0x100, lpOverlapped=0x0) returned 1 [0098.593] CloseHandle (hObject=0x154) returned 1 [0098.593] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpFilePart=0x0) returned 0x64 [0098.593] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.anonymous", lpFilePart=0x0) returned 0x6e [0098.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.593] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9b3f0d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0098.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.anonymous")) returned 1 [0098.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0098.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.595] GetFileType (hFile=0x154) returned 0x1 [0098.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.595] GetFileType (hFile=0x154) returned 0x1 [0098.595] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35d [0098.595] ReadFile (in: hFile=0x154, lpBuffer=0x1c42eb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1c42eb4*, lpNumberOfBytesRead=0x2ae404*=0x35d, lpOverlapped=0x0) returned 1 [0098.598] CloseHandle (hObject=0x154) returned 1 [0098.622] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0098.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.623] GetFileType (hFile=0x154) returned 0x1 [0098.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.623] GetFileType (hFile=0x154) returned 0x1 [0098.623] WriteFile (in: hFile=0x154, lpBuffer=0x1c91f04*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1c91f04*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0098.624] CloseHandle (hObject=0x154) returned 1 [0098.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0098.624] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.anonymous", lpFilePart=0x0) returned 0x73 [0098.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.624] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9b8b390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0098.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.anonymous")) returned 1 [0098.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpFilePart=0x0) returned 0x61 [0098.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.625] GetFileType (hFile=0x154) returned 0x1 [0098.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.625] GetFileType (hFile=0x154) returned 0x1 [0098.625] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x354 [0098.626] ReadFile (in: hFile=0x154, lpBuffer=0x1c936a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1c936a4*, lpNumberOfBytesRead=0x2ae404*=0x354, lpOverlapped=0x0) returned 1 [0098.627] CloseHandle (hObject=0x154) returned 1 [0098.650] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpFilePart=0x0) returned 0x61 [0098.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.653] GetFileType (hFile=0x154) returned 0x1 [0098.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.653] GetFileType (hFile=0x154) returned 0x1 [0098.653] WriteFile (in: hFile=0x154, lpBuffer=0x1ce26dc*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ce26dc*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0098.655] CloseHandle (hObject=0x154) returned 1 [0098.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpFilePart=0x0) returned 0x61 [0098.655] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.anonymous", lpFilePart=0x0) returned 0x6b [0098.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3c6000, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9bd7650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0098.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.anonymous")) returned 1 [0098.656] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0098.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.656] GetFileType (hFile=0x154) returned 0x1 [0098.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.656] GetFileType (hFile=0x154) returned 0x1 [0098.656] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x352 [0098.656] ReadFile (in: hFile=0x154, lpBuffer=0x1ce3e50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ce3e50*, lpNumberOfBytesRead=0x2ae404*=0x352, lpOverlapped=0x0) returned 1 [0098.658] CloseHandle (hObject=0x154) returned 1 [0098.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0098.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.684] GetFileType (hFile=0x154) returned 0x1 [0098.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.684] GetFileType (hFile=0x154) returned 0x1 [0098.685] WriteFile (in: hFile=0x154, lpBuffer=0x1d32e90*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1d32e90*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0098.686] CloseHandle (hObject=0x154) returned 1 [0098.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0098.686] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.anonymous", lpFilePart=0x0) returned 0x6c [0098.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b6d8d00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9c23910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0098.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.anonymous")) returned 1 [0098.687] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0098.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.687] GetFileType (hFile=0x154) returned 0x1 [0098.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.687] GetFileType (hFile=0x154) returned 0x1 [0098.687] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x373 [0098.687] ReadFile (in: hFile=0x154, lpBuffer=0x1d34630, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1d34630*, lpNumberOfBytesRead=0x2ae404*=0x373, lpOverlapped=0x0) returned 1 [0098.689] CloseHandle (hObject=0x154) returned 1 [0098.744] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0098.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.746] GetFileType (hFile=0x154) returned 0x1 [0098.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.746] GetFileType (hFile=0x154) returned 0x1 [0098.747] WriteFile (in: hFile=0x154, lpBuffer=0x19b90e4*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19b90e4*, lpNumberOfBytesWritten=0x2ae3cc*=0x380, lpOverlapped=0x0) returned 1 [0098.748] CloseHandle (hObject=0x154) returned 1 [0098.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0098.748] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.anonymous", lpFilePart=0x0) returned 0x6c [0098.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.748] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b6d8d00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9cbbe90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0098.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.anonymous")) returned 1 [0098.749] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpFilePart=0x0) returned 0x65 [0098.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.749] GetFileType (hFile=0x154) returned 0x1 [0098.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.749] GetFileType (hFile=0x154) returned 0x1 [0098.750] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa0 [0098.750] ReadFile (in: hFile=0x154, lpBuffer=0x19ba5bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ba5bc*, lpNumberOfBytesRead=0x2ae404*=0xa0, lpOverlapped=0x0) returned 1 [0098.751] CloseHandle (hObject=0x154) returned 1 [0098.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpFilePart=0x0) returned 0x65 [0098.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.774] GetFileType (hFile=0x154) returned 0x1 [0098.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.774] GetFileType (hFile=0x154) returned 0x1 [0098.774] WriteFile (in: hFile=0x154, lpBuffer=0x1a08908*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a08908*, lpNumberOfBytesWritten=0x2ae3cc*=0xb0, lpOverlapped=0x0) returned 1 [0098.775] CloseHandle (hObject=0x154) returned 1 [0098.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpFilePart=0x0) returned 0x65 [0098.775] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.anonymous", lpFilePart=0x0) returned 0x6f [0098.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.776] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b6d8d00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9d08150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0098.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.anonymous")) returned 1 [0098.777] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpFilePart=0x0) returned 0x64 [0098.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.777] GetFileType (hFile=0x154) returned 0x1 [0098.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.777] GetFileType (hFile=0x154) returned 0x1 [0098.777] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35c [0098.777] ReadFile (in: hFile=0x154, lpBuffer=0x1a0a0a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a0a0a4*, lpNumberOfBytesRead=0x2ae404*=0x35c, lpOverlapped=0x0) returned 1 [0098.790] CloseHandle (hObject=0x154) returned 1 [0098.808] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpFilePart=0x0) returned 0x64 [0098.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.810] GetFileType (hFile=0x154) returned 0x1 [0098.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.810] GetFileType (hFile=0x154) returned 0x1 [0098.810] WriteFile (in: hFile=0x154, lpBuffer=0x1a590e0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a590e0*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0098.811] CloseHandle (hObject=0x154) returned 1 [0098.812] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpFilePart=0x0) returned 0x64 [0098.812] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.anonymous", lpFilePart=0x0) returned 0x6e [0098.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.812] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b6d8d00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9d54410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0098.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.anonymous")) returned 1 [0098.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x68 [0098.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0098.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.818] GetFileType (hFile=0x154) returned 0x1 [0098.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0098.819] GetFileType (hFile=0x154) returned 0x1 [0098.819] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd78 [0098.819] ReadFile (in: hFile=0x154, lpBuffer=0x1a5b328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5b328*, lpNumberOfBytesRead=0x2ae404*=0xd78, lpOverlapped=0x0) returned 1 [0098.838] CloseHandle (hObject=0x154) returned 1 [0098.856] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x68 [0098.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0098.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.858] GetFileType (hFile=0x154) returned 0x1 [0098.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0098.858] GetFileType (hFile=0x154) returned 0x1 [0098.858] WriteFile (in: hFile=0x154, lpBuffer=0x1aad618*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aad618*, lpNumberOfBytesWritten=0x2ae3cc*=0xd80, lpOverlapped=0x0) returned 1 [0098.859] CloseHandle (hObject=0x154) returned 1 [0098.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpFilePart=0x0) returned 0x68 [0098.859] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.anonymous", lpFilePart=0x0) returned 0x72 [0098.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0098.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b6d8d00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x851e8870, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xd9dc6830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd80)) returned 1 [0098.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.anonymous")) returned 1 [0098.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0098.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles", lpFilePart=0x0) returned 0x5e [0098.861] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpFilePart=0x0) returned 0x5f [0098.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0098.863] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.864] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.864] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.864] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.864] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.864] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.865] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.866] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.867] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.868] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.869] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.870] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0098.870] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0098.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0098.871] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles", lpFilePart=0x0) returned 0x5e [0098.871] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpFilePart=0x0) returned 0x5f [0098.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec18 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.873] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.874] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.874] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.874] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.874] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.874] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.874] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.875] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.876] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.877] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.878] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.878] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.878] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.878] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.878] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.896] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.896] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.896] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.896] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0098.896] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0098.897] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0098.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0098.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.898] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana", lpFilePart=0x0) returned 0x68 [0098.898] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpFilePart=0x0) returned 0x69 [0098.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.901] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.902] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.902] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.902] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.902] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana", lpFilePart=0x0) returned 0x68 [0098.902] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpFilePart=0x0) returned 0x69 [0098.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.903] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.903] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.903] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.903] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.903] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.903] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue", lpFilePart=0x0) returned 0x67 [0098.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpFilePart=0x0) returned 0x68 [0098.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.917] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.918] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.918] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.918] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.918] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.918] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.918] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue", lpFilePart=0x0) returned 0x67 [0098.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpFilePart=0x0) returned 0x68 [0098.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.919] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.919] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.919] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.919] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.919] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.919] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.920] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay", lpFilePart=0x0) returned 0x65 [0098.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpFilePart=0x0) returned 0x66 [0098.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.920] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.921] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.921] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.921] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.921] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.921] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay", lpFilePart=0x0) returned 0x65 [0098.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpFilePart=0x0) returned 0x66 [0098.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.921] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.922] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.929] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.929] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.929] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.929] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange", lpFilePart=0x0) returned 0x6b [0098.929] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpFilePart=0x0) returned 0x6c [0098.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.930] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.930] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.930] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.930] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.930] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.930] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.930] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0098.930] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange", lpFilePart=0x0) returned 0x6b [0098.930] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpFilePart=0x0) returned 0x6c [0098.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbec18 [0098.931] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.931] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.931] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.931] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.931] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0098.931] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0098.931] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0098.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0098.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0098.931] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x7a [0098.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0098.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0098.931] GetFileType (hFile=0x154) returned 0x1 [0098.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0098.931] GetFileType (hFile=0x154) returned 0x1 [0098.931] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x143 [0098.931] ReadFile (in: hFile=0x154, lpBuffer=0x1ac68e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1ac68e4*, lpNumberOfBytesRead=0x2ae31c*=0x143, lpOverlapped=0x0) returned 1 [0098.934] CloseHandle (hObject=0x154) returned 1 [0099.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x7a [0099.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0099.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.092] GetFileType (hFile=0x154) returned 0x1 [0099.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0099.092] GetFileType (hFile=0x154) returned 0x1 [0099.092] WriteFile (in: hFile=0x154, lpBuffer=0x1b14f04*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1b14f04*, lpNumberOfBytesWritten=0x2ae2e4*=0x150, lpOverlapped=0x0) returned 1 [0099.093] CloseHandle (hObject=0x154) returned 1 [0099.093] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpFilePart=0x0) returned 0x7a [0099.093] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.anonymous", lpFilePart=0x0) returned 0x84 [0099.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0099.093] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33155200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76d64870, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda001cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0099.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0099.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.anonymous")) returned 1 [0099.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.095] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow", lpFilePart=0x0) returned 0x6b [0099.095] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpFilePart=0x0) returned 0x6c [0099.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.095] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.097] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.097] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.097] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.097] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.097] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.097] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow", lpFilePart=0x0) returned 0x6b [0099.097] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpFilePart=0x0) returned 0x6c [0099.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.098] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.098] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.098] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.098] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.098] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.098] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.098] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert", lpFilePart=0x0) returned 0x65 [0099.098] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpFilePart=0x0) returned 0x66 [0099.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.099] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.099] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.099] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.099] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.100] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.100] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert", lpFilePart=0x0) returned 0x65 [0099.100] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpFilePart=0x0) returned 0x66 [0099.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.100] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.100] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.100] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.100] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.101] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.101] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck", lpFilePart=0x0) returned 0x68 [0099.101] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpFilePart=0x0) returned 0x69 [0099.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.102] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.102] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.102] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.102] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.102] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.102] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck", lpFilePart=0x0) returned 0x68 [0099.102] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpFilePart=0x0) returned 0x69 [0099.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.103] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.103] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.103] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.103] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.103] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.103] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.103] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime", lpFilePart=0x0) returned 0x63 [0099.103] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpFilePart=0x0) returned 0x64 [0099.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.104] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.104] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.104] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.104] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.105] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime", lpFilePart=0x0) returned 0x63 [0099.105] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpFilePart=0x0) returned 0x64 [0099.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.105] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.105] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.105] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.105] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.105] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis", lpFilePart=0x0) returned 0x64 [0099.105] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpFilePart=0x0) returned 0x65 [0099.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.106] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.106] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.106] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.106] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.107] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.107] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.107] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis", lpFilePart=0x0) returned 0x64 [0099.107] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpFilePart=0x0) returned 0x65 [0099.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.107] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.107] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.107] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.107] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.107] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.107] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate", lpFilePart=0x0) returned 0x64 [0099.108] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpFilePart=0x0) returned 0x65 [0099.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.117] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.117] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.117] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.117] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.117] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate", lpFilePart=0x0) returned 0x64 [0099.118] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpFilePart=0x0) returned 0x65 [0099.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.118] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.118] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.118] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.118] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.118] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue", lpFilePart=0x0) returned 0x67 [0099.118] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpFilePart=0x0) returned 0x68 [0099.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.119] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.119] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.119] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.120] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue", lpFilePart=0x0) returned 0x67 [0099.120] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpFilePart=0x0) returned 0x68 [0099.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.120] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.121] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0099.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x76 [0099.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0099.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.121] GetFileType (hFile=0x154) returned 0x1 [0099.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0099.121] GetFileType (hFile=0x154) returned 0x1 [0099.121] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x1afa [0099.121] ReadFile (in: hFile=0x154, lpBuffer=0x1b28184, nNumberOfBytesToRead=0x1afa, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b28184*, lpNumberOfBytesRead=0x2ae31c*=0x1afa, lpOverlapped=0x0) returned 1 [0099.132] CloseHandle (hObject=0x154) returned 1 [0099.145] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x76 [0099.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0099.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.147] GetFileType (hFile=0x154) returned 0x1 [0099.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0099.147] GetFileType (hFile=0x154) returned 0x1 [0099.147] WriteFile (in: hFile=0x154, lpBuffer=0x1b7d670*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x1b7d670*, lpNumberOfBytesWritten=0x2ae310*=0x1b00, lpOverlapped=0x0) returned 1 [0099.148] CloseHandle (hObject=0x154) returned 1 [0099.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpFilePart=0x0) returned 0x76 [0099.148] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.anonymous", lpFilePart=0x0) returned 0x80 [0099.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0099.148] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a8d900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x826776f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda09a250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b00)) returned 1 [0099.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0099.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.anonymous")) returned 1 [0099.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.149] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen", lpFilePart=0x0) returned 0x6a [0099.149] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpFilePart=0x0) returned 0x6b [0099.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0099.150] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.150] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.150] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.150] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.150] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.151] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0099.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.151] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen", lpFilePart=0x0) returned 0x6a [0099.151] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpFilePart=0x0) returned 0x6b [0099.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0099.151] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.151] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.151] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.151] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.151] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.151] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0099.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.152] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2", lpFilePart=0x0) returned 0x63 [0099.152] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpFilePart=0x0) returned 0x64 [0099.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0099.153] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.153] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.153] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.153] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.153] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.153] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.153] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0099.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.154] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2", lpFilePart=0x0) returned 0x63 [0099.154] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpFilePart=0x0) returned 0x64 [0099.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0099.154] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.154] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.154] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.154] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.154] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.154] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.155] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0099.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.155] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x72 [0099.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0099.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.156] GetFileType (hFile=0x154) returned 0x1 [0099.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0099.156] GetFileType (hFile=0x154) returned 0x1 [0099.156] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xe9 [0099.156] ReadFile (in: hFile=0x154, lpBuffer=0x1b851b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b851b4*, lpNumberOfBytesRead=0x2ae31c*=0xe9, lpOverlapped=0x0) returned 1 [0099.157] CloseHandle (hObject=0x154) returned 1 [0099.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x72 [0099.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0099.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.199] GetFileType (hFile=0x154) returned 0x1 [0099.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0099.199] GetFileType (hFile=0x154) returned 0x1 [0099.199] WriteFile (in: hFile=0x154, lpBuffer=0x19d5b70*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19d5b70*, lpNumberOfBytesWritten=0x2ae2e4*=0xf0, lpOverlapped=0x0) returned 1 [0099.200] CloseHandle (hObject=0x154) returned 1 [0099.200] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpFilePart=0x0) returned 0x72 [0099.200] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.anonymous", lpFilePart=0x0) returned 0x7c [0099.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0099.200] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da0600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8270fc70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda10c670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0099.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0099.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.anonymous")) returned 1 [0099.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.201] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl", lpFilePart=0x0) returned 0x64 [0099.201] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpFilePart=0x0) returned 0x65 [0099.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe9d8 [0099.202] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.202] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.202] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.202] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.202] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.202] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.202] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0099.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0099.203] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl", lpFilePart=0x0) returned 0x64 [0099.203] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpFilePart=0x0) returned 0x65 [0099.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe9d8 [0099.203] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.203] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.203] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.203] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.203] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0099.203] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0099.204] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0099.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0099.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0099.204] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x73 [0099.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0099.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.204] GetFileType (hFile=0x154) returned 0x1 [0099.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0099.204] GetFileType (hFile=0x154) returned 0x1 [0099.204] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x32f [0099.204] ReadFile (in: hFile=0x154, lpBuffer=0x19da194, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19da194*, lpNumberOfBytesRead=0x2ae31c*=0x32f, lpOverlapped=0x0) returned 1 [0099.212] CloseHandle (hObject=0x154) returned 1 [0099.224] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x73 [0099.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0099.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.225] GetFileType (hFile=0x154) returned 0x1 [0099.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0099.225] GetFileType (hFile=0x154) returned 0x1 [0099.225] WriteFile (in: hFile=0x154, lpBuffer=0x1a29254*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a29254*, lpNumberOfBytesWritten=0x2ae2e4*=0x330, lpOverlapped=0x0) returned 1 [0099.226] CloseHandle (hObject=0x154) returned 1 [0099.226] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpFilePart=0x0) returned 0x73 [0099.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.anonymous", lpFilePart=0x0) returned 0x7d [0099.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0099.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da0600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8275bf30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda158930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0099.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0099.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.anonymous")) returned 1 [0099.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0099.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5", lpFilePart=0x0) returned 0x52 [0099.227] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpFilePart=0x0) returned 0x53 [0099.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0099.233] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.234] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.234] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.234] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0099.238] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0099.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0099.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0099.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0099.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5", lpFilePart=0x0) returned 0x52 [0099.240] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpFilePart=0x0) returned 0x53 [0099.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0099.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.243] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.244] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.245] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.246] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.246] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.246] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.246] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0099.246] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0099.246] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0099.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0099.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0099.247] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpFilePart=0x0) returned 0x60 [0099.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.248] GetFileType (hFile=0x154) returned 0x1 [0099.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.248] GetFileType (hFile=0x154) returned 0x1 [0099.248] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xae8 [0099.248] ReadFile (in: hFile=0x154, lpBuffer=0x1a37410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a37410*, lpNumberOfBytesRead=0x2ae404*=0xae8, lpOverlapped=0x0) returned 1 [0099.253] CloseHandle (hObject=0x154) returned 1 [0099.266] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpFilePart=0x0) returned 0x60 [0099.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.268] GetFileType (hFile=0x154) returned 0x1 [0099.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.268] GetFileType (hFile=0x154) returned 0x1 [0099.268] WriteFile (in: hFile=0x154, lpBuffer=0x1a88a10*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a88a10*, lpNumberOfBytesWritten=0x2ae3cc*=0xaf0, lpOverlapped=0x0) returned 1 [0099.269] CloseHandle (hObject=0x154) returned 1 [0099.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpFilePart=0x0) returned 0x60 [0099.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.anonymous", lpFilePart=0x0) returned 0x6a [0099.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b6d8d00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x85da9510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda1cad50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaf0)) returned 1 [0099.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.anonymous")) returned 1 [0099.270] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0099.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.271] GetFileType (hFile=0x154) returned 0x1 [0099.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.271] GetFileType (hFile=0x154) returned 0x1 [0099.271] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x43a [0099.271] ReadFile (in: hFile=0x154, lpBuffer=0x1a8a2d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8a2d8*, lpNumberOfBytesRead=0x2ae404*=0x43a, lpOverlapped=0x0) returned 1 [0099.278] CloseHandle (hObject=0x154) returned 1 [0099.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0099.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.291] GetFileType (hFile=0x154) returned 0x1 [0099.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.292] GetFileType (hFile=0x154) returned 0x1 [0099.292] WriteFile (in: hFile=0x154, lpBuffer=0x1ad9780*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ad9780*, lpNumberOfBytesWritten=0x2ae3cc*=0x440, lpOverlapped=0x0) returned 1 [0099.293] CloseHandle (hObject=0x154) returned 1 [0099.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpFilePart=0x0) returned 0x66 [0099.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.anonymous", lpFilePart=0x0) returned 0x70 [0099.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda1f0eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x440)) returned 1 [0099.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.anonymous")) returned 1 [0099.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0099.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.294] GetFileType (hFile=0x154) returned 0x1 [0099.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.294] GetFileType (hFile=0x154) returned 0x1 [0099.294] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x829 [0099.294] ReadFile (in: hFile=0x154, lpBuffer=0x1adb414, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1adb414*, lpNumberOfBytesRead=0x2ae404*=0x829, lpOverlapped=0x0) returned 1 [0099.295] CloseHandle (hObject=0x154) returned 1 [0099.334] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0099.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.336] GetFileType (hFile=0x154) returned 0x1 [0099.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.336] GetFileType (hFile=0x154) returned 0x1 [0099.336] WriteFile (in: hFile=0x154, lpBuffer=0x1b2bc80*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b2bc80*, lpNumberOfBytesWritten=0x2ae3cc*=0x830, lpOverlapped=0x0) returned 1 [0099.337] CloseHandle (hObject=0x154) returned 1 [0099.337] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpFilePart=0x0) returned 0x6b [0099.337] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.anonymous", lpFilePart=0x0) returned 0x75 [0099.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.337] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda2632d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x830)) returned 1 [0099.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.anonymous")) returned 1 [0099.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0099.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.338] GetFileType (hFile=0x154) returned 0x1 [0099.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.338] GetFileType (hFile=0x154) returned 0x1 [0099.338] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ef [0099.339] ReadFile (in: hFile=0x154, lpBuffer=0x1b2d3e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b2d3e0*, lpNumberOfBytesRead=0x2ae404*=0x2ef, lpOverlapped=0x0) returned 1 [0099.340] CloseHandle (hObject=0x154) returned 1 [0099.352] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0099.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.353] GetFileType (hFile=0x154) returned 0x1 [0099.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.353] GetFileType (hFile=0x154) returned 0x1 [0099.353] WriteFile (in: hFile=0x154, lpBuffer=0x1b7c1f8*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b7c1f8*, lpNumberOfBytesWritten=0x2ae3cc*=0x2f0, lpOverlapped=0x0) returned 1 [0099.354] CloseHandle (hObject=0x154) returned 1 [0099.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpFilePart=0x0) returned 0x67 [0099.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.anonymous", lpFilePart=0x0) returned 0x71 [0099.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.354] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda289430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0099.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.anonymous")) returned 1 [0099.355] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0099.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.356] GetFileType (hFile=0x154) returned 0x1 [0099.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.356] GetFileType (hFile=0x154) returned 0x1 [0099.356] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13bb [0099.356] ReadFile (in: hFile=0x154, lpBuffer=0x1b7d64c, nNumberOfBytesToRead=0x13bb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7d64c*, lpNumberOfBytesRead=0x2ae404*=0x13bb, lpOverlapped=0x0) returned 1 [0099.357] CloseHandle (hObject=0x154) returned 1 [0099.396] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0099.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.398] GetFileType (hFile=0x154) returned 0x1 [0099.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.398] GetFileType (hFile=0x154) returned 0x1 [0099.398] WriteFile (in: hFile=0x154, lpBuffer=0x19d106c*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19d106c*, lpNumberOfBytesWritten=0x2ae3f8*=0x13c0, lpOverlapped=0x0) returned 1 [0099.399] CloseHandle (hObject=0x154) returned 1 [0099.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpFilePart=0x0) returned 0x69 [0099.399] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.anonymous", lpFilePart=0x0) returned 0x73 [0099.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.399] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88457a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda2fb850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13c0)) returned 1 [0099.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.anonymous")) returned 1 [0099.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpFilePart=0x0) returned 0x6c [0099.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.401] GetFileType (hFile=0x154) returned 0x1 [0099.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.401] GetFileType (hFile=0x154) returned 0x1 [0099.401] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13c5 [0099.401] ReadFile (in: hFile=0x154, lpBuffer=0x19d2a10, nNumberOfBytesToRead=0x13c5, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19d2a10*, lpNumberOfBytesRead=0x2ae404*=0x13c5, lpOverlapped=0x0) returned 1 [0099.407] CloseHandle (hObject=0x154) returned 1 [0099.419] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpFilePart=0x0) returned 0x6c [0099.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.420] GetFileType (hFile=0x154) returned 0x1 [0099.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.420] GetFileType (hFile=0x154) returned 0x1 [0099.420] WriteFile (in: hFile=0x154, lpBuffer=0x1a25c68*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a25c68*, lpNumberOfBytesWritten=0x2ae3f8*=0x13d0, lpOverlapped=0x0) returned 1 [0099.422] CloseHandle (hObject=0x154) returned 1 [0099.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpFilePart=0x0) returned 0x6c [0099.422] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.anonymous", lpFilePart=0x0) returned 0x76 [0099.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.422] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff336900, ftCreationTime.dwHighDateTime=0x1c7d367, ftLastAccessTime.dwLowDateTime=0x77de8110, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda3219b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13d0)) returned 1 [0099.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.anonymous")) returned 1 [0099.423] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0099.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.423] GetFileType (hFile=0x154) returned 0x1 [0099.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.423] GetFileType (hFile=0x154) returned 0x1 [0099.423] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x8ab [0099.423] ReadFile (in: hFile=0x154, lpBuffer=0x1a27ef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a27ef0*, lpNumberOfBytesRead=0x2ae404*=0x8ab, lpOverlapped=0x0) returned 1 [0099.425] CloseHandle (hObject=0x154) returned 1 [0099.436] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0099.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.438] GetFileType (hFile=0x154) returned 0x1 [0099.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.438] GetFileType (hFile=0x154) returned 0x1 [0099.438] WriteFile (in: hFile=0x154, lpBuffer=0x1a789d8*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a789d8*, lpNumberOfBytesWritten=0x2ae3cc*=0x8b0, lpOverlapped=0x0) returned 1 [0099.439] CloseHandle (hObject=0x154) returned 1 [0099.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpFilePart=0x0) returned 0x6a [0099.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0099.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.439] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda347b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1 [0099.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.anonymous")) returned 1 [0099.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0099.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.441] GetFileType (hFile=0x154) returned 0x1 [0099.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.441] GetFileType (hFile=0x154) returned 0x1 [0099.441] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x858 [0099.441] ReadFile (in: hFile=0x154, lpBuffer=0x1a7a6ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a7a6ac*, lpNumberOfBytesRead=0x2ae404*=0x858, lpOverlapped=0x0) returned 1 [0099.442] CloseHandle (hObject=0x154) returned 1 [0099.454] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0099.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.456] GetFileType (hFile=0x154) returned 0x1 [0099.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.456] GetFileType (hFile=0x154) returned 0x1 [0099.456] WriteFile (in: hFile=0x154, lpBuffer=0x1acb004*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1acb004*, lpNumberOfBytesWritten=0x2ae3cc*=0x860, lpOverlapped=0x0) returned 1 [0099.457] CloseHandle (hObject=0x154) returned 1 [0099.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpFilePart=0x0) returned 0x6a [0099.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0099.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.458] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda36dc70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0099.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.anonymous")) returned 1 [0099.459] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0099.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.459] GetFileType (hFile=0x154) returned 0x1 [0099.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.459] GetFileType (hFile=0x154) returned 0x1 [0099.459] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x46ff [0099.459] ReadFile (in: hFile=0x154, lpBuffer=0x1acc47c, nNumberOfBytesToRead=0x46ff, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1acc47c*, lpNumberOfBytesRead=0x2ae404*=0x46ff, lpOverlapped=0x0) returned 1 [0099.460] CloseHandle (hObject=0x154) returned 1 [0099.473] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0099.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.474] GetFileType (hFile=0x154) returned 0x1 [0099.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.474] GetFileType (hFile=0x154) returned 0x1 [0099.474] WriteFile (in: hFile=0x154, lpBuffer=0x1b2f568*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b2f568*, lpNumberOfBytesWritten=0x2ae3f8*=0x4700, lpOverlapped=0x0) returned 1 [0099.475] CloseHandle (hObject=0x154) returned 1 [0099.476] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpFilePart=0x0) returned 0x6c [0099.476] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.anonymous", lpFilePart=0x0) returned 0x76 [0099.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.476] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda3b9f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4700)) returned 1 [0099.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.anonymous")) returned 1 [0099.476] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpFilePart=0x0) returned 0x6f [0099.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.477] GetFileType (hFile=0x154) returned 0x1 [0099.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.477] GetFileType (hFile=0x154) returned 0x1 [0099.477] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4709 [0099.477] ReadFile (in: hFile=0x154, lpBuffer=0x1b3427c, nNumberOfBytesToRead=0x4709, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3427c*, lpNumberOfBytesRead=0x2ae404*=0x4709, lpOverlapped=0x0) returned 1 [0099.486] CloseHandle (hObject=0x154) returned 1 [0099.498] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpFilePart=0x0) returned 0x6f [0099.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.500] GetFileType (hFile=0x154) returned 0x1 [0099.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.500] GetFileType (hFile=0x154) returned 0x1 [0099.500] WriteFile (in: hFile=0x154, lpBuffer=0x1b973b8*, nNumberOfBytesToWrite=0x4710, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b973b8*, lpNumberOfBytesWritten=0x2ae3f8*=0x4710, lpOverlapped=0x0) returned 1 [0099.501] CloseHandle (hObject=0x154) returned 1 [0099.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpFilePart=0x0) returned 0x6f [0099.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.anonymous", lpFilePart=0x0) returned 0x79 [0099.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.502] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b200, ftCreationTime.dwHighDateTime=0x1c7d368, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda3e0090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4710)) returned 1 [0099.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.anonymous")) returned 1 [0099.502] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0099.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.503] GetFileType (hFile=0x154) returned 0x1 [0099.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.503] GetFileType (hFile=0x154) returned 0x1 [0099.503] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5bf [0099.503] ReadFile (in: hFile=0x154, lpBuffer=0x1b9c6ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b9c6ac*, lpNumberOfBytesRead=0x2ae404*=0x5bf, lpOverlapped=0x0) returned 1 [0099.504] CloseHandle (hObject=0x154) returned 1 [0099.541] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0099.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.542] GetFileType (hFile=0x154) returned 0x1 [0099.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.542] GetFileType (hFile=0x154) returned 0x1 [0099.542] WriteFile (in: hFile=0x154, lpBuffer=0x19eb47c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19eb47c*, lpNumberOfBytesWritten=0x2ae3cc*=0x5c0, lpOverlapped=0x0) returned 1 [0099.543] CloseHandle (hObject=0x154) returned 1 [0099.543] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpFilePart=0x0) returned 0x6a [0099.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.anonymous", lpFilePart=0x0) returned 0x74 [0099.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.544] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcfe700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda4524b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0099.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.anonymous")) returned 1 [0099.544] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpFilePart=0x0) returned 0x6d [0099.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.545] GetFileType (hFile=0x154) returned 0x1 [0099.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.545] GetFileType (hFile=0x154) returned 0x1 [0099.545] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5c9 [0099.545] ReadFile (in: hFile=0x154, lpBuffer=0x19eced0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19eced0*, lpNumberOfBytesRead=0x2ae404*=0x5c9, lpOverlapped=0x0) returned 1 [0099.546] CloseHandle (hObject=0x154) returned 1 [0099.558] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpFilePart=0x0) returned 0x6d [0099.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.560] GetFileType (hFile=0x154) returned 0x1 [0099.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.560] GetFileType (hFile=0x154) returned 0x1 [0099.560] WriteFile (in: hFile=0x154, lpBuffer=0x1a3ccc0*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a3ccc0*, lpNumberOfBytesWritten=0x2ae3cc*=0x5d0, lpOverlapped=0x0) returned 1 [0099.561] CloseHandle (hObject=0x154) returned 1 [0099.561] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpFilePart=0x0) returned 0x6d [0099.561] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.anonymous", lpFilePart=0x0) returned 0x77 [0099.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.561] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f632800, ftCreationTime.dwHighDateTime=0x1c7d368, ftLastAccessTime.dwLowDateTime=0x77e0e270, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda478610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5d0)) returned 1 [0099.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.anonymous")) returned 1 [0099.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0099.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.562] GetFileType (hFile=0x154) returned 0x1 [0099.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.562] GetFileType (hFile=0x154) returned 0x1 [0099.562] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1499 [0099.562] ReadFile (in: hFile=0x154, lpBuffer=0x1a3e150, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3e150*, lpNumberOfBytesRead=0x2ae404*=0x1499, lpOverlapped=0x0) returned 1 [0099.564] CloseHandle (hObject=0x154) returned 1 [0099.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0099.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.578] GetFileType (hFile=0x154) returned 0x1 [0099.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.578] GetFileType (hFile=0x154) returned 0x1 [0099.578] WriteFile (in: hFile=0x154, lpBuffer=0x1a9165c*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a9165c*, lpNumberOfBytesWritten=0x2ae3f8*=0x14a0, lpOverlapped=0x0) returned 1 [0099.579] CloseHandle (hObject=0x154) returned 1 [0099.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpFilePart=0x0) returned 0x6f [0099.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.anonymous", lpFilePart=0x0) returned 0x79 [0099.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.579] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46282200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8847dbf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda49e770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14a0)) returned 1 [0099.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.anonymous")) returned 1 [0099.580] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0099.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.580] GetFileType (hFile=0x154) returned 0x1 [0099.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.580] GetFileType (hFile=0x154) returned 0x1 [0099.580] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x638 [0099.581] ReadFile (in: hFile=0x154, lpBuffer=0x1a9377c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a9377c*, lpNumberOfBytesRead=0x2ae404*=0x638, lpOverlapped=0x0) returned 1 [0099.582] CloseHandle (hObject=0x154) returned 1 [0099.594] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0099.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.596] GetFileType (hFile=0x154) returned 0x1 [0099.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.596] GetFileType (hFile=0x154) returned 0x1 [0099.596] WriteFile (in: hFile=0x154, lpBuffer=0x1ae3658*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae3658*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0099.597] CloseHandle (hObject=0x154) returned 1 [0099.597] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpFilePart=0x0) returned 0x73 [0099.597] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x7d [0099.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.597] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x77e343d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda4eaa30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0099.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.anonymous")) returned 1 [0099.598] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpFilePart=0x0) returned 0x6b [0099.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.598] GetFileType (hFile=0x154) returned 0x1 [0099.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.598] GetFileType (hFile=0x154) returned 0x1 [0099.598] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14316 [0099.598] ReadFile (in: hFile=0x154, lpBuffer=0x1ae4b10, nNumberOfBytesToRead=0x14316, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ae4b10*, lpNumberOfBytesRead=0x2ae404*=0x14316, lpOverlapped=0x0) returned 1 [0099.610] CloseHandle (hObject=0x154) returned 1 [0099.625] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpFilePart=0x0) returned 0x6b [0099.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.627] GetFileType (hFile=0x154) returned 0x1 [0099.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.627] GetFileType (hFile=0x154) returned 0x1 [0099.628] WriteFile (in: hFile=0x154, lpBuffer=0x1b6e270*, nNumberOfBytesToWrite=0x14320, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b6e270*, lpNumberOfBytesWritten=0x2ae3f8*=0x14320, lpOverlapped=0x0) returned 1 [0099.630] CloseHandle (hObject=0x154) returned 1 [0099.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpFilePart=0x0) returned 0x6b [0099.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.anonymous", lpFilePart=0x0) returned 0x75 [0099.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.630] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78e6b9b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda536cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14320)) returned 1 [0099.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.anonymous")) returned 1 [0099.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0099.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.632] GetFileType (hFile=0x154) returned 0x1 [0099.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.632] GetFileType (hFile=0x154) returned 0x1 [0099.632] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x30074 [0099.633] ReadFile (in: hFile=0x154, lpBuffer=0xb28e998, nNumberOfBytesToRead=0x30074, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0xb28e998*, lpNumberOfBytesRead=0x2ae404*=0x30074, lpOverlapped=0x0) returned 1 [0099.658] CloseHandle (hObject=0x154) returned 1 [0099.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0099.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.733] GetFileType (hFile=0x154) returned 0x1 [0099.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.733] GetFileType (hFile=0x154) returned 0x1 [0099.733] WriteFile (in: hFile=0x154, lpBuffer=0xb37ec48*, nNumberOfBytesToWrite=0x30080, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0xb37ec48*, lpNumberOfBytesWritten=0x2ae3f8*=0x30080, lpOverlapped=0x0) returned 1 [0099.737] CloseHandle (hObject=0x154) returned 1 [0099.737] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpFilePart=0x0) returned 0x64 [0099.737] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.anonymous", lpFilePart=0x0) returned 0x6e [0099.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.737] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c42a00, ftCreationTime.dwHighDateTime=0x1c9ff01, ftLastAccessTime.dwLowDateTime=0x8d1682d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda641690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30080)) returned 1 [0099.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.anonymous")) returned 1 [0099.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0099.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.738] GetFileType (hFile=0x154) returned 0x1 [0099.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.739] GetFileType (hFile=0x154) returned 0x1 [0099.739] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x350 [0099.739] ReadFile (in: hFile=0x154, lpBuffer=0x19cfcb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cfcb4*, lpNumberOfBytesRead=0x2ae404*=0x350, lpOverlapped=0x0) returned 1 [0099.752] CloseHandle (hObject=0x154) returned 1 [0099.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0099.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.765] GetFileType (hFile=0x154) returned 0x1 [0099.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.765] GetFileType (hFile=0x154) returned 0x1 [0099.766] WriteFile (in: hFile=0x154, lpBuffer=0x1a1ee58*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1ee58*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0099.767] CloseHandle (hObject=0x154) returned 1 [0099.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpFilePart=0x0) returned 0x64 [0099.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.anonymous", lpFilePart=0x0) returned 0x6e [0099.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.767] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda6677f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0099.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.anonymous")) returned 1 [0099.767] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0099.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.768] GetFileType (hFile=0x154) returned 0x1 [0099.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.768] GetFileType (hFile=0x154) returned 0x1 [0099.768] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x34f [0099.768] ReadFile (in: hFile=0x154, lpBuffer=0x1a205ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a205ec*, lpNumberOfBytesRead=0x2ae404*=0x34f, lpOverlapped=0x0) returned 1 [0099.770] CloseHandle (hObject=0x154) returned 1 [0099.781] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0099.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.783] GetFileType (hFile=0x154) returned 0x1 [0099.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.783] GetFileType (hFile=0x154) returned 0x1 [0099.783] WriteFile (in: hFile=0x154, lpBuffer=0x1a6f5dc*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6f5dc*, lpNumberOfBytesWritten=0x2ae3cc*=0x350, lpOverlapped=0x0) returned 1 [0099.784] CloseHandle (hObject=0x154) returned 1 [0099.784] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpFilePart=0x0) returned 0x65 [0099.784] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.anonymous", lpFilePart=0x0) returned 0x6f [0099.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.784] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824ae670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda6b3ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0099.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.anonymous")) returned 1 [0099.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0099.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.785] GetFileType (hFile=0x154) returned 0x1 [0099.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.785] GetFileType (hFile=0x154) returned 0x1 [0099.785] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x365 [0099.785] ReadFile (in: hFile=0x154, lpBuffer=0x1a70d7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a70d7c*, lpNumberOfBytesRead=0x2ae404*=0x365, lpOverlapped=0x0) returned 1 [0099.787] CloseHandle (hObject=0x154) returned 1 [0099.798] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0099.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.799] GetFileType (hFile=0x154) returned 0x1 [0099.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.800] GetFileType (hFile=0x154) returned 0x1 [0099.800] WriteFile (in: hFile=0x154, lpBuffer=0x1abfe08*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1abfe08*, lpNumberOfBytesWritten=0x2ae3cc*=0x370, lpOverlapped=0x0) returned 1 [0099.801] CloseHandle (hObject=0x154) returned 1 [0099.801] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpFilePart=0x0) returned 0x62 [0099.801] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.anonymous", lpFilePart=0x0) returned 0x6c [0099.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.801] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda6d9c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0099.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.anonymous")) returned 1 [0099.801] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0099.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.802] GetFileType (hFile=0x154) returned 0x1 [0099.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.802] GetFileType (hFile=0x154) returned 0x1 [0099.802] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x34f [0099.802] ReadFile (in: hFile=0x154, lpBuffer=0x1ac1580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac1580*, lpNumberOfBytesRead=0x2ae404*=0x34f, lpOverlapped=0x0) returned 1 [0099.803] CloseHandle (hObject=0x154) returned 1 [0099.815] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0099.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.816] GetFileType (hFile=0x154) returned 0x1 [0099.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.816] GetFileType (hFile=0x154) returned 0x1 [0099.816] WriteFile (in: hFile=0x154, lpBuffer=0x1b10560*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b10560*, lpNumberOfBytesWritten=0x2ae3cc*=0x350, lpOverlapped=0x0) returned 1 [0099.818] CloseHandle (hObject=0x154) returned 1 [0099.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpFilePart=0x0) returned 0x61 [0099.818] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.anonymous", lpFilePart=0x0) returned 0x6b [0099.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.818] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda6ffd70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0099.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.anonymous")) returned 1 [0099.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0099.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.819] GetFileType (hFile=0x154) returned 0x1 [0099.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.819] GetFileType (hFile=0x154) returned 0x1 [0099.819] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3ee [0099.819] ReadFile (in: hFile=0x154, lpBuffer=0x1b11d80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b11d80*, lpNumberOfBytesRead=0x2ae404*=0x3ee, lpOverlapped=0x0) returned 1 [0099.820] CloseHandle (hObject=0x154) returned 1 [0099.832] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0099.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.834] GetFileType (hFile=0x154) returned 0x1 [0099.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.834] GetFileType (hFile=0x154) returned 0x1 [0099.834] WriteFile (in: hFile=0x154, lpBuffer=0x1b61094*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b61094*, lpNumberOfBytesWritten=0x2ae3cc*=0x3f0, lpOverlapped=0x0) returned 1 [0099.837] CloseHandle (hObject=0x154) returned 1 [0099.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpFilePart=0x0) returned 0x66 [0099.837] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.anonymous", lpFilePart=0x0) returned 0x70 [0099.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.838] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5669c00, ftCreationTime.dwHighDateTime=0x1ca039f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda725ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0099.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.anonymous")) returned 1 [0099.838] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0099.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.839] GetFileType (hFile=0x154) returned 0x1 [0099.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.839] GetFileType (hFile=0x154) returned 0x1 [0099.839] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35f [0099.839] ReadFile (in: hFile=0x154, lpBuffer=0x1b62854, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b62854*, lpNumberOfBytesRead=0x2ae404*=0x35f, lpOverlapped=0x0) returned 1 [0099.855] CloseHandle (hObject=0x154) returned 1 [0099.870] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0099.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.872] GetFileType (hFile=0x154) returned 0x1 [0099.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.872] GetFileType (hFile=0x154) returned 0x1 [0099.872] WriteFile (in: hFile=0x154, lpBuffer=0x1bb18a4*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1bb18a4*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0099.873] CloseHandle (hObject=0x154) returned 1 [0099.873] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpFilePart=0x0) returned 0x69 [0099.873] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.anonymous", lpFilePart=0x0) returned 0x73 [0099.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47594f00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda772190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0099.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.anonymous")) returned 1 [0099.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpFilePart=0x0) returned 0x64 [0099.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.901] GetFileType (hFile=0x154) returned 0x1 [0099.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.901] GetFileType (hFile=0x154) returned 0x1 [0099.901] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xf1 [0099.901] ReadFile (in: hFile=0x154, lpBuffer=0x1bb2df0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1bb2df0*, lpNumberOfBytesRead=0x2ae404*=0xf1, lpOverlapped=0x0) returned 1 [0099.902] CloseHandle (hObject=0x154) returned 1 [0099.939] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpFilePart=0x0) returned 0x64 [0099.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.941] GetFileType (hFile=0x154) returned 0x1 [0099.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.941] GetFileType (hFile=0x154) returned 0x1 [0099.943] CloseHandle (hObject=0x154) returned 1 [0099.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpFilePart=0x0) returned 0x64 [0099.943] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.anonymous", lpFilePart=0x0) returned 0x6e [0099.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.943] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488a7c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda830870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0099.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.anonymous")) returned 1 [0099.944] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0099.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.944] GetFileType (hFile=0x154) returned 0x1 [0099.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.945] GetFileType (hFile=0x154) returned 0x1 [0099.945] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x35d [0099.945] ReadFile (in: hFile=0x154, lpBuffer=0x1a0293c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a0293c*, lpNumberOfBytesRead=0x2ae404*=0x35d, lpOverlapped=0x0) returned 1 [0099.946] CloseHandle (hObject=0x154) returned 1 [0099.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0099.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.959] GetFileType (hFile=0x154) returned 0x1 [0099.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.959] GetFileType (hFile=0x154) returned 0x1 [0099.959] WriteFile (in: hFile=0x154, lpBuffer=0x1a51ae8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a51ae8*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0099.961] CloseHandle (hObject=0x154) returned 1 [0099.961] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpFilePart=0x0) returned 0x69 [0099.961] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.anonymous", lpFilePart=0x0) returned 0x73 [0099.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.961] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488a7c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90449910, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda8569d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0099.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.anonymous")) returned 1 [0099.962] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0099.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.962] GetFileType (hFile=0x154) returned 0x1 [0099.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.962] GetFileType (hFile=0x154) returned 0x1 [0099.962] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x352 [0099.962] ReadFile (in: hFile=0x154, lpBuffer=0x1a5328c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5328c*, lpNumberOfBytesRead=0x2ae404*=0x352, lpOverlapped=0x0) returned 1 [0099.963] CloseHandle (hObject=0x154) returned 1 [0099.975] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0099.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0099.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.976] GetFileType (hFile=0x154) returned 0x1 [0099.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0099.976] GetFileType (hFile=0x154) returned 0x1 [0099.977] WriteFile (in: hFile=0x154, lpBuffer=0x1aa22cc*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aa22cc*, lpNumberOfBytesWritten=0x2ae3cc*=0x360, lpOverlapped=0x0) returned 1 [0099.978] CloseHandle (hObject=0x154) returned 1 [0099.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpFilePart=0x0) returned 0x62 [0099.978] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.anonymous", lpFilePart=0x0) returned 0x6c [0099.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0099.978] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488a7c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9046fa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda87cb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0099.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0099.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.anonymous")) returned 1 [0099.979] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0099.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0099.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0099.979] GetFileType (hFile=0x154) returned 0x1 [0099.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0099.979] GetFileType (hFile=0x154) returned 0x1 [0099.979] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x373 [0099.979] ReadFile (in: hFile=0x154, lpBuffer=0x1aa3a6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa3a6c*, lpNumberOfBytesRead=0x2ae404*=0x373, lpOverlapped=0x0) returned 1 [0100.056] CloseHandle (hObject=0x154) returned 1 [0100.068] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0100.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.070] GetFileType (hFile=0x154) returned 0x1 [0100.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.070] GetFileType (hFile=0x154) returned 0x1 [0100.071] CloseHandle (hObject=0x154) returned 1 [0100.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpFilePart=0x0) returned 0x62 [0100.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.anonymous", lpFilePart=0x0) returned 0x6c [0100.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.071] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488a7c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x824d47d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xda961370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0100.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.anonymous")) returned 1 [0100.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0100.072] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset", lpFilePart=0x0) returned 0x5a [0100.072] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpFilePart=0x0) returned 0x5b [0100.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0100.076] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.078] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.078] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.079] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.080] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.080] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.080] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.080] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.081] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0100.081] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0100.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0100.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0100.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0100.082] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset", lpFilePart=0x0) returned 0x5a [0100.082] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpFilePart=0x0) returned 0x5b [0100.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0100.083] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.084] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.085] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0100.086] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0100.086] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0100.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0100.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0100.087] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpFilePart=0x0) returned 0x6c [0100.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.121] GetFileType (hFile=0x154) returned 0x1 [0100.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.121] GetFileType (hFile=0x154) returned 0x1 [0100.121] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x140b [0100.121] ReadFile (in: hFile=0x154, lpBuffer=0x1afc19c, nNumberOfBytesToRead=0x140b, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1afc19c*, lpNumberOfBytesRead=0x2ae404*=0x140b, lpOverlapped=0x0) returned 1 [0100.164] CloseHandle (hObject=0x154) returned 1 [0100.176] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpFilePart=0x0) returned 0x6c [0100.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.178] GetFileType (hFile=0x154) returned 0x1 [0100.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.178] GetFileType (hFile=0x154) returned 0x1 [0100.178] WriteFile (in: hFile=0x154, lpBuffer=0x1b4f3d8*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b4f3d8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1410, lpOverlapped=0x0) returned 1 [0100.179] CloseHandle (hObject=0x154) returned 1 [0100.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpFilePart=0x0) returned 0x6c [0100.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.anonymous", lpFilePart=0x0) returned 0x76 [0100.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.179] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488a7c00, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86ae6f70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaa6bd10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1410)) returned 1 [0100.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.anonymous")) returned 1 [0100.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpFilePart=0x0) returned 0x70 [0100.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.180] GetFileType (hFile=0x154) returned 0x1 [0100.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.180] GetFileType (hFile=0x154) returned 0x1 [0100.180] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xf76 [0100.180] ReadFile (in: hFile=0x154, lpBuffer=0x1b51d64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b51d64*, lpNumberOfBytesRead=0x2ae404*=0xf76, lpOverlapped=0x0) returned 1 [0100.182] CloseHandle (hObject=0x154) returned 1 [0100.194] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpFilePart=0x0) returned 0x70 [0100.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.195] GetFileType (hFile=0x154) returned 0x1 [0100.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.195] GetFileType (hFile=0x154) returned 0x1 [0100.195] WriteFile (in: hFile=0x154, lpBuffer=0x1ba4a68*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ba4a68*, lpNumberOfBytesWritten=0x2ae3cc*=0xf80, lpOverlapped=0x0) returned 1 [0100.196] CloseHandle (hObject=0x154) returned 1 [0100.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpFilePart=0x0) returned 0x70 [0100.196] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.anonymous", lpFilePart=0x0) returned 0x7a [0100.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x86ae6f70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaa91e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf80)) returned 1 [0100.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.anonymous")) returned 1 [0100.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpFilePart=0x0) returned 0x6a [0100.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.197] GetFileType (hFile=0x154) returned 0x1 [0100.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.197] GetFileType (hFile=0x154) returned 0x1 [0100.197] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x32cd [0100.197] ReadFile (in: hFile=0x154, lpBuffer=0x1ba5eec, nNumberOfBytesToRead=0x32cd, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ba5eec*, lpNumberOfBytesRead=0x2ae404*=0x32cd, lpOverlapped=0x0) returned 1 [0100.389] CloseHandle (hObject=0x154) returned 1 [0100.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpFilePart=0x0) returned 0x6a [0100.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.429] GetFileType (hFile=0x154) returned 0x1 [0100.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.429] GetFileType (hFile=0x154) returned 0x1 [0100.429] WriteFile (in: hFile=0x154, lpBuffer=0x1a05044*, nNumberOfBytesToWrite=0x32d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a05044*, lpNumberOfBytesWritten=0x2ae3f8*=0x32d0, lpOverlapped=0x0) returned 1 [0100.431] CloseHandle (hObject=0x154) returned 1 [0100.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpFilePart=0x0) returned 0x6a [0100.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.anonymous", lpFilePart=0x0) returned 0x74 [0100.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.431] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76f2d8f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaccd310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x32d0)) returned 1 [0100.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.anonymous")) returned 1 [0100.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpFilePart=0x0) returned 0x6e [0100.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.432] GetFileType (hFile=0x154) returned 0x1 [0100.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.432] GetFileType (hFile=0x154) returned 0x1 [0100.432] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x114c [0100.432] ReadFile (in: hFile=0x154, lpBuffer=0x1a088f0, nNumberOfBytesToRead=0x114c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a088f0*, lpNumberOfBytesRead=0x2ae404*=0x114c, lpOverlapped=0x0) returned 1 [0100.436] CloseHandle (hObject=0x154) returned 1 [0100.448] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpFilePart=0x0) returned 0x6e [0100.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.449] GetFileType (hFile=0x154) returned 0x1 [0100.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.449] GetFileType (hFile=0x154) returned 0x1 [0100.449] WriteFile (in: hFile=0x154, lpBuffer=0x1a5aec4*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a5aec4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1150, lpOverlapped=0x0) returned 1 [0100.451] CloseHandle (hObject=0x154) returned 1 [0100.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpFilePart=0x0) returned 0x6e [0100.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x78 [0100.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.451] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x76f2d8f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdacf3470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1150)) returned 1 [0100.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.anonymous")) returned 1 [0100.452] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpFilePart=0x0) returned 0x6a [0100.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.452] GetFileType (hFile=0x154) returned 0x1 [0100.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.453] GetFileType (hFile=0x154) returned 0x1 [0100.453] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x26ba [0100.453] ReadFile (in: hFile=0x154, lpBuffer=0x1a5c608, nNumberOfBytesToRead=0x26ba, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5c608*, lpNumberOfBytesRead=0x2ae404*=0x26ba, lpOverlapped=0x0) returned 1 [0100.467] CloseHandle (hObject=0x154) returned 1 [0100.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpFilePart=0x0) returned 0x6a [0100.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.481] GetFileType (hFile=0x154) returned 0x1 [0100.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.481] GetFileType (hFile=0x154) returned 0x1 [0100.481] WriteFile (in: hFile=0x154, lpBuffer=0x1ab55b4*, nNumberOfBytesToWrite=0x26c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ab55b4*, lpNumberOfBytesWritten=0x2ae3f8*=0x26c0, lpOverlapped=0x0) returned 1 [0100.482] CloseHandle (hObject=0x154) returned 1 [0100.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpFilePart=0x0) returned 0x6a [0100.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.anonymous", lpFilePart=0x0) returned 0x74 [0100.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.482] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d18e430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdad3f730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26c0)) returned 1 [0100.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.anonymous")) returned 1 [0100.483] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpFilePart=0x0) returned 0x6e [0100.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.483] GetFileType (hFile=0x154) returned 0x1 [0100.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.483] GetFileType (hFile=0x154) returned 0x1 [0100.483] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x6b8 [0100.483] ReadFile (in: hFile=0x154, lpBuffer=0x1ab8914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab8914*, lpNumberOfBytesRead=0x2ae404*=0x6b8, lpOverlapped=0x0) returned 1 [0100.500] CloseHandle (hObject=0x154) returned 1 [0100.512] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpFilePart=0x0) returned 0x6e [0100.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.513] GetFileType (hFile=0x154) returned 0x1 [0100.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.513] GetFileType (hFile=0x154) returned 0x1 [0100.513] WriteFile (in: hFile=0x154, lpBuffer=0x1b08a4c*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b08a4c*, lpNumberOfBytesWritten=0x2ae3cc*=0x6c0, lpOverlapped=0x0) returned 1 [0100.514] CloseHandle (hObject=0x154) returned 1 [0100.514] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpFilePart=0x0) returned 0x6e [0100.515] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.anonymous", lpFilePart=0x0) returned 0x78 [0100.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.515] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8d18e430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdad8b9f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c0)) returned 1 [0100.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.anonymous")) returned 1 [0100.515] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpFilePart=0x0) returned 0x71 [0100.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.516] GetFileType (hFile=0x154) returned 0x1 [0100.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.516] GetFileType (hFile=0x154) returned 0x1 [0100.516] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x19e9 [0100.516] ReadFile (in: hFile=0x154, lpBuffer=0x1b09ee0, nNumberOfBytesToRead=0x19e9, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b09ee0*, lpNumberOfBytesRead=0x2ae404*=0x19e9, lpOverlapped=0x0) returned 1 [0100.537] CloseHandle (hObject=0x154) returned 1 [0100.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpFilePart=0x0) returned 0x71 [0100.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.550] GetFileType (hFile=0x154) returned 0x1 [0100.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.550] GetFileType (hFile=0x154) returned 0x1 [0100.550] WriteFile (in: hFile=0x154, lpBuffer=0x1b5ee7c*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b5ee7c*, lpNumberOfBytesWritten=0x2ae3f8*=0x19f0, lpOverlapped=0x0) returned 1 [0100.551] CloseHandle (hObject=0x154) returned 1 [0100.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpFilePart=0x0) returned 0x71 [0100.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.anonymous", lpFilePart=0x0) returned 0x7b [0100.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x820d02b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdadfde10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19f0)) returned 1 [0100.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.anonymous")) returned 1 [0100.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpFilePart=0x0) returned 0x75 [0100.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.553] GetFileType (hFile=0x154) returned 0x1 [0100.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.553] GetFileType (hFile=0x154) returned 0x1 [0100.553] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa10 [0100.553] ReadFile (in: hFile=0x154, lpBuffer=0x1b618c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b618c0*, lpNumberOfBytesRead=0x2ae404*=0xa10, lpOverlapped=0x0) returned 1 [0100.572] CloseHandle (hObject=0x154) returned 1 [0100.584] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpFilePart=0x0) returned 0x75 [0100.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.586] GetFileType (hFile=0x154) returned 0x1 [0100.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.586] GetFileType (hFile=0x154) returned 0x1 [0100.586] WriteFile (in: hFile=0x154, lpBuffer=0x1bb2afc*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1bb2afc*, lpNumberOfBytesWritten=0x2ae3cc*=0xa20, lpOverlapped=0x0) returned 1 [0100.587] CloseHandle (hObject=0x154) returned 1 [0100.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpFilePart=0x0) returned 0x75 [0100.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x7f [0100.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.587] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90318e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdae4a0d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa20)) returned 1 [0100.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.anonymous")) returned 1 [0100.588] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpFilePart=0x0) returned 0x6e [0100.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.589] GetFileType (hFile=0x154) returned 0x1 [0100.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.589] GetFileType (hFile=0x154) returned 0x1 [0100.589] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x200e [0100.589] ReadFile (in: hFile=0x154, lpBuffer=0x1bb3fa8, nNumberOfBytesToRead=0x200e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1bb3fa8*, lpNumberOfBytesRead=0x2ae404*=0x200e, lpOverlapped=0x0) returned 1 [0100.590] CloseHandle (hObject=0x154) returned 1 [0100.626] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpFilePart=0x0) returned 0x6e [0100.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.628] GetFileType (hFile=0x154) returned 0x1 [0100.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.628] GetFileType (hFile=0x154) returned 0x1 [0100.628] WriteFile (in: hFile=0x154, lpBuffer=0x1a09afc*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a09afc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2010, lpOverlapped=0x0) returned 1 [0100.629] CloseHandle (hObject=0x154) returned 1 [0100.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpFilePart=0x0) returned 0x6e [0100.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.anonymous", lpFilePart=0x0) returned 0x78 [0100.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.629] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x820d02b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaebc4f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1 [0100.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.anonymous")) returned 1 [0100.630] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpFilePart=0x0) returned 0x72 [0100.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.630] GetFileType (hFile=0x154) returned 0x1 [0100.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.630] GetFileType (hFile=0x154) returned 0x1 [0100.630] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x79c [0100.630] ReadFile (in: hFile=0x154, lpBuffer=0x1a0c8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a0c8c8*, lpNumberOfBytesRead=0x2ae404*=0x79c, lpOverlapped=0x0) returned 1 [0100.632] CloseHandle (hObject=0x154) returned 1 [0100.644] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpFilePart=0x0) returned 0x72 [0100.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.646] GetFileType (hFile=0x154) returned 0x1 [0100.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.646] GetFileType (hFile=0x154) returned 0x1 [0100.646] WriteFile (in: hFile=0x154, lpBuffer=0x1a5cfc8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a5cfc8*, lpNumberOfBytesWritten=0x2ae3cc*=0x7a0, lpOverlapped=0x0) returned 1 [0100.647] CloseHandle (hObject=0x154) returned 1 [0100.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpFilePart=0x0) returned 0x72 [0100.647] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.anonymous", lpFilePart=0x0) returned 0x7c [0100.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.647] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bba900, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x90318e10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaee2650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7a0)) returned 1 [0100.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.anonymous")) returned 1 [0100.648] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpFilePart=0x0) returned 0x77 [0100.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.649] GetFileType (hFile=0x154) returned 0x1 [0100.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.649] GetFileType (hFile=0x154) returned 0x1 [0100.649] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4f0a [0100.649] ReadFile (in: hFile=0x154, lpBuffer=0x1a5e48c, nNumberOfBytesToRead=0x4f0a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5e48c*, lpNumberOfBytesRead=0x2ae404*=0x4f0a, lpOverlapped=0x0) returned 1 [0100.650] CloseHandle (hObject=0x154) returned 1 [0100.662] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpFilePart=0x0) returned 0x77 [0100.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.664] GetFileType (hFile=0x154) returned 0x1 [0100.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.664] GetFileType (hFile=0x154) returned 0x1 [0100.664] WriteFile (in: hFile=0x154, lpBuffer=0x1ac3dc8*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ac3dc8*, lpNumberOfBytesWritten=0x2ae3f8*=0x4f10, lpOverlapped=0x0) returned 1 [0100.665] CloseHandle (hObject=0x154) returned 1 [0100.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpFilePart=0x0) returned 0x77 [0100.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.anonymous", lpFilePart=0x0) returned 0x81 [0100.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.666] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x820d02b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaf087b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f10)) returned 1 [0100.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.anonymous")) returned 1 [0100.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpFilePart=0x0) returned 0x7b [0100.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.667] GetFileType (hFile=0x154) returned 0x1 [0100.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.667] GetFileType (hFile=0x154) returned 0x1 [0100.667] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2338 [0100.667] ReadFile (in: hFile=0x154, lpBuffer=0x1ac9364, nNumberOfBytesToRead=0x2338, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac9364*, lpNumberOfBytesRead=0x2ae404*=0x2338, lpOverlapped=0x0) returned 1 [0100.668] CloseHandle (hObject=0x154) returned 1 [0100.680] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpFilePart=0x0) returned 0x7b [0100.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.682] GetFileType (hFile=0x154) returned 0x1 [0100.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.682] GetFileType (hFile=0x154) returned 0x1 [0100.682] WriteFile (in: hFile=0x154, lpBuffer=0x1b2118c*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b2118c*, lpNumberOfBytesWritten=0x2ae3f8*=0x2340, lpOverlapped=0x0) returned 1 [0100.683] CloseHandle (hObject=0x154) returned 1 [0100.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpFilePart=0x0) returned 0x7b [0100.683] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x85 [0100.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.683] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x820d02b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdaf2e910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2340)) returned 1 [0100.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.anonymous")) returned 1 [0100.684] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpFilePart=0x0) returned 0x6a [0100.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.700] GetFileType (hFile=0x154) returned 0x1 [0100.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.700] GetFileType (hFile=0x154) returned 0x1 [0100.700] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5f00 [0100.700] ReadFile (in: hFile=0x154, lpBuffer=0x1b23b3c, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b23b3c*, lpNumberOfBytesRead=0x2ae404*=0x5f00, lpOverlapped=0x0) returned 1 [0100.722] CloseHandle (hObject=0x154) returned 1 [0100.734] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpFilePart=0x0) returned 0x6a [0100.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.736] GetFileType (hFile=0x154) returned 0x1 [0100.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.736] GetFileType (hFile=0x154) returned 0x1 [0100.736] WriteFile (in: hFile=0x154, lpBuffer=0x1b8e474*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b8e474*, lpNumberOfBytesWritten=0x2ae3f8*=0x5f10, lpOverlapped=0x0) returned 1 [0100.738] CloseHandle (hObject=0x154) returned 1 [0100.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpFilePart=0x0) returned 0x6a [0100.738] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.anonymous", lpFilePart=0x0) returned 0x74 [0100.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.738] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8269d850, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdafc6e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f10)) returned 1 [0100.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.anonymous")) returned 1 [0100.739] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpFilePart=0x0) returned 0x6e [0100.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.739] GetFileType (hFile=0x154) returned 0x1 [0100.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.739] GetFileType (hFile=0x154) returned 0x1 [0100.739] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14078 [0100.739] ReadFile (in: hFile=0x154, lpBuffer=0x1b94960, nNumberOfBytesToRead=0x14078, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b94960*, lpNumberOfBytesRead=0x2ae404*=0x14078, lpOverlapped=0x0) returned 1 [0100.742] CloseHandle (hObject=0x154) returned 1 [0100.783] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpFilePart=0x0) returned 0x6e [0100.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.785] GetFileType (hFile=0x154) returned 0x1 [0100.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.785] GetFileType (hFile=0x154) returned 0x1 [0100.785] WriteFile (in: hFile=0x154, lpBuffer=0x1a2f914*, nNumberOfBytesToWrite=0x14080, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a2f914*, lpNumberOfBytesWritten=0x2ae3f8*=0x14080, lpOverlapped=0x0) returned 1 [0100.788] CloseHandle (hObject=0x154) returned 1 [0100.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpFilePart=0x0) returned 0x6e [0100.788] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.anonymous", lpFilePart=0x0) returned 0x78 [0100.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x8269d850, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb0392b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14080)) returned 1 [0100.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.anonymous")) returned 1 [0100.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpFilePart=0x0) returned 0x65 [0100.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.789] GetFileType (hFile=0x154) returned 0x1 [0100.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.789] GetFileType (hFile=0x154) returned 0x1 [0100.789] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9b6 [0100.789] ReadFile (in: hFile=0x154, lpBuffer=0x1a44950, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a44950*, lpNumberOfBytesRead=0x2ae404*=0x9b6, lpOverlapped=0x0) returned 1 [0100.815] CloseHandle (hObject=0x154) returned 1 [0100.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpFilePart=0x0) returned 0x65 [0100.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.829] GetFileType (hFile=0x154) returned 0x1 [0100.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.829] GetFileType (hFile=0x154) returned 0x1 [0100.829] WriteFile (in: hFile=0x154, lpBuffer=0x1a95ac4*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a95ac4*, lpNumberOfBytesWritten=0x2ae3cc*=0x9c0, lpOverlapped=0x0) returned 1 [0100.830] CloseHandle (hObject=0x154) returned 1 [0100.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpFilePart=0x0) returned 0x65 [0100.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.anonymous", lpFilePart=0x0) returned 0x6f [0100.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.830] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x9071d330, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb0ab6d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0100.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.anonymous")) returned 1 [0100.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpFilePart=0x0) returned 0x64 [0100.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.832] GetFileType (hFile=0x154) returned 0x1 [0100.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.832] GetFileType (hFile=0x154) returned 0x1 [0100.832] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9ef [0100.832] ReadFile (in: hFile=0x154, lpBuffer=0x1a978e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a978e4*, lpNumberOfBytesRead=0x2ae404*=0x9ef, lpOverlapped=0x0) returned 1 [0100.845] CloseHandle (hObject=0x154) returned 1 [0100.857] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpFilePart=0x0) returned 0x64 [0100.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.859] GetFileType (hFile=0x154) returned 0x1 [0100.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.859] GetFileType (hFile=0x154) returned 0x1 [0100.859] WriteFile (in: hFile=0x154, lpBuffer=0x1ae89e0*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae89e0*, lpNumberOfBytesWritten=0x2ae3cc*=0x9f0, lpOverlapped=0x0) returned 1 [0100.860] CloseHandle (hObject=0x154) returned 1 [0100.860] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpFilePart=0x0) returned 0x64 [0100.860] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.anonymous", lpFilePart=0x0) returned 0x6e [0100.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x82782090, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb0f7990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9f0)) returned 1 [0100.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.anonymous")) returned 1 [0100.861] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpFilePart=0x0) returned 0x67 [0100.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.861] GetFileType (hFile=0x154) returned 0x1 [0100.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.862] GetFileType (hFile=0x154) returned 0x1 [0100.862] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xdff [0100.862] ReadFile (in: hFile=0x154, lpBuffer=0x1aeac1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aeac1c*, lpNumberOfBytesRead=0x2ae404*=0xdff, lpOverlapped=0x0) returned 1 [0100.889] CloseHandle (hObject=0x154) returned 1 [0100.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpFilePart=0x0) returned 0x67 [0100.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.903] GetFileType (hFile=0x154) returned 0x1 [0100.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.903] GetFileType (hFile=0x154) returned 0x1 [0100.903] WriteFile (in: hFile=0x154, lpBuffer=0x1b3d174*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3d174*, lpNumberOfBytesWritten=0x2ae3cc*=0xe00, lpOverlapped=0x0) returned 1 [0100.904] CloseHandle (hObject=0x154) returned 1 [0100.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpFilePart=0x0) returned 0x67 [0100.904] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.anonymous", lpFilePart=0x0) returned 0x71 [0100.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.904] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x923d3c90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb143c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0100.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.anonymous")) returned 1 [0100.905] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpFilePart=0x0) returned 0x6b [0100.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.905] GetFileType (hFile=0x154) returned 0x1 [0100.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.906] GetFileType (hFile=0x154) returned 0x1 [0100.906] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4d72 [0100.906] ReadFile (in: hFile=0x154, lpBuffer=0x1b3e5c0, nNumberOfBytesToRead=0x4d72, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3e5c0*, lpNumberOfBytesRead=0x2ae404*=0x4d72, lpOverlapped=0x0) returned 1 [0100.909] CloseHandle (hObject=0x154) returned 1 [0100.925] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpFilePart=0x0) returned 0x6b [0100.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0100.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.927] GetFileType (hFile=0x154) returned 0x1 [0100.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0100.927] GetFileType (hFile=0x154) returned 0x1 [0100.927] WriteFile (in: hFile=0x154, lpBuffer=0x1ba372c*, nNumberOfBytesToWrite=0x4d80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ba372c*, lpNumberOfBytesWritten=0x2ae3f8*=0x4d80, lpOverlapped=0x0) returned 1 [0100.928] CloseHandle (hObject=0x154) returned 1 [0100.928] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpFilePart=0x0) returned 0x6b [0100.928] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.anonymous", lpFilePart=0x0) returned 0x75 [0100.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0100.928] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aecd600, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x923d3c90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb18ff10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d80)) returned 1 [0100.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0100.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.anonymous")) returned 1 [0100.930] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpFilePart=0x0) returned 0x68 [0100.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0100.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0100.952] GetFileType (hFile=0x154) returned 0x1 [0100.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0100.952] GetFileType (hFile=0x154) returned 0x1 [0100.952] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc59 [0100.952] ReadFile (in: hFile=0x154, lpBuffer=0x1ba96dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ba96dc*, lpNumberOfBytesRead=0x2ae404*=0xc59, lpOverlapped=0x0) returned 1 [0100.998] CloseHandle (hObject=0x154) returned 1 [0101.032] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpFilePart=0x0) returned 0x68 [0101.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0101.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.033] GetFileType (hFile=0x154) returned 0x1 [0101.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0101.034] GetFileType (hFile=0x154) returned 0x1 [0101.034] WriteFile (in: hFile=0x154, lpBuffer=0x19e7fe0*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19e7fe0*, lpNumberOfBytesWritten=0x2ae3cc*=0xc60, lpOverlapped=0x0) returned 1 [0101.035] CloseHandle (hObject=0x154) returned 1 [0101.035] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpFilePart=0x0) returned 0x68 [0101.035] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.anonymous", lpFilePart=0x0) returned 0x72 [0101.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0101.035] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c1e0300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x855a0ad0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb29a8b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc60)) returned 1 [0101.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0101.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.anonymous")) returned 1 [0101.036] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpFilePart=0x0) returned 0x6c [0101.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0101.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.036] GetFileType (hFile=0x154) returned 0x1 [0101.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0101.036] GetFileType (hFile=0x154) returned 0x1 [0101.036] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x638 [0101.036] ReadFile (in: hFile=0x154, lpBuffer=0x19e9a80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e9a80*, lpNumberOfBytesRead=0x2ae404*=0x638, lpOverlapped=0x0) returned 1 [0101.056] CloseHandle (hObject=0x154) returned 1 [0101.068] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpFilePart=0x0) returned 0x6c [0101.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0101.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.070] GetFileType (hFile=0x154) returned 0x1 [0101.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0101.070] GetFileType (hFile=0x154) returned 0x1 [0101.070] WriteFile (in: hFile=0x154, lpBuffer=0x1a39a8c*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a39a8c*, lpNumberOfBytesWritten=0x2ae3cc*=0x640, lpOverlapped=0x0) returned 1 [0101.071] CloseHandle (hObject=0x154) returned 1 [0101.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpFilePart=0x0) returned 0x6c [0101.071] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.anonymous", lpFilePart=0x0) returned 0x76 [0101.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0101.071] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c1e0300, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x92681550, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb2e6b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x640)) returned 1 [0101.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0101.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.anonymous")) returned 1 [0101.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0101.072] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool", lpFilePart=0x0) returned 0x66 [0101.072] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", lpFilePart=0x0) returned 0x67 [0101.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0101.073] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0101.073] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0101.073] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0101.073] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0101.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0101.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0101.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool", lpFilePart=0x0) returned 0x66 [0101.073] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", lpFilePart=0x0) returned 0x67 [0101.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0101.074] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0101.074] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0101.074] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0101.074] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0101.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0101.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0101.074] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type", lpFilePart=0x0) returned 0x7a [0101.074] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpFilePart=0x0) returned 0x7b [0101.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0101.075] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0101.075] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0101.075] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0101.075] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0101.075] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0101.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0101.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0101.075] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type", lpFilePart=0x0) returned 0x7a [0101.075] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpFilePart=0x0) returned 0x7b [0101.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0101.075] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0101.076] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0101.076] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0101.076] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0101.076] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0101.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0101.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0101.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic", lpFilePart=0x0) returned 0x80 [0101.076] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpFilePart=0x0) returned 0x81 [0101.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea98 [0101.077] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.077] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.077] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0101.077] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0101.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0101.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0101.077] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic", lpFilePart=0x0) returned 0x80 [0101.077] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpFilePart=0x0) returned 0x81 [0101.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea98 [0101.078] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.078] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.078] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0101.078] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0101.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0101.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0101.078] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy", lpFilePart=0x0) returned 0x80 [0101.078] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpFilePart=0x0) returned 0x81 [0101.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea98 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.099] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0101.100] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0101.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0101.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0101.101] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy", lpFilePart=0x0) returned 0x80 [0101.101] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpFilePart=0x0) returned 0x81 [0101.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea98 [0101.102] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.102] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.102] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.102] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.102] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.102] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0101.103] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0101.103] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0101.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0101.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0101.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool", lpFilePart=0x0) returned 0x52 [0101.104] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpFilePart=0x0) returned 0x53 [0101.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0101.104] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0101.105] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0101.105] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0101.105] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0101.105] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0101.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0101.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0101.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool", lpFilePart=0x0) returned 0x52 [0101.105] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpFilePart=0x0) returned 0x53 [0101.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0101.105] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0101.105] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0101.106] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0101.106] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0101.106] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0101.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0101.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpFilePart=0x0) returned 0x61 [0101.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0101.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.106] GetFileType (hFile=0x154) returned 0x1 [0101.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0101.106] GetFileType (hFile=0x154) returned 0x1 [0101.106] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x10f3 [0101.106] ReadFile (in: hFile=0x154, lpBuffer=0x1a48070, nNumberOfBytesToRead=0x10f3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a48070*, lpNumberOfBytesRead=0x2ae404*=0x10f3, lpOverlapped=0x0) returned 1 [0101.122] CloseHandle (hObject=0x154) returned 1 [0101.134] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpFilePart=0x0) returned 0x61 [0101.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0101.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.136] GetFileType (hFile=0x154) returned 0x1 [0101.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0101.136] GetFileType (hFile=0x154) returned 0x1 [0101.136] WriteFile (in: hFile=0x154, lpBuffer=0x1a9a35c*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a9a35c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1100, lpOverlapped=0x0) returned 1 [0101.137] CloseHandle (hObject=0x154) returned 1 [0101.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpFilePart=0x0) returned 0x61 [0101.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.anonymous", lpFilePart=0x0) returned 0x6b [0101.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0101.137] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50e2b700, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x78e1f6f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb37f0f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1100)) returned 1 [0101.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0101.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.anonymous")) returned 1 [0101.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpFilePart=0x0) returned 0x65 [0101.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0101.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.139] GetFileType (hFile=0x154) returned 0x1 [0101.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0101.139] GetFileType (hFile=0x154) returned 0x1 [0101.139] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa38 [0101.139] ReadFile (in: hFile=0x154, lpBuffer=0x1a9c418, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a9c418*, lpNumberOfBytesRead=0x2ae404*=0xa38, lpOverlapped=0x0) returned 1 [0101.157] CloseHandle (hObject=0x154) returned 1 [0101.168] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpFilePart=0x0) returned 0x65 [0101.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0101.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.170] GetFileType (hFile=0x154) returned 0x1 [0101.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0101.170] GetFileType (hFile=0x154) returned 0x1 [0101.170] WriteFile (in: hFile=0x154, lpBuffer=0x1aed6bc*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aed6bc*, lpNumberOfBytesWritten=0x2ae3cc*=0xa40, lpOverlapped=0x0) returned 1 [0101.171] CloseHandle (hObject=0x154) returned 1 [0101.171] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpFilePart=0x0) returned 0x65 [0101.171] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.anonymous", lpFilePart=0x0) returned 0x6f [0101.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0101.171] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5213e400, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x88c3a370, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb3cb3b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0101.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0101.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.anonymous")) returned 1 [0101.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons", lpFilePart=0x0) returned 0x3b [0101.172] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpFilePart=0x0) returned 0x3c [0101.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0101.181] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.182] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.183] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.184] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.185] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.185] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.185] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0101.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons", lpFilePart=0x0) returned 0x3b [0101.186] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpFilePart=0x0) returned 0x3c [0101.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0101.187] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.187] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.187] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.187] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.187] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.188] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.189] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.190] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.191] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.191] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.191] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.191] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.191] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0101.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files", lpFilePart=0x0) returned 0x3b [0101.192] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpFilePart=0x0) returned 0x3c [0101.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.198] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.198] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0101.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.199] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files", lpFilePart=0x0) returned 0x3b [0101.199] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpFilePart=0x0) returned 0x3c [0101.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.200] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.200] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0101.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.201] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpFilePart=0x0) returned 0x49 [0101.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0101.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.203] GetFileType (hFile=0x154) returned 0x1 [0101.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0101.203] GetFileType (hFile=0x154) returned 0x1 [0101.203] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x14a [0101.203] ReadFile (in: hFile=0x154, lpBuffer=0x1afa2c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1afa2c0*, lpNumberOfBytesRead=0x2ae4ec*=0x14a, lpOverlapped=0x0) returned 1 [0101.204] CloseHandle (hObject=0x154) returned 1 [0101.216] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpFilePart=0x0) returned 0x49 [0101.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0101.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.217] GetFileType (hFile=0x154) returned 0x1 [0101.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0101.217] GetFileType (hFile=0x154) returned 0x1 [0101.217] WriteFile (in: hFile=0x154, lpBuffer=0x1b48870*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b48870*, lpNumberOfBytesWritten=0x2ae4b4*=0x150, lpOverlapped=0x0) returned 1 [0101.218] CloseHandle (hObject=0x154) returned 1 [0101.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", lpFilePart=0x0) returned 0x49 [0101.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.anonymous", lpFilePart=0x0) returned 0x53 [0101.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0101.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5809c500, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x7f538fd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb463930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0101.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.anonymous")) returned 1 [0101.219] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpFilePart=0x0) returned 0x5d [0101.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0101.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.220] GetFileType (hFile=0x154) returned 0x1 [0101.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0101.220] GetFileType (hFile=0x154) returned 0x1 [0101.220] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x17e2d [0101.220] ReadFile (in: hFile=0x154, lpBuffer=0xb3d6de8, nNumberOfBytesToRead=0x17e2d, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xb3d6de8*, lpNumberOfBytesRead=0x2ae4ec*=0x17e2d, lpOverlapped=0x0) returned 1 [0101.251] CloseHandle (hObject=0x154) returned 1 [0101.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpFilePart=0x0) returned 0x5d [0101.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0101.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.271] GetFileType (hFile=0x154) returned 0x1 [0101.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0101.271] GetFileType (hFile=0x154) returned 0x1 [0101.271] WriteFile (in: hFile=0x154, lpBuffer=0xb44e518*, nNumberOfBytesToWrite=0x17e30, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0xb44e518*, lpNumberOfBytesWritten=0x2ae4e0*=0x17e30, lpOverlapped=0x0) returned 1 [0101.273] CloseHandle (hObject=0x154) returned 1 [0101.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", lpFilePart=0x0) returned 0x5d [0101.278] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.anonymous", lpFilePart=0x0) returned 0x67 [0101.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0101.278] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf779900, ftCreationTime.dwHighDateTime=0x1c9d7ab, ftLastAccessTime.dwLowDateTime=0x906aaf10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb4d5d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17e30)) returned 1 [0101.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.anonymous")) returned 1 [0101.279] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpFilePart=0x0) returned 0x5e [0101.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0101.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.281] GetFileType (hFile=0x154) returned 0x1 [0101.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0101.281] GetFileType (hFile=0x154) returned 0x1 [0101.281] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1b875 [0101.281] ReadFile (in: hFile=0x154, lpBuffer=0xb466368, nNumberOfBytesToRead=0x1b875, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xb466368*, lpNumberOfBytesRead=0x2ae4ec*=0x1b875, lpOverlapped=0x0) returned 1 [0101.304] CloseHandle (hObject=0x154) returned 1 [0101.348] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpFilePart=0x0) returned 0x5e [0101.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0101.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.351] GetFileType (hFile=0x154) returned 0x1 [0101.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0101.351] GetFileType (hFile=0x154) returned 0x1 [0101.351] WriteFile (in: hFile=0x154, lpBuffer=0xb4efe20*, nNumberOfBytesToWrite=0x1b880, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0xb4efe20*, lpNumberOfBytesWritten=0x2ae4e0*=0x1b880, lpOverlapped=0x0) returned 1 [0101.353] CloseHandle (hObject=0x154) returned 1 [0101.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", lpFilePart=0x0) returned 0x5e [0101.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.anonymous", lpFilePart=0x0) returned 0x68 [0101.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0101.354] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x593af200, ftCreationTime.dwHighDateTime=0x1c7484f, ftLastAccessTime.dwLowDateTime=0x826c39b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb594430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b880)) returned 1 [0101.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.anonymous")) returned 1 [0101.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpFilePart=0x0) returned 0x54 [0101.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0101.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.355] GetFileType (hFile=0x154) returned 0x1 [0101.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0101.355] GetFileType (hFile=0x154) returned 0x1 [0101.355] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a553 [0101.355] ReadFile (in: hFile=0x154, lpBuffer=0xb50b6c0, nNumberOfBytesToRead=0x1a553, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xb50b6c0*, lpNumberOfBytesRead=0x2ae4ec*=0x1a553, lpOverlapped=0x0) returned 1 [0101.376] CloseHandle (hObject=0x154) returned 1 [0101.395] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpFilePart=0x0) returned 0x54 [0101.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0101.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.397] GetFileType (hFile=0x154) returned 0x1 [0101.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0101.397] GetFileType (hFile=0x154) returned 0x1 [0101.397] WriteFile (in: hFile=0x154, lpBuffer=0xb58f1d0*, nNumberOfBytesToWrite=0x1a560, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0xb58f1d0*, lpNumberOfBytesWritten=0x2ae4e0*=0x1a560, lpOverlapped=0x0) returned 1 [0101.400] CloseHandle (hObject=0x154) returned 1 [0101.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", lpFilePart=0x0) returned 0x54 [0101.400] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.anonymous", lpFilePart=0x0) returned 0x5e [0101.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0101.400] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7893300, ftCreationTime.dwHighDateTime=0x1c9a4f3, ftLastAccessTime.dwLowDateTime=0x906aaf10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb606850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a560)) returned 1 [0101.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.anonymous")) returned 1 [0101.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0101.401] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates", lpFilePart=0x0) returned 0x4b [0101.401] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\", lpFilePart=0x0) returned 0x4c [0101.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0101.401] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.401] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0101.401] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0101.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0101.402] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates", lpFilePart=0x0) returned 0x4b [0101.402] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\", lpFilePart=0x0) returned 0x4c [0101.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0101.402] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.402] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0101.402] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0101.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.402] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM", lpFilePart=0x0) returned 0x35 [0101.402] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpFilePart=0x0) returned 0x36 [0101.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0101.412] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.412] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.412] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.412] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.413] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.413] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.413] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.414] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM", lpFilePart=0x0) returned 0x35 [0101.414] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpFilePart=0x0) returned 0x36 [0101.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0101.415] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.415] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.415] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.415] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.415] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.415] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.415] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0101.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.416] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x53 [0101.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0101.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.417] GetFileType (hFile=0x154) returned 0x1 [0101.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0101.418] GetFileType (hFile=0x154) returned 0x1 [0101.418] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3dddf [0101.419] ReadFile (in: hFile=0x154, lpBuffer=0xb5a9750, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0xb5a9750*, lpNumberOfBytesRead=0x2ae560*=0x3dddf, lpOverlapped=0x0) returned 1 [0101.443] CloseHandle (hObject=0x154) returned 1 [0101.472] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x53 [0101.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0101.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.476] GetFileType (hFile=0x154) returned 0x1 [0101.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0101.476] GetFileType (hFile=0x154) returned 0x1 [0101.476] WriteFile (in: hFile=0x154, lpBuffer=0xb6decf0*, nNumberOfBytesToWrite=0x3dde0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0xb6decf0*, lpNumberOfBytesWritten=0x2ae554*=0x3dde0, lpOverlapped=0x0) returned 1 [0101.481] CloseHandle (hObject=0x154) returned 1 [0101.481] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x53 [0101.481] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.anonymous", lpFilePart=0x0) returned 0x5d [0101.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0101.481] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225b3900, ftCreationTime.dwHighDateTime=0x1ca5695, ftLastAccessTime.dwLowDateTime=0x8922da70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb6c4f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3dde0)) returned 1 [0101.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.anonymous")) returned 1 [0101.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.482] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices", lpFilePart=0x0) returned 0x4c [0101.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpFilePart=0x0) returned 0x4d [0101.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0101.495] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.495] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.495] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.495] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.495] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.495] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0101.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices", lpFilePart=0x0) returned 0x4c [0101.496] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpFilePart=0x0) returned 0x4d [0101.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0101.497] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.498] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.498] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.498] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.498] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.498] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0101.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.499] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x6a [0101.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0101.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.500] GetFileType (hFile=0x154) returned 0x1 [0101.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0101.500] GetFileType (hFile=0x154) returned 0x1 [0101.500] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3dddf [0101.501] ReadFile (in: hFile=0x154, lpBuffer=0xb71caf0, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xb71caf0*, lpNumberOfBytesRead=0x2ae4ec*=0x3dddf, lpOverlapped=0x0) returned 1 [0101.525] CloseHandle (hObject=0x154) returned 1 [0101.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x6a [0101.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0101.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.578] GetFileType (hFile=0x154) returned 0x1 [0101.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0101.579] GetFileType (hFile=0x154) returned 0x1 [0101.579] WriteFile (in: hFile=0x154, lpBuffer=0xb852090*, nNumberOfBytesToWrite=0x3dde0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0xb852090*, lpNumberOfBytesWritten=0x2ae4e0*=0x3dde0, lpOverlapped=0x0) returned 1 [0101.583] CloseHandle (hObject=0x154) returned 1 [0101.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x6a [0101.583] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.anonymous", lpFilePart=0x0) returned 0x74 [0101.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0101.584] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225b3900, ftCreationTime.dwHighDateTime=0x1ca5695, ftLastAccessTime.dwLowDateTime=0x8a8325f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb7cf8d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3dde0)) returned 1 [0101.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.anonymous")) returned 1 [0101.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0101.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12", lpFilePart=0x0) returned 0x66 [0101.586] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpFilePart=0x0) returned 0x67 [0101.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0101.586] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.586] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.586] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.586] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0101.586] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0101.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0101.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0101.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12", lpFilePart=0x0) returned 0x66 [0101.587] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpFilePart=0x0) returned 0x67 [0101.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0101.587] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.587] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.587] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0101.587] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0101.587] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0101.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0101.587] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x84 [0101.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0101.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.588] GetFileType (hFile=0x154) returned 0x1 [0101.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0101.588] GetFileType (hFile=0x154) returned 0x1 [0101.588] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3dddf [0101.589] ReadFile (in: hFile=0x154, lpBuffer=0xb88fe90, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0xb88fe90*, lpNumberOfBytesRead=0x2ae478*=0x3dddf, lpOverlapped=0x0) returned 1 [0101.610] CloseHandle (hObject=0x154) returned 1 [0101.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x84 [0101.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0101.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.661] GetFileType (hFile=0x154) returned 0x1 [0101.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0101.661] GetFileType (hFile=0x154) returned 0x1 [0101.661] WriteFile (in: hFile=0x154, lpBuffer=0xb9c5430*, nNumberOfBytesToWrite=0x3dde0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0xb9c5430*, lpNumberOfBytesWritten=0x2ae46c*=0x3dde0, lpOverlapped=0x0) returned 1 [0101.666] CloseHandle (hObject=0x154) returned 1 [0101.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x84 [0101.666] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.anonymous", lpFilePart=0x0) returned 0x8e [0101.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0101.666] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225b3900, ftCreationTime.dwHighDateTime=0x1ca5695, ftLastAccessTime.dwLowDateTime=0x7b377010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb88dfb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3dde0)) returned 1 [0101.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0101.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.anonymous")) returned 1 [0101.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.667] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12", lpFilePart=0x0) returned 0x43 [0101.667] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpFilePart=0x0) returned 0x44 [0101.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0101.668] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.668] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.668] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.668] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.668] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0101.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.668] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12", lpFilePart=0x0) returned 0x43 [0101.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpFilePart=0x0) returned 0x44 [0101.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0101.668] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.669] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.669] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.669] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.669] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0101.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.669] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x61 [0101.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0101.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.669] GetFileType (hFile=0x154) returned 0x1 [0101.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0101.669] GetFileType (hFile=0x154) returned 0x1 [0101.670] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3dddf [0101.670] ReadFile (in: hFile=0x154, lpBuffer=0xba03230, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xba03230*, lpNumberOfBytesRead=0x2ae4ec*=0x3dddf, lpOverlapped=0x0) returned 1 [0101.701] CloseHandle (hObject=0x154) returned 1 [0101.729] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x61 [0101.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0101.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.732] GetFileType (hFile=0x154) returned 0x1 [0101.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0101.732] GetFileType (hFile=0x154) returned 0x1 [0101.732] WriteFile (in: hFile=0x154, lpBuffer=0xbb387d0*, nNumberOfBytesToWrite=0x3dde0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0xbb387d0*, lpNumberOfBytesWritten=0x2ae4e0*=0x3dde0, lpOverlapped=0x0) returned 1 [0101.739] CloseHandle (hObject=0x154) returned 1 [0101.739] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", lpFilePart=0x0) returned 0x61 [0101.739] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.anonymous", lpFilePart=0x0) returned 0x6b [0101.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0101.739] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225b3900, ftCreationTime.dwHighDateTime=0x1ca5695, ftLastAccessTime.dwLowDateTime=0x7a508ab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdb94c690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3dde0)) returned 1 [0101.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0101.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.anonymous")) returned 1 [0101.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.740] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Library", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library", lpFilePart=0x0) returned 0x32 [0101.740] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpFilePart=0x0) returned 0x33 [0101.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0101.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.740] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.741] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.741] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Library", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library", lpFilePart=0x0) returned 0x32 [0101.741] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpFilePart=0x0) returned 0x33 [0101.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0101.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.741] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.742] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.742] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.742] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis", lpFilePart=0x0) returned 0x3b [0101.742] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpFilePart=0x0) returned 0x3c [0101.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0101.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.753] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.754] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.754] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.755] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis", lpFilePart=0x0) returned 0x3b [0101.755] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpFilePart=0x0) returned 0x3c [0101.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0101.756] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.756] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.757] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.757] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.757] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.757] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.757] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.758] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER", lpFilePart=0x0) returned 0x39 [0101.758] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpFilePart=0x0) returned 0x3a [0101.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0101.758] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.759] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER", lpFilePart=0x0) returned 0x39 [0101.759] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpFilePart=0x0) returned 0x3a [0101.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0101.759] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0101.760] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.760] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\MEDIA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA", lpFilePart=0x0) returned 0x30 [0101.760] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpFilePart=0x0) returned 0x31 [0101.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.768] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.769] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.770] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.771] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\MEDIA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA", lpFilePart=0x0) returned 0x30 [0101.771] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpFilePart=0x0) returned 0x31 [0101.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.772] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.773] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.773] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OneNote", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote", lpFilePart=0x0) returned 0x32 [0101.774] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpFilePart=0x0) returned 0x33 [0101.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0101.793] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.793] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.793] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.794] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.794] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.794] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.794] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.794] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.794] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.794] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.795] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OneNote", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote", lpFilePart=0x0) returned 0x32 [0101.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpFilePart=0x0) returned 0x33 [0101.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0101.796] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.797] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.797] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0101.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.798] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", lpFilePart=0x0) returned 0x53 [0101.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0101.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.802] GetFileType (hFile=0x154) returned 0x1 [0101.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0101.802] GetFileType (hFile=0x154) returned 0x1 [0101.802] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1fa [0101.802] ReadFile (in: hFile=0x154, lpBuffer=0x1b7bcf4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b7bcf4*, lpNumberOfBytesRead=0x2ae560*=0x1fa, lpOverlapped=0x0) returned 1 [0101.804] CloseHandle (hObject=0x154) returned 1 [0101.838] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", lpFilePart=0x0) returned 0x53 [0101.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0101.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0101.840] GetFileType (hFile=0x154) returned 0x1 [0101.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0101.840] GetFileType (hFile=0x154) returned 0x1 [0101.840] WriteFile (in: hFile=0x154, lpBuffer=0x19ca800*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19ca800*, lpNumberOfBytesWritten=0x2ae528*=0x200, lpOverlapped=0x0) returned 1 [0101.841] CloseHandle (hObject=0x154) returned 1 [0101.841] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", lpFilePart=0x0) returned 0x53 [0101.841] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.anonymous", lpFilePart=0x0) returned 0x5d [0101.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0101.841] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b31f300, ftCreationTime.dwHighDateTime=0x1c8e688, ftLastAccessTime.dwLowDateTime=0x8e57dc70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdba30ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0101.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.anonymous")) returned 1 [0101.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.842] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover", lpFilePart=0x0) returned 0x3e [0101.842] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpFilePart=0x0) returned 0x3f [0101.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.858] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.860] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.860] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.861] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.862] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.863] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.864] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.865] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.865] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.865] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.865] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.865] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.865] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.866] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover", lpFilePart=0x0) returned 0x3e [0101.866] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpFilePart=0x0) returned 0x3f [0101.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.867] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.868] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.869] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.870] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.871] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.872] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.873] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.873] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.886] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PAGESIZE", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE", lpFilePart=0x0) returned 0x33 [0101.886] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpFilePart=0x0) returned 0x34 [0101.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.899] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.899] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.900] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.901] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.902] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.903] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.904] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.904] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.906] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PAGESIZE", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE", lpFilePart=0x0) returned 0x33 [0101.906] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpFilePart=0x0) returned 0x34 [0101.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.907] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.908] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.909] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0101.910] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.911] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF", lpFilePart=0x0) returned 0x30 [0101.911] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpFilePart=0x0) returned 0x31 [0101.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.912] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.913] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.913] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0101.913] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.914] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF", lpFilePart=0x0) returned 0x30 [0101.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpFilePart=0x0) returned 0x31 [0101.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.915] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.916] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033", lpFilePart=0x0) returned 0x35 [0101.916] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", lpFilePart=0x0) returned 0x36 [0101.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0101.918] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033", lpFilePart=0x0) returned 0x35 [0101.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", lpFilePart=0x0) returned 0x36 [0101.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0101.918] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.918] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036", lpFilePart=0x0) returned 0x35 [0101.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpFilePart=0x0) returned 0x36 [0101.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0101.919] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036", lpFilePart=0x0) returned 0x35 [0101.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpFilePart=0x0) returned 0x36 [0101.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0101.919] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.919] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082", lpFilePart=0x0) returned 0x35 [0101.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpFilePart=0x0) returned 0x36 [0101.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0101.919] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0101.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082", lpFilePart=0x0) returned 0x35 [0101.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpFilePart=0x0) returned 0x36 [0101.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0101.920] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0101.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0101.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.920] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PUBBA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA", lpFilePart=0x0) returned 0x30 [0101.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpFilePart=0x0) returned 0x31 [0101.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.933] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.934] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PUBBA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA", lpFilePart=0x0) returned 0x30 [0101.934] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpFilePart=0x0) returned 0x31 [0101.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.935] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.936] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PUBWIZ", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ", lpFilePart=0x0) returned 0x31 [0101.936] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpFilePart=0x0) returned 0x32 [0101.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.965] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.967] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\PUBWIZ", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ", lpFilePart=0x0) returned 0x31 [0101.967] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpFilePart=0x0) returned 0x32 [0101.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0101.968] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0101.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0101.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0101.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0101.970] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\QUERIES", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES", lpFilePart=0x0) returned 0x32 [0101.970] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", lpFilePart=0x0) returned 0x33 [0101.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.004] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.005] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\QUERIES", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES", lpFilePart=0x0) returned 0x32 [0102.005] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", lpFilePart=0x0) returned 0x33 [0102.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.006] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.007] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SAMPLES", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES", lpFilePart=0x0) returned 0x32 [0102.007] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", lpFilePart=0x0) returned 0x33 [0102.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.008] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\SAMPLES", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES", lpFilePart=0x0) returned 0x32 [0102.008] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", lpFilePart=0x0) returned 0x33 [0102.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.008] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.008] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\STARTUP", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP", lpFilePart=0x0) returned 0x32 [0102.008] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\", lpFilePart=0x0) returned 0x33 [0102.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.009] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\STARTUP", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP", lpFilePart=0x0) returned 0x32 [0102.009] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\", lpFilePart=0x0) returned 0x33 [0102.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.009] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.009] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content", lpFilePart=0x0) returned 0x38 [0102.009] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\", lpFilePart=0x0) returned 0x39 [0102.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.010] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.010] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content", lpFilePart=0x0) returned 0x38 [0102.010] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\", lpFilePart=0x0) returned 0x39 [0102.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.010] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.010] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033", lpFilePart=0x0) returned 0x3d [0102.011] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", lpFilePart=0x0) returned 0x3e [0102.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.041] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.042] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033", lpFilePart=0x0) returned 0x3d [0102.042] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", lpFilePart=0x0) returned 0x3e [0102.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.045] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.047] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", lpFilePart=0x0) returned 0x4a [0102.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0102.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.048] GetFileType (hFile=0x154) returned 0x1 [0102.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0102.048] GetFileType (hFile=0x154) returned 0x1 [0102.048] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xd9ad [0102.063] CloseHandle (hObject=0x154) returned 1 [0102.076] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", lpFilePart=0x0) returned 0x4a [0102.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0102.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.079] GetFileType (hFile=0x154) returned 0x1 [0102.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0102.079] GetFileType (hFile=0x154) returned 0x1 [0102.079] WriteFile (in: hFile=0x154, lpBuffer=0x1b08328*, nNumberOfBytesToWrite=0xd9b0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b08328*, lpNumberOfBytesWritten=0x2ae4e0*=0xd9b0, lpOverlapped=0x0) returned 1 [0102.083] CloseHandle (hObject=0x154) returned 1 [0102.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", lpFilePart=0x0) returned 0x4a [0102.083] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.anonymous", lpFilePart=0x0) returned 0x54 [0102.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0102.083] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca85900, ftCreationTime.dwHighDateTime=0x1c2efb3, ftLastAccessTime.dwLowDateTime=0xa45c3950, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xdbc924d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd9b0)) returned 1 [0102.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg.anonymous")) returned 1 [0102.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.084] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\XLSTART", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART", lpFilePart=0x0) returned 0x32 [0102.084] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\", lpFilePart=0x0) returned 0x33 [0102.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0102.084] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0102.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Office14\\XLSTART", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART", lpFilePart=0x0) returned 0x32 [0102.085] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\", lpFilePart=0x0) returned 0x33 [0102.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0102.085] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0102.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.085] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery", lpFilePart=0x0) returned 0x2c [0102.085] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\", lpFilePart=0x0) returned 0x2d [0102.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0102.086] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0102.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.086] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery", lpFilePart=0x0) returned 0x2c [0102.086] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\", lpFilePart=0x0) returned 0x2d [0102.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0102.086] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0102.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.086] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033", lpFilePart=0x0) returned 0x31 [0102.086] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", lpFilePart=0x0) returned 0x32 [0102.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0102.099] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0102.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.100] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033", lpFilePart=0x0) returned 0x31 [0102.100] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", lpFilePart=0x0) returned 0x32 [0102.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0102.101] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0102.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.102] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", lpFilePart=0x0) returned 0x3e [0102.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0102.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.103] GetFileType (hFile=0x154) returned 0x1 [0102.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0102.103] GetFileType (hFile=0x154) returned 0x1 [0102.103] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb86 [0102.124] CloseHandle (hObject=0x154) returned 1 [0102.135] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", lpFilePart=0x0) returned 0x3e [0102.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0102.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.136] GetFileType (hFile=0x154) returned 0x1 [0102.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0102.136] GetFileType (hFile=0x154) returned 0x1 [0102.136] WriteFile (in: hFile=0x154, lpBuffer=0x1b724dc*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b724dc*, lpNumberOfBytesWritten=0x2ae528*=0xb90, lpOverlapped=0x0) returned 1 [0102.137] CloseHandle (hObject=0x154) returned 1 [0102.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", lpFilePart=0x0) returned 0x3e [0102.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.anonymous", lpFilePart=0x0) returned 0x48 [0102.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0102.138] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0070300, ftCreationTime.dwHighDateTime=0x1bdcc39, ftLastAccessTime.dwLowDateTime=0x48c8dab0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdbd048f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb90)) returned 1 [0102.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg.anonymous")) returned 1 [0102.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", lpFilePart=0x0) returned 0x3e [0102.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0102.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.139] GetFileType (hFile=0x154) returned 0x1 [0102.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0102.139] GetFileType (hFile=0x154) returned 0x1 [0102.139] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf8d [0102.171] CloseHandle (hObject=0x154) returned 1 [0102.205] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", lpFilePart=0x0) returned 0x3e [0102.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0102.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.207] GetFileType (hFile=0x154) returned 0x1 [0102.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0102.207] GetFileType (hFile=0x154) returned 0x1 [0102.207] WriteFile (in: hFile=0x154, lpBuffer=0x19c89a0*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19c89a0*, lpNumberOfBytesWritten=0x2ae528*=0xf90, lpOverlapped=0x0) returned 1 [0102.208] CloseHandle (hObject=0x154) returned 1 [0102.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", lpFilePart=0x0) returned 0x3e [0102.208] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.anonymous", lpFilePart=0x0) returned 0x48 [0102.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0102.208] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a69c00, ftCreationTime.dwHighDateTime=0x1bdaf42, ftLastAccessTime.dwLowDateTime=0x48e7cc90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdbdc2fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf90)) returned 1 [0102.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg.anonymous")) returned 1 [0102.209] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", lpFilePart=0x0) returned 0x3e [0102.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0102.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.210] GetFileType (hFile=0x154) returned 0x1 [0102.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0102.210] GetFileType (hFile=0x154) returned 0x1 [0102.210] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1889 [0102.210] ReadFile (in: hFile=0x154, lpBuffer=0x19c9cb4, nNumberOfBytesToRead=0x1889, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c9cb4*, lpNumberOfBytesRead=0x2ae560*=0x1889, lpOverlapped=0x0) returned 1 [0102.226] CloseHandle (hObject=0x154) returned 1 [0102.237] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", lpFilePart=0x0) returned 0x3e [0102.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0102.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.239] GetFileType (hFile=0x154) returned 0x1 [0102.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0102.239] GetFileType (hFile=0x154) returned 0x1 [0102.239] WriteFile (in: hFile=0x154, lpBuffer=0x1a1e6cc*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a1e6cc*, lpNumberOfBytesWritten=0x2ae554*=0x1890, lpOverlapped=0x0) returned 1 [0102.240] CloseHandle (hObject=0x154) returned 1 [0102.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", lpFilePart=0x0) returned 0x3e [0102.240] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.anonymous", lpFilePart=0x0) returned 0x48 [0102.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0102.241] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fce400, ftCreationTime.dwHighDateTime=0x1bdcc39, ftLastAccessTime.dwLowDateTime=0x48ec8f50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdbe0f290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1890)) returned 1 [0102.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.anonymous" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg.anonymous")) returned 1 [0102.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.241] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates", lpFilePart=0x0) returned 0x2b [0102.241] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\", lpFilePart=0x0) returned 0x2c [0102.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed98 [0102.242] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0102.242] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0102.243] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0102.243] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0102.243] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.243] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates", lpFilePart=0x0) returned 0x2b [0102.243] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\", lpFilePart=0x0) returned 0x2c [0102.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed98 [0102.243] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0102.243] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0102.243] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0102.244] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0102.244] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.244] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033", lpFilePart=0x0) returned 0x30 [0102.244] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpFilePart=0x0) returned 0x31 [0102.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.246] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.247] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.248] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.249] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.250] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.250] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.250] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.250] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.251] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.251] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.251] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.251] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.251] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.251] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.252] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.253] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.254] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.255] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.255] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.258] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.258] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.258] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.258] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.258] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.259] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.260] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.260] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.260] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.260] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.260] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0102.260] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.261] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033", lpFilePart=0x0) returned 0x30 [0102.261] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpFilePart=0x0) returned 0x31 [0102.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.262] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.263] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.264] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.265] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.266] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.267] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0102.268] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0102.268] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access", lpFilePart=0x0) returned 0x37 [0102.269] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpFilePart=0x0) returned 0x38 [0102.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.288] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.289] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.289] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.289] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.289] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.289] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0102.289] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.290] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access", lpFilePart=0x0) returned 0x37 [0102.290] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpFilePart=0x0) returned 0x38 [0102.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0102.291] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0102.291] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType", lpFilePart=0x0) returned 0x40 [0102.292] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpFilePart=0x0) returned 0x41 [0102.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.302] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.303] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0102.303] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.304] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType", lpFilePart=0x0) returned 0x40 [0102.304] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpFilePart=0x0) returned 0x41 [0102.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.305] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0102.305] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.306] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part", lpFilePart=0x0) returned 0x3c [0102.306] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpFilePart=0x0) returned 0x3d [0102.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.312] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.313] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0102.313] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.314] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part", lpFilePart=0x0) returned 0x3c [0102.314] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpFilePart=0x0) returned 0x3d [0102.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.315] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.315] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.315] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.315] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0102.315] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS", lpFilePart=0x0) returned 0x3b [0102.317] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpFilePart=0x0) returned 0x3c [0102.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.317] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.317] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS", lpFilePart=0x0) returned 0x3b [0102.317] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpFilePart=0x0) returned 0x3c [0102.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.318] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.318] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\FAX", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX", lpFilePart=0x0) returned 0x34 [0102.318] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpFilePart=0x0) returned 0x35 [0102.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.329] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.330] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\FAX", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX", lpFilePart=0x0) returned 0x34 [0102.330] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpFilePart=0x0) returned 0x35 [0102.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.331] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE", lpFilePart=0x0) returned 0x38 [0102.332] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\", lpFilePart=0x0) returned 0x39 [0102.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.333] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE", lpFilePart=0x0) returned 0x38 [0102.335] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\", lpFilePart=0x0) returned 0x39 [0102.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0102.335] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.335] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14", lpFilePart=0x0) returned 0x3b [0102.336] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\", lpFilePart=0x0) returned 0x3c [0102.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.336] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.336] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14", lpFilePart=0x0) returned 0x3b [0102.336] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\", lpFilePart=0x0) returned 0x3c [0102.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0102.336] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0102.336] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates", lpFilePart=0x0) returned 0x4e [0102.336] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", lpFilePart=0x0) returned 0x4f [0102.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0102.337] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0102.337] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates", lpFilePart=0x0) returned 0x4e [0102.337] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", lpFilePart=0x0) returned 0x4f [0102.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0102.337] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0102.337] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery", lpFilePart=0x0) returned 0x46 [0102.337] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpFilePart=0x0) returned 0x47 [0102.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0102.338] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0102.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0102.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0102.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery", lpFilePart=0x0) returned 0x46 [0102.338] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpFilePart=0x0) returned 0x47 [0102.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0102.338] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0102.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0102.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.338] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\Presentation Designs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs", lpFilePart=0x0) returned 0x40 [0102.338] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\", lpFilePart=0x0) returned 0x41 [0102.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.339] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.339] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\Presentation Designs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs", lpFilePart=0x0) returned 0x40 [0102.339] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\", lpFilePart=0x0) returned 0x41 [0102.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0102.339] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0102.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.339] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", lpFilePart=0x0) returned 0x4a [0102.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0102.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.339] GetFileType (hFile=0x154) returned 0x1 [0102.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0102.339] GetFileType (hFile=0x154) returned 0x1 [0102.339] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x0 [0102.339] CloseHandle (hObject=0x154) returned 1 [0102.351] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", lpFilePart=0x0) returned 0x4a [0102.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0102.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.351] GetFileType (hFile=0x154) returned 0x1 [0102.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0102.352] GetFileType (hFile=0x154) returned 0x1 [0102.352] WriteFile (in: hFile=0x154, lpBuffer=0x1a9a78c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a9a78c*, lpNumberOfBytesWritten=0x2ae528*=0x10, lpOverlapped=0x0) returned 1 [0102.353] CloseHandle (hObject=0x154) returned 1 [0102.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", lpFilePart=0x0) returned 0x4a [0102.353] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif.anonymous", lpFilePart=0x0) returned 0x54 [0102.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0102.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4baef600, ftCreationTime.dwHighDateTime=0x1c65295, ftLastAccessTime.dwLowDateTime=0x8d1682d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdbf19c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0102.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif.anonymous" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif.anonymous")) returned 1 [0102.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0102.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft SQL Server Compact Edition", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition", lpFilePart=0x0) returned 0x35 [0102.354] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", lpFilePart=0x0) returned 0x36 [0102.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbefd8 [0102.354] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0102.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0102.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0102.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft SQL Server Compact Edition", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition", lpFilePart=0x0) returned 0x35 [0102.354] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", lpFilePart=0x0) returned 0x36 [0102.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbefd8 [0102.354] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0102.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0102.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.354] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5", lpFilePart=0x0) returned 0x3a [0102.354] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", lpFilePart=0x0) returned 0x3b [0102.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0102.362] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5", lpFilePart=0x0) returned 0x3a [0102.363] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", lpFilePart=0x0) returned 0x3b [0102.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0102.364] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.365] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop", lpFilePart=0x0) returned 0x42 [0102.365] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", lpFilePart=0x0) returned 0x43 [0102.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0102.366] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.366] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop", lpFilePart=0x0) returned 0x42 [0102.367] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\", lpFilePart=0x0) returned 0x43 [0102.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0102.367] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0102.367] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework", lpFilePart=0x0) returned 0x29 [0102.367] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\", lpFilePart=0x0) returned 0x2a [0102.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbefd8 [0102.367] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0102.367] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework", lpFilePart=0x0) returned 0x29 [0102.367] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\", lpFilePart=0x0) returned 0x2a [0102.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbefd8 [0102.367] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0102.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.368] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0", lpFilePart=0x0) returned 0x2e [0102.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\", lpFilePart=0x0) returned 0x2f [0102.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0102.368] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0102.368] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0", lpFilePart=0x0) returned 0x2e [0102.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\", lpFilePart=0x0) returned 0x2f [0102.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0102.368] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0102.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0102.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.368] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation", lpFilePart=0x0) returned 0x3c [0102.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\", lpFilePart=0x0) returned 0x3d [0102.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0102.368] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0102.369] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation", lpFilePart=0x0) returned 0x3c [0102.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\", lpFilePart=0x0) returned 0x3d [0102.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0102.369] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0102.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0102.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.369] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033", lpFilePart=0x0) returned 0x41 [0102.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\", lpFilePart=0x0) returned 0x42 [0102.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0102.370] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0102.370] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033", lpFilePart=0x0) returned 0x41 [0102.370] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\", lpFilePart=0x0) returned 0x42 [0102.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0102.370] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.370] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements", lpFilePart=0x0) returned 0x54 [0102.370] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\", lpFilePart=0x0) returned 0x55 [0102.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0102.370] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0102.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0102.371] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements", lpFilePart=0x0) returned 0x54 [0102.371] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\", lpFilePart=0x0) returned 0x55 [0102.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0102.371] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0102.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0102.371] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", lpFilePart=0x0) returned 0x6c [0102.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.371] GetFileType (hFile=0x154) returned 0x1 [0102.371] GetFileType (hFile=0x154) returned 0x1 [0102.371] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1afd7 [0102.372] ReadFile (in: hFile=0x154, lpBuffer=0xbb91930, nNumberOfBytesToRead=0x1afd7, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0xbb91930*, lpNumberOfBytesRead=0x2ae478*=0x1afd7, lpOverlapped=0x0) returned 1 [0102.379] CloseHandle (hObject=0x154) returned 1 [0102.402] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", lpFilePart=0x0) returned 0x6c [0102.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.404] GetFileType (hFile=0x154) returned 0x1 [0102.404] GetFileType (hFile=0x154) returned 0x1 [0102.404] WriteFile (in: hFile=0x154, lpBuffer=0xbc188c8*, nNumberOfBytesToWrite=0x1afe0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0xbc188c8*, lpNumberOfBytesWritten=0x2ae46c*=0x1afe0, lpOverlapped=0x0) returned 1 [0102.406] CloseHandle (hObject=0x154) returned 1 [0102.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", lpFilePart=0x0) returned 0x6c [0102.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf.anonymous", lpFilePart=0x0) returned 0x76 [0102.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80607400, ftCreationTime.dwHighDateTime=0x1c9c5bf, ftLastAccessTime.dwLowDateTime=0x7b9b69d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdbfb21b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1afe0)) returned 1 [0102.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf.anonymous" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf.anonymous")) returned 1 [0102.407] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime", lpFilePart=0x0) returned 0x36 [0102.407] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\", lpFilePart=0x0) returned 0x37 [0102.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0102.408] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime", lpFilePart=0x0) returned 0x36 [0102.408] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\", lpFilePart=0x0) returned 0x37 [0102.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0102.408] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.408] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86", lpFilePart=0x0) returned 0x3a [0102.408] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\", lpFilePart=0x0) returned 0x3b [0102.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.425] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.427] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86", lpFilePart=0x0) returned 0x3a [0102.427] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\", lpFilePart=0x0) returned 0x3b [0102.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.429] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources", lpFilePart=0x0) returned 0x44 [0102.431] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\", lpFilePart=0x0) returned 0x45 [0102.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0102.439] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources", lpFilePart=0x0) returned 0x44 [0102.439] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\", lpFilePart=0x0) returned 0x45 [0102.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0102.439] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.439] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033", lpFilePart=0x0) returned 0x49 [0102.439] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033\\", lpFilePart=0x0) returned 0x4a [0102.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0102.440] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033", lpFilePart=0x0) returned 0x49 [0102.440] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033\\", lpFilePart=0x0) returned 0x4a [0102.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0102.440] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Synchronization Services", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services", lpFilePart=0x0) returned 0x33 [0102.440] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\", lpFilePart=0x0) returned 0x34 [0102.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0102.440] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.440] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Synchronization Services", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services", lpFilePart=0x0) returned 0x33 [0102.440] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\", lpFilePart=0x0) returned 0x34 [0102.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0102.441] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Synchronization Services\\ADO.NET", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET", lpFilePart=0x0) returned 0x3b [0102.441] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\", lpFilePart=0x0) returned 0x3c [0102.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0102.441] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Synchronization Services\\ADO.NET", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET", lpFilePart=0x0) returned 0x3b [0102.441] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\", lpFilePart=0x0) returned 0x3c [0102.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0102.441] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.441] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0", lpFilePart=0x0) returned 0x40 [0102.441] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpFilePart=0x0) returned 0x41 [0102.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0102.446] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.447] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0", lpFilePart=0x0) returned 0x40 [0102.447] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpFilePart=0x0) returned 0x41 [0102.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0102.448] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8", lpFilePart=0x0) returned 0x2a [0102.449] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\", lpFilePart=0x0) returned 0x2b [0102.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0102.449] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8", lpFilePart=0x0) returned 0x2a [0102.449] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\", lpFilePart=0x0) returned 0x2b [0102.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0102.449] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.449] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7", lpFilePart=0x0) returned 0x32 [0102.449] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\", lpFilePart=0x0) returned 0x33 [0102.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0102.450] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7", lpFilePart=0x0) returned 0x32 [0102.450] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\", lpFilePart=0x0) returned 0x33 [0102.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0102.450] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE", lpFilePart=0x0) returned 0x36 [0102.450] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\", lpFilePart=0x0) returned 0x37 [0102.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0102.450] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.450] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE", lpFilePart=0x0) returned 0x36 [0102.450] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\", lpFilePart=0x0) returned 0x37 [0102.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0102.451] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies", lpFilePart=0x0) returned 0x48 [0102.451] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\", lpFilePart=0x0) returned 0x49 [0102.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.451] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies", lpFilePart=0x0) returned 0x48 [0102.451] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\", lpFilePart=0x0) returned 0x49 [0102.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.451] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.451] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies", lpFilePart=0x0) returned 0x47 [0102.451] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\", lpFilePart=0x0) returned 0x48 [0102.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.476] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.477] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies", lpFilePart=0x0) returned 0x47 [0102.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\", lpFilePart=0x0) returned 0x48 [0102.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.478] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.479] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA", lpFilePart=0x0) returned 0x3b [0102.479] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\", lpFilePart=0x0) returned 0x3c [0102.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.480] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA", lpFilePart=0x0) returned 0x3b [0102.480] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\", lpFilePart=0x0) returned 0x3c [0102.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0102.480] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates", lpFilePart=0x0) returned 0x49 [0102.480] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\", lpFilePart=0x0) returned 0x4a [0102.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0102.480] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates", lpFilePart=0x0) returned 0x49 [0102.480] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\", lpFilePart=0x0) returned 0x4a [0102.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0102.480] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.480] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp", lpFilePart=0x0) returned 0x50 [0102.481] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\", lpFilePart=0x0) returned 0x51 [0102.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0102.481] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.481] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp", lpFilePart=0x0) returned 0x50 [0102.481] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\", lpFilePart=0x0) returned 0x51 [0102.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0102.481] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.481] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033", lpFilePart=0x0) returned 0x55 [0102.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", lpFilePart=0x0) returned 0x56 [0102.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0102.496] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033", lpFilePart=0x0) returned 0x55 [0102.497] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", lpFilePart=0x0) returned 0x56 [0102.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0102.498] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0102.499] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", lpFilePart=0x0) returned 0x62 [0102.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.500] GetFileType (hFile=0x154) returned 0x1 [0102.500] GetFileType (hFile=0x154) returned 0x1 [0102.500] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x8b52 [0102.515] CloseHandle (hObject=0x154) returned 1 [0102.549] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", lpFilePart=0x0) returned 0x62 [0102.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.550] GetFileType (hFile=0x154) returned 0x1 [0102.550] GetFileType (hFile=0x154) returned 0x1 [0102.550] WriteFile (in: hFile=0x154, lpBuffer=0x1b8fef0*, nNumberOfBytesToWrite=0x8b60, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b8fef0*, lpNumberOfBytesWritten=0x2ae384*=0x8b60, lpOverlapped=0x0) returned 1 [0102.552] CloseHandle (hObject=0x154) returned 1 [0102.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip", lpFilePart=0x0) returned 0x62 [0102.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip.anonymous", lpFilePart=0x0) returned 0x6c [0102.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5904fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc108e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8b60)) returned 1 [0102.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip.anonymous")) returned 1 [0102.553] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", lpFilePart=0x0) returned 0x63 [0102.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.553] GetFileType (hFile=0x154) returned 0x1 [0102.553] GetFileType (hFile=0x154) returned 0x1 [0102.553] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x251 [0102.560] CloseHandle (hObject=0x154) returned 1 [0102.574] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", lpFilePart=0x0) returned 0x63 [0102.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.575] GetFileType (hFile=0x154) returned 0x1 [0102.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.576] GetFileType (hFile=0x154) returned 0x1 [0102.576] WriteFile (in: hFile=0x154, lpBuffer=0x19e812c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19e812c*, lpNumberOfBytesWritten=0x2ae358*=0x260, lpOverlapped=0x0) returned 1 [0102.577] CloseHandle (hObject=0x154) returned 1 [0102.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip", lpFilePart=0x0) returned 0x63 [0102.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip.anonymous", lpFilePart=0x0) returned 0x6d [0102.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.577] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5904fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc1550d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1 [0102.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip.anonymous")) returned 1 [0102.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", lpFilePart=0x0) returned 0x6b [0102.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.579] GetFileType (hFile=0x154) returned 0x1 [0102.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.579] GetFileType (hFile=0x154) returned 0x1 [0102.579] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x26d [0102.579] ReadFile (in: hFile=0x154, lpBuffer=0x19e97e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19e97e4*, lpNumberOfBytesRead=0x2ae390*=0x26d, lpOverlapped=0x0) returned 1 [0102.598] CloseHandle (hObject=0x154) returned 1 [0102.628] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", lpFilePart=0x0) returned 0x6b [0102.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.630] GetFileType (hFile=0x154) returned 0x1 [0102.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.630] GetFileType (hFile=0x154) returned 0x1 [0102.630] WriteFile (in: hFile=0x154, lpBuffer=0x1a384e0*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a384e0*, lpNumberOfBytesWritten=0x2ae358*=0x270, lpOverlapped=0x0) returned 1 [0102.631] CloseHandle (hObject=0x154) returned 1 [0102.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip", lpFilePart=0x0) returned 0x6b [0102.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip.anonymous", lpFilePart=0x0) returned 0x75 [0102.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.631] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5904fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc1c74f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0102.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip.anonymous")) returned 1 [0102.632] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip", lpFilePart=0x0) returned 0x66 [0102.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.633] GetFileType (hFile=0x154) returned 0x1 [0102.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.633] GetFileType (hFile=0x154) returned 0x1 [0102.633] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x492 [0102.633] ReadFile (in: hFile=0x154, lpBuffer=0x1a39ddc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a39ddc*, lpNumberOfBytesRead=0x2ae390*=0x492, lpOverlapped=0x0) returned 1 [0102.649] CloseHandle (hObject=0x154) returned 1 [0102.661] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip", lpFilePart=0x0) returned 0x66 [0102.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.662] GetFileType (hFile=0x154) returned 0x1 [0102.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.662] GetFileType (hFile=0x154) returned 0x1 [0102.662] WriteFile (in: hFile=0x154, lpBuffer=0x1a89468*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a89468*, lpNumberOfBytesWritten=0x2ae358*=0x4a0, lpOverlapped=0x0) returned 1 [0102.663] CloseHandle (hObject=0x154) returned 1 [0102.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.664] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5904fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc2137b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0102.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip.anonymous")) returned 1 [0102.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.665] GetFileType (hFile=0x154) returned 0x1 [0102.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.665] GetFileType (hFile=0x154) returned 0x1 [0102.665] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x4e2 [0102.665] ReadFile (in: hFile=0x154, lpBuffer=0x1a8adbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a8adbc*, lpNumberOfBytesRead=0x2ae390*=0x4e2, lpOverlapped=0x0) returned 1 [0102.679] CloseHandle (hObject=0x154) returned 1 [0102.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.693] GetFileType (hFile=0x154) returned 0x1 [0102.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.693] GetFileType (hFile=0x154) returned 0x1 [0102.693] WriteFile (in: hFile=0x154, lpBuffer=0x1ada5f8*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ada5f8*, lpNumberOfBytesWritten=0x2ae358*=0x4f0, lpOverlapped=0x0) returned 1 [0102.694] CloseHandle (hObject=0x154) returned 1 [0102.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x59075cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc25fa70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0102.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip.anonymous")) returned 1 [0102.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.695] GetFileType (hFile=0x154) returned 0x1 [0102.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.695] GetFileType (hFile=0x154) returned 0x1 [0102.695] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2bd [0102.695] ReadFile (in: hFile=0x154, lpBuffer=0x1adbd18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1adbd18*, lpNumberOfBytesRead=0x2ae390*=0x2bd, lpOverlapped=0x0) returned 1 [0102.698] CloseHandle (hObject=0x154) returned 1 [0102.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.714] GetFileType (hFile=0x154) returned 0x1 [0102.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.714] GetFileType (hFile=0x154) returned 0x1 [0102.714] WriteFile (in: hFile=0x154, lpBuffer=0x1b2aa18*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b2aa18*, lpNumberOfBytesWritten=0x2ae358*=0x2c0, lpOverlapped=0x0) returned 1 [0102.718] CloseHandle (hObject=0x154) returned 1 [0102.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.718] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x59075cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc2abd30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1 [0102.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip.anonymous")) returned 1 [0102.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.719] GetFileType (hFile=0x154) returned 0x1 [0102.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.719] GetFileType (hFile=0x154) returned 0x1 [0102.719] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x222 [0102.719] ReadFile (in: hFile=0x154, lpBuffer=0x1b2c04c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b2c04c*, lpNumberOfBytesRead=0x2ae390*=0x222, lpOverlapped=0x0) returned 1 [0102.721] CloseHandle (hObject=0x154) returned 1 [0102.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.734] GetFileType (hFile=0x154) returned 0x1 [0102.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.734] GetFileType (hFile=0x154) returned 0x1 [0102.734] WriteFile (in: hFile=0x154, lpBuffer=0x1b7aa98*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b7aa98*, lpNumberOfBytesWritten=0x2ae358*=0x230, lpOverlapped=0x0) returned 1 [0102.735] CloseHandle (hObject=0x154) returned 1 [0102.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.735] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x59075cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc2d1e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0102.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip.anonymous")) returned 1 [0102.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.736] GetFileType (hFile=0x154) returned 0x1 [0102.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.736] GetFileType (hFile=0x154) returned 0x1 [0102.736] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x499 [0102.736] ReadFile (in: hFile=0x154, lpBuffer=0x1b7c354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b7c354*, lpNumberOfBytesRead=0x2ae390*=0x499, lpOverlapped=0x0) returned 1 [0102.746] CloseHandle (hObject=0x154) returned 1 [0102.785] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip", lpFilePart=0x0) returned 0x61 [0102.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.786] GetFileType (hFile=0x154) returned 0x1 [0102.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.786] GetFileType (hFile=0x154) returned 0x1 [0102.786] WriteFile (in: hFile=0x154, lpBuffer=0x19cbc60*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19cbc60*, lpNumberOfBytesWritten=0x2ae358*=0x4a0, lpOverlapped=0x0) returned 1 [0102.787] CloseHandle (hObject=0x154) returned 1 [0102.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip", lpFilePart=0x0) returned 0x61 [0102.787] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip.anonymous", lpFilePart=0x0) returned 0x6b [0102.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.787] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5909be30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc3442b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0102.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip.anonymous")) returned 1 [0102.789] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", lpFilePart=0x0) returned 0x67 [0102.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.789] GetFileType (hFile=0x154) returned 0x1 [0102.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.789] GetFileType (hFile=0x154) returned 0x1 [0102.789] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x341 [0102.789] ReadFile (in: hFile=0x154, lpBuffer=0x19cd3d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19cd3d0*, lpNumberOfBytesRead=0x2ae390*=0x341, lpOverlapped=0x0) returned 1 [0102.816] CloseHandle (hObject=0x154) returned 1 [0102.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", lpFilePart=0x0) returned 0x67 [0102.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.829] GetFileType (hFile=0x154) returned 0x1 [0102.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.829] GetFileType (hFile=0x154) returned 0x1 [0102.829] WriteFile (in: hFile=0x154, lpBuffer=0x1a1c528*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a1c528*, lpNumberOfBytesWritten=0x2ae358*=0x350, lpOverlapped=0x0) returned 1 [0102.830] CloseHandle (hObject=0x154) returned 1 [0102.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip", lpFilePart=0x0) returned 0x67 [0102.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip.anonymous", lpFilePart=0x0) returned 0x71 [0102.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.831] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc3b66d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0102.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip.anonymous")) returned 1 [0102.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", lpFilePart=0x0) returned 0x5e [0102.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.832] GetFileType (hFile=0x154) returned 0x1 [0102.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.832] GetFileType (hFile=0x154) returned 0x1 [0102.832] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x585 [0102.832] ReadFile (in: hFile=0x154, lpBuffer=0x1a1dee0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a1dee0*, lpNumberOfBytesRead=0x2ae390*=0x585, lpOverlapped=0x0) returned 1 [0102.834] CloseHandle (hObject=0x154) returned 1 [0102.845] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", lpFilePart=0x0) returned 0x5e [0102.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.847] GetFileType (hFile=0x154) returned 0x1 [0102.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.847] GetFileType (hFile=0x154) returned 0x1 [0102.847] WriteFile (in: hFile=0x154, lpBuffer=0x1a6d9f8*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a6d9f8*, lpNumberOfBytesWritten=0x2ae358*=0x590, lpOverlapped=0x0) returned 1 [0102.848] CloseHandle (hObject=0x154) returned 1 [0102.848] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip", lpFilePart=0x0) returned 0x5e [0102.848] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip.anonymous", lpFilePart=0x0) returned 0x68 [0102.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.848] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc3dc830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0102.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip.anonymous")) returned 1 [0102.849] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", lpFilePart=0x0) returned 0x63 [0102.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.849] GetFileType (hFile=0x154) returned 0x1 [0102.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.849] GetFileType (hFile=0x154) returned 0x1 [0102.849] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x303 [0102.849] ReadFile (in: hFile=0x154, lpBuffer=0x1a6f10c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a6f10c*, lpNumberOfBytesRead=0x2ae390*=0x303, lpOverlapped=0x0) returned 1 [0102.851] CloseHandle (hObject=0x154) returned 1 [0102.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", lpFilePart=0x0) returned 0x63 [0102.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.864] GetFileType (hFile=0x154) returned 0x1 [0102.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.864] GetFileType (hFile=0x154) returned 0x1 [0102.864] WriteFile (in: hFile=0x154, lpBuffer=0x1abdfb8*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1abdfb8*, lpNumberOfBytesWritten=0x2ae358*=0x310, lpOverlapped=0x0) returned 1 [0102.868] CloseHandle (hObject=0x154) returned 1 [0102.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip", lpFilePart=0x0) returned 0x63 [0102.868] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip.anonymous", lpFilePart=0x0) returned 0x6d [0102.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.868] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc402990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x310)) returned 1 [0102.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip.anonymous")) returned 1 [0102.869] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", lpFilePart=0x0) returned 0x63 [0102.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.869] GetFileType (hFile=0x154) returned 0x1 [0102.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.870] GetFileType (hFile=0x154) returned 0x1 [0102.870] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3719 [0102.870] ReadFile (in: hFile=0x154, lpBuffer=0x1abf3d4, nNumberOfBytesToRead=0x3719, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1abf3d4*, lpNumberOfBytesRead=0x2ae390*=0x3719, lpOverlapped=0x0) returned 1 [0102.884] CloseHandle (hObject=0x154) returned 1 [0102.897] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", lpFilePart=0x0) returned 0x63 [0102.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.899] GetFileType (hFile=0x154) returned 0x1 [0102.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.899] GetFileType (hFile=0x154) returned 0x1 [0102.899] WriteFile (in: hFile=0x154, lpBuffer=0x1b1d560*, nNumberOfBytesToWrite=0x3720, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b1d560*, lpNumberOfBytesWritten=0x2ae384*=0x3720, lpOverlapped=0x0) returned 1 [0102.901] CloseHandle (hObject=0x154) returned 1 [0102.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip", lpFilePart=0x0) returned 0x63 [0102.901] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip.anonymous", lpFilePart=0x0) returned 0x6d [0102.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.901] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591343b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc44ec50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3720)) returned 1 [0102.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip.anonymous")) returned 1 [0102.902] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", lpFilePart=0x0) returned 0x62 [0102.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.902] GetFileType (hFile=0x154) returned 0x1 [0102.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.902] GetFileType (hFile=0x154) returned 0x1 [0102.902] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x83f [0102.902] ReadFile (in: hFile=0x154, lpBuffer=0x1b21a40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b21a40*, lpNumberOfBytesRead=0x2ae390*=0x83f, lpOverlapped=0x0) returned 1 [0102.920] CloseHandle (hObject=0x154) returned 1 [0102.933] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", lpFilePart=0x0) returned 0x62 [0102.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0102.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.938] GetFileType (hFile=0x154) returned 0x1 [0102.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0102.938] GetFileType (hFile=0x154) returned 0x1 [0102.938] WriteFile (in: hFile=0x154, lpBuffer=0x1b722d0*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b722d0*, lpNumberOfBytesWritten=0x2ae358*=0x840, lpOverlapped=0x0) returned 1 [0102.939] CloseHandle (hObject=0x154) returned 1 [0102.939] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip", lpFilePart=0x0) returned 0x62 [0102.948] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip.anonymous", lpFilePart=0x0) returned 0x6c [0102.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0102.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc4c1070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0102.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0102.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip.anonymous")) returned 1 [0102.975] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", lpFilePart=0x0) returned 0x6a [0102.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0102.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0102.976] GetFileType (hFile=0x154) returned 0x1 [0102.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0102.976] GetFileType (hFile=0x154) returned 0x1 [0102.976] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x85a [0102.976] ReadFile (in: hFile=0x154, lpBuffer=0x1b73f74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b73f74*, lpNumberOfBytesRead=0x2ae390*=0x85a, lpOverlapped=0x0) returned 1 [0102.994] CloseHandle (hObject=0x154) returned 1 [0103.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", lpFilePart=0x0) returned 0x6a [0103.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.106] GetFileType (hFile=0x154) returned 0x1 [0103.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.106] GetFileType (hFile=0x154) returned 0x1 [0103.106] WriteFile (in: hFile=0x154, lpBuffer=0x19c4c70*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19c4c70*, lpNumberOfBytesWritten=0x2ae358*=0x860, lpOverlapped=0x0) returned 1 [0103.107] CloseHandle (hObject=0x154) returned 1 [0103.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip", lpFilePart=0x0) returned 0x6a [0103.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip.anonymous", lpFilePart=0x0) returned 0x74 [0103.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.108] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc663f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0103.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip.anonymous")) returned 1 [0103.111] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", lpFilePart=0x0) returned 0x62 [0103.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.111] GetFileType (hFile=0x154) returned 0x1 [0103.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.111] GetFileType (hFile=0x154) returned 0x1 [0103.111] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3b8 [0103.111] ReadFile (in: hFile=0x154, lpBuffer=0x19c6480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19c6480*, lpNumberOfBytesRead=0x2ae390*=0x3b8, lpOverlapped=0x0) returned 1 [0103.121] CloseHandle (hObject=0x154) returned 1 [0103.133] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", lpFilePart=0x0) returned 0x62 [0103.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.135] GetFileType (hFile=0x154) returned 0x1 [0103.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.135] GetFileType (hFile=0x154) returned 0x1 [0103.135] WriteFile (in: hFile=0x154, lpBuffer=0x1a157f0*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a157f0*, lpNumberOfBytesWritten=0x2ae358*=0x3c0, lpOverlapped=0x0) returned 1 [0103.136] CloseHandle (hObject=0x154) returned 1 [0103.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip", lpFilePart=0x0) returned 0x62 [0103.136] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip.anonymous", lpFilePart=0x0) returned 0x6c [0103.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.136] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc68a0f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0103.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip.anonymous")) returned 1 [0103.137] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", lpFilePart=0x0) returned 0x6a [0103.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.138] GetFileType (hFile=0x154) returned 0x1 [0103.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.138] GetFileType (hFile=0x154) returned 0x1 [0103.138] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3d4 [0103.138] ReadFile (in: hFile=0x154, lpBuffer=0x1a1700c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a1700c*, lpNumberOfBytesRead=0x2ae390*=0x3d4, lpOverlapped=0x0) returned 1 [0103.160] CloseHandle (hObject=0x154) returned 1 [0103.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", lpFilePart=0x0) returned 0x6a [0103.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.173] GetFileType (hFile=0x154) returned 0x1 [0103.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.173] GetFileType (hFile=0x154) returned 0x1 [0103.173] WriteFile (in: hFile=0x154, lpBuffer=0x1a662e4*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a662e4*, lpNumberOfBytesWritten=0x2ae358*=0x3e0, lpOverlapped=0x0) returned 1 [0103.174] CloseHandle (hObject=0x154) returned 1 [0103.174] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip", lpFilePart=0x0) returned 0x6a [0103.175] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip.anonymous", lpFilePart=0x0) returned 0x74 [0103.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.175] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc6fc510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0103.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip.anonymous")) returned 1 [0103.175] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", lpFilePart=0x0) returned 0x62 [0103.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.176] GetFileType (hFile=0x154) returned 0x1 [0103.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.176] GetFileType (hFile=0x154) returned 0x1 [0103.176] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x226 [0103.176] ReadFile (in: hFile=0x154, lpBuffer=0x1a67964, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a67964*, lpNumberOfBytesRead=0x2ae390*=0x226, lpOverlapped=0x0) returned 1 [0103.177] CloseHandle (hObject=0x154) returned 1 [0103.190] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", lpFilePart=0x0) returned 0x62 [0103.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.191] GetFileType (hFile=0x154) returned 0x1 [0103.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.191] GetFileType (hFile=0x154) returned 0x1 [0103.191] WriteFile (in: hFile=0x154, lpBuffer=0x1ab63ac*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ab63ac*, lpNumberOfBytesWritten=0x2ae358*=0x230, lpOverlapped=0x0) returned 1 [0103.192] CloseHandle (hObject=0x154) returned 1 [0103.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip", lpFilePart=0x0) returned 0x62 [0103.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip.anonymous", lpFilePart=0x0) returned 0x6c [0103.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.193] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x592b1170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc722670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0103.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip.anonymous")) returned 1 [0103.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", lpFilePart=0x0) returned 0x65 [0103.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.195] GetFileType (hFile=0x154) returned 0x1 [0103.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.195] GetFileType (hFile=0x154) returned 0x1 [0103.195] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x59c [0103.195] ReadFile (in: hFile=0x154, lpBuffer=0x1ab7d78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1ab7d78*, lpNumberOfBytesRead=0x2ae390*=0x59c, lpOverlapped=0x0) returned 1 [0103.213] CloseHandle (hObject=0x154) returned 1 [0103.224] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", lpFilePart=0x0) returned 0x65 [0103.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.226] GetFileType (hFile=0x154) returned 0x1 [0103.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.226] GetFileType (hFile=0x154) returned 0x1 [0103.226] WriteFile (in: hFile=0x154, lpBuffer=0x1b078f0*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b078f0*, lpNumberOfBytesWritten=0x2ae358*=0x5a0, lpOverlapped=0x0) returned 1 [0103.227] CloseHandle (hObject=0x154) returned 1 [0103.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip", lpFilePart=0x0) returned 0x65 [0103.227] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip.anonymous", lpFilePart=0x0) returned 0x6f [0103.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x592b1170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc76e930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5a0)) returned 1 [0103.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip.anonymous")) returned 1 [0103.228] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", lpFilePart=0x0) returned 0x64 [0103.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.228] GetFileType (hFile=0x154) returned 0x1 [0103.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.228] GetFileType (hFile=0x154) returned 0x1 [0103.228] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x558 [0103.228] ReadFile (in: hFile=0x154, lpBuffer=0x1b09284, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b09284*, lpNumberOfBytesRead=0x2ae390*=0x558, lpOverlapped=0x0) returned 1 [0103.254] CloseHandle (hObject=0x154) returned 1 [0103.266] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", lpFilePart=0x0) returned 0x64 [0103.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.267] GetFileType (hFile=0x154) returned 0x1 [0103.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.267] GetFileType (hFile=0x154) returned 0x1 [0103.267] WriteFile (in: hFile=0x154, lpBuffer=0x1b58cc0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b58cc0*, lpNumberOfBytesWritten=0x2ae358*=0x560, lpOverlapped=0x0) returned 1 [0103.268] CloseHandle (hObject=0x154) returned 1 [0103.268] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip", lpFilePart=0x0) returned 0x64 [0103.268] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip.anonymous", lpFilePart=0x0) returned 0x6e [0103.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x592d72d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc7e0d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0103.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip.anonymous")) returned 1 [0103.269] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", lpFilePart=0x0) returned 0x61 [0103.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.270] GetFileType (hFile=0x154) returned 0x1 [0103.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.270] GetFileType (hFile=0x154) returned 0x1 [0103.270] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x251 [0103.270] ReadFile (in: hFile=0x154, lpBuffer=0x1b5a340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b5a340*, lpNumberOfBytesRead=0x2ae390*=0x251, lpOverlapped=0x0) returned 1 [0103.271] CloseHandle (hObject=0x154) returned 1 [0103.283] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", lpFilePart=0x0) returned 0x61 [0103.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.284] GetFileType (hFile=0x154) returned 0x1 [0103.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.284] GetFileType (hFile=0x154) returned 0x1 [0103.284] WriteFile (in: hFile=0x154, lpBuffer=0x1ba8e74*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ba8e74*, lpNumberOfBytesWritten=0x2ae358*=0x260, lpOverlapped=0x0) returned 1 [0103.285] CloseHandle (hObject=0x154) returned 1 [0103.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip", lpFilePart=0x0) returned 0x61 [0103.285] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip.anonymous", lpFilePart=0x0) returned 0x6b [0103.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.285] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x59323590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc806eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1 [0103.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip.anonymous")) returned 1 [0103.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0103.292] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic", lpFilePart=0x0) returned 0x55 [0103.292] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\", lpFilePart=0x0) returned 0x56 [0103.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0103.292] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0103.293] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0103.293] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0103.293] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0103.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0103.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0103.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0103.293] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic", lpFilePart=0x0) returned 0x55 [0103.293] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\", lpFilePart=0x0) returned 0x56 [0103.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0103.293] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0103.294] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0103.294] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0103.294] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0103.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0103.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0103.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0103.294] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033", lpFilePart=0x0) returned 0x5a [0103.294] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", lpFilePart=0x0) returned 0x5b [0103.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0103.353] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.354] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.355] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.355] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.355] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.355] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.355] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.355] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0103.355] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0103.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0103.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0103.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0103.356] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033", lpFilePart=0x0) returned 0x5a [0103.356] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", lpFilePart=0x0) returned 0x5b [0103.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0103.357] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.358] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.359] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0103.360] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0103.360] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0103.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0103.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0103.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", lpFilePart=0x0) returned 0x77 [0103.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.362] GetFileType (hFile=0x154) returned 0x1 [0103.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.362] GetFileType (hFile=0x154) returned 0x1 [0103.362] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x45d [0103.362] ReadFile (in: hFile=0x154, lpBuffer=0x1bb254c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1bb254c*, lpNumberOfBytesRead=0x2ae390*=0x45d, lpOverlapped=0x0) returned 1 [0103.396] CloseHandle (hObject=0x154) returned 1 [0103.432] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", lpFilePart=0x0) returned 0x77 [0103.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.434] GetFileType (hFile=0x154) returned 0x1 [0103.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.434] GetFileType (hFile=0x154) returned 0x1 [0103.434] WriteFile (in: hFile=0x154, lpBuffer=0x1a013e0*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a013e0*, lpNumberOfBytesWritten=0x2ae358*=0x460, lpOverlapped=0x0) returned 1 [0103.435] CloseHandle (hObject=0x154) returned 1 [0103.435] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip", lpFilePart=0x0) returned 0x77 [0103.435] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip.anonymous", lpFilePart=0x0) returned 0x81 [0103.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.435] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5904fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdc983c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0103.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip.anonymous")) returned 1 [0103.436] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", lpFilePart=0x0) returned 0x73 [0103.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.436] GetFileType (hFile=0x154) returned 0x1 [0103.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.436] GetFileType (hFile=0x154) returned 0x1 [0103.436] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x485 [0103.436] ReadFile (in: hFile=0x154, lpBuffer=0x1a02d40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a02d40*, lpNumberOfBytesRead=0x2ae390*=0x485, lpOverlapped=0x0) returned 1 [0103.563] CloseHandle (hObject=0x154) returned 1 [0103.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", lpFilePart=0x0) returned 0x73 [0103.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.577] GetFileType (hFile=0x154) returned 0x1 [0103.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.577] GetFileType (hFile=0x154) returned 0x1 [0103.577] WriteFile (in: hFile=0x154, lpBuffer=0x1a524fc*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a524fc*, lpNumberOfBytesWritten=0x2ae358*=0x490, lpOverlapped=0x0) returned 1 [0103.578] CloseHandle (hObject=0x154) returned 1 [0103.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip", lpFilePart=0x0) returned 0x73 [0103.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip.anonymous", lpFilePart=0x0) returned 0x7d [0103.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.578] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5904fb70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcada8d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x490)) returned 1 [0103.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip.anonymous")) returned 1 [0103.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", lpFilePart=0x0) returned 0x64 [0103.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.579] GetFileType (hFile=0x154) returned 0x1 [0103.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.579] GetFileType (hFile=0x154) returned 0x1 [0103.579] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x24d [0103.579] ReadFile (in: hFile=0x154, lpBuffer=0x1a53bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a53bd0*, lpNumberOfBytesRead=0x2ae390*=0x24d, lpOverlapped=0x0) returned 1 [0103.580] CloseHandle (hObject=0x154) returned 1 [0103.592] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", lpFilePart=0x0) returned 0x64 [0103.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.593] GetFileType (hFile=0x154) returned 0x1 [0103.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.593] GetFileType (hFile=0x154) returned 0x1 [0103.594] WriteFile (in: hFile=0x154, lpBuffer=0x1aa26ac*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1aa26ac*, lpNumberOfBytesWritten=0x2ae358*=0x250, lpOverlapped=0x0) returned 1 [0103.595] CloseHandle (hObject=0x154) returned 1 [0103.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip", lpFilePart=0x0) returned 0x64 [0103.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip.anonymous", lpFilePart=0x0) returned 0x6e [0103.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.595] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x59075cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcb00a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0103.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip.anonymous")) returned 1 [0103.595] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip", lpFilePart=0x0) returned 0x66 [0103.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.596] GetFileType (hFile=0x154) returned 0x1 [0103.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.596] GetFileType (hFile=0x154) returned 0x1 [0103.596] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x4a8 [0103.596] ReadFile (in: hFile=0x154, lpBuffer=0x1aa3f8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aa3f8c*, lpNumberOfBytesRead=0x2ae390*=0x4a8, lpOverlapped=0x0) returned 1 [0103.669] CloseHandle (hObject=0x154) returned 1 [0103.685] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip", lpFilePart=0x0) returned 0x66 [0103.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.687] GetFileType (hFile=0x154) returned 0x1 [0103.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.687] GetFileType (hFile=0x154) returned 0x1 [0103.687] WriteFile (in: hFile=0x154, lpBuffer=0x1af3654*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1af3654*, lpNumberOfBytesWritten=0x2ae358*=0x4b0, lpOverlapped=0x0) returned 1 [0103.688] CloseHandle (hObject=0x154) returned 1 [0103.688] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip", lpFilePart=0x0) returned 0x66 [0103.688] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip.anonymous", lpFilePart=0x0) returned 0x70 [0103.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5909be30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcbe5270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4b0)) returned 1 [0103.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip.anonymous")) returned 1 [0103.689] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip", lpFilePart=0x0) returned 0x65 [0103.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.690] GetFileType (hFile=0x154) returned 0x1 [0103.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.690] GetFileType (hFile=0x154) returned 0x1 [0103.690] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x7f4 [0103.690] ReadFile (in: hFile=0x154, lpBuffer=0x1af5288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1af5288*, lpNumberOfBytesRead=0x2ae390*=0x7f4, lpOverlapped=0x0) returned 1 [0103.716] CloseHandle (hObject=0x154) returned 1 [0103.728] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip", lpFilePart=0x0) returned 0x65 [0103.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.729] GetFileType (hFile=0x154) returned 0x1 [0103.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.729] GetFileType (hFile=0x154) returned 0x1 [0103.729] WriteFile (in: hFile=0x154, lpBuffer=0x1b459e0*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b459e0*, lpNumberOfBytesWritten=0x2ae358*=0x800, lpOverlapped=0x0) returned 1 [0103.730] CloseHandle (hObject=0x154) returned 1 [0103.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip", lpFilePart=0x0) returned 0x65 [0103.730] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip.anonymous", lpFilePart=0x0) returned 0x6f [0103.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.731] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5909be30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcc57690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1 [0103.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip.anonymous")) returned 1 [0103.731] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip", lpFilePart=0x0) returned 0x6c [0103.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.731] GetFileType (hFile=0x154) returned 0x1 [0103.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.732] GetFileType (hFile=0x154) returned 0x1 [0103.732] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x35b [0103.732] ReadFile (in: hFile=0x154, lpBuffer=0x1b4718c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b4718c*, lpNumberOfBytesRead=0x2ae390*=0x35b, lpOverlapped=0x0) returned 1 [0103.749] CloseHandle (hObject=0x154) returned 1 [0103.761] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip", lpFilePart=0x0) returned 0x6c [0103.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.762] GetFileType (hFile=0x154) returned 0x1 [0103.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.763] GetFileType (hFile=0x154) returned 0x1 [0103.763] WriteFile (in: hFile=0x154, lpBuffer=0x1b961dc*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b961dc*, lpNumberOfBytesWritten=0x2ae358*=0x360, lpOverlapped=0x0) returned 1 [0103.764] CloseHandle (hObject=0x154) returned 1 [0103.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip", lpFilePart=0x0) returned 0x6c [0103.764] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip.anonymous", lpFilePart=0x0) returned 0x76 [0103.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.764] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcca3950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0103.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip.anonymous")) returned 1 [0103.765] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip", lpFilePart=0x0) returned 0x67 [0103.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.765] GetFileType (hFile=0x154) returned 0x1 [0103.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.765] GetFileType (hFile=0x154) returned 0x1 [0103.765] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x4faa [0103.765] ReadFile (in: hFile=0x154, lpBuffer=0x1b9763c, nNumberOfBytesToRead=0x4faa, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b9763c*, lpNumberOfBytesRead=0x2ae390*=0x4faa, lpOverlapped=0x0) returned 1 [0103.774] CloseHandle (hObject=0x154) returned 1 [0103.809] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip", lpFilePart=0x0) returned 0x67 [0103.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.811] GetFileType (hFile=0x154) returned 0x1 [0103.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.811] GetFileType (hFile=0x154) returned 0x1 [0103.811] WriteFile (in: hFile=0x154, lpBuffer=0x1a01db4*, nNumberOfBytesToWrite=0x4fb0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a01db4*, lpNumberOfBytesWritten=0x2ae384*=0x4fb0, lpOverlapped=0x0) returned 1 [0103.812] CloseHandle (hObject=0x154) returned 1 [0103.812] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip", lpFilePart=0x0) returned 0x67 [0103.813] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip.anonymous", lpFilePart=0x0) returned 0x71 [0103.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.813] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcd15d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4fb0)) returned 1 [0103.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip.anonymous")) returned 1 [0103.813] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip", lpFilePart=0x0) returned 0x63 [0103.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.814] GetFileType (hFile=0x154) returned 0x1 [0103.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.814] GetFileType (hFile=0x154) returned 0x1 [0103.814] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x514 [0103.814] ReadFile (in: hFile=0x154, lpBuffer=0x1a07810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a07810*, lpNumberOfBytesRead=0x2ae390*=0x514, lpOverlapped=0x0) returned 1 [0103.815] CloseHandle (hObject=0x154) returned 1 [0103.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip", lpFilePart=0x0) returned 0x63 [0103.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.829] GetFileType (hFile=0x154) returned 0x1 [0103.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.829] GetFileType (hFile=0x154) returned 0x1 [0103.829] WriteFile (in: hFile=0x154, lpBuffer=0x1a5725c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a5725c*, lpNumberOfBytesWritten=0x2ae358*=0x520, lpOverlapped=0x0) returned 1 [0103.830] CloseHandle (hObject=0x154) returned 1 [0103.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip", lpFilePart=0x0) returned 0x63 [0103.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip.anonymous", lpFilePart=0x0) returned 0x6d [0103.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.830] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcd3bed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0103.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip.anonymous")) returned 1 [0103.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip", lpFilePart=0x0) returned 0x68 [0103.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.831] GetFileType (hFile=0x154) returned 0x1 [0103.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.831] GetFileType (hFile=0x154) returned 0x1 [0103.831] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb090 [0103.831] ReadFile (in: hFile=0x154, lpBuffer=0x1a58684, nNumberOfBytesToRead=0xb090, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a58684*, lpNumberOfBytesRead=0x2ae390*=0xb090, lpOverlapped=0x0) returned 1 [0103.845] CloseHandle (hObject=0x154) returned 1 [0103.858] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip", lpFilePart=0x0) returned 0x68 [0103.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.860] GetFileType (hFile=0x154) returned 0x1 [0103.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.860] GetFileType (hFile=0x154) returned 0x1 [0103.860] WriteFile (in: hFile=0x154, lpBuffer=0x1ac6660*, nNumberOfBytesToWrite=0xb0a0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ac6660*, lpNumberOfBytesWritten=0x2ae384*=0xb0a0, lpOverlapped=0x0) returned 1 [0103.862] CloseHandle (hObject=0x154) returned 1 [0103.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip", lpFilePart=0x0) returned 0x68 [0103.862] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip.anonymous", lpFilePart=0x0) returned 0x72 [0103.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5910e250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcd88190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0a0)) returned 1 [0103.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip.anonymous")) returned 1 [0103.863] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip", lpFilePart=0x0) returned 0x68 [0103.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.863] GetFileType (hFile=0x154) returned 0x1 [0103.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.863] GetFileType (hFile=0x154) returned 0x1 [0103.863] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x36b7 [0103.863] ReadFile (in: hFile=0x154, lpBuffer=0x1ad1cb0, nNumberOfBytesToRead=0x36b7, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1ad1cb0*, lpNumberOfBytesRead=0x2ae390*=0x36b7, lpOverlapped=0x0) returned 1 [0103.883] CloseHandle (hObject=0x154) returned 1 [0103.895] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip", lpFilePart=0x0) returned 0x68 [0103.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.896] GetFileType (hFile=0x154) returned 0x1 [0103.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.896] GetFileType (hFile=0x154) returned 0x1 [0103.896] WriteFile (in: hFile=0x154, lpBuffer=0x1b2fc5c*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b2fc5c*, lpNumberOfBytesWritten=0x2ae384*=0x36c0, lpOverlapped=0x0) returned 1 [0103.898] CloseHandle (hObject=0x154) returned 1 [0103.898] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip", lpFilePart=0x0) returned 0x68 [0103.898] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip.anonymous", lpFilePart=0x0) returned 0x72 [0103.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.898] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591343b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcdd4450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x36c0)) returned 1 [0103.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip.anonymous")) returned 1 [0103.899] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip", lpFilePart=0x0) returned 0x65 [0103.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.899] GetFileType (hFile=0x154) returned 0x1 [0103.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.899] GetFileType (hFile=0x154) returned 0x1 [0103.899] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x24f [0103.899] ReadFile (in: hFile=0x154, lpBuffer=0x1b33b1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b33b1c*, lpNumberOfBytesRead=0x2ae390*=0x24f, lpOverlapped=0x0) returned 1 [0103.900] CloseHandle (hObject=0x154) returned 1 [0103.913] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip", lpFilePart=0x0) returned 0x65 [0103.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.914] GetFileType (hFile=0x154) returned 0x1 [0103.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.914] GetFileType (hFile=0x154) returned 0x1 [0103.914] WriteFile (in: hFile=0x154, lpBuffer=0x1b825fc*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b825fc*, lpNumberOfBytesWritten=0x2ae358*=0x250, lpOverlapped=0x0) returned 1 [0103.915] CloseHandle (hObject=0x154) returned 1 [0103.915] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip", lpFilePart=0x0) returned 0x65 [0103.915] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip.anonymous", lpFilePart=0x0) returned 0x6f [0103.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.915] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x5915a510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcdfa5b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0103.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip.anonymous")) returned 1 [0103.917] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip", lpFilePart=0x0) returned 0x6f [0103.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.917] GetFileType (hFile=0x154) returned 0x1 [0103.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.918] GetFileType (hFile=0x154) returned 0x1 [0103.918] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x89b [0103.918] ReadFile (in: hFile=0x154, lpBuffer=0x1b842f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b842f4*, lpNumberOfBytesRead=0x2ae390*=0x89b, lpOverlapped=0x0) returned 1 [0103.928] CloseHandle (hObject=0x154) returned 1 [0103.964] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip", lpFilePart=0x0) returned 0x6f [0103.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0103.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.966] GetFileType (hFile=0x154) returned 0x1 [0103.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0103.966] GetFileType (hFile=0x154) returned 0x1 [0103.966] WriteFile (in: hFile=0x154, lpBuffer=0x19d06a0*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19d06a0*, lpNumberOfBytesWritten=0x2ae358*=0x8a0, lpOverlapped=0x0) returned 1 [0103.967] CloseHandle (hObject=0x154) returned 1 [0103.967] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip", lpFilePart=0x0) returned 0x6f [0103.967] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip.anonymous", lpFilePart=0x0) returned 0x79 [0103.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0103.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdce92b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8a0)) returned 1 [0103.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0103.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip.anonymous")) returned 1 [0103.968] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip", lpFilePart=0x0) returned 0x6f [0103.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0103.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0103.969] GetFileType (hFile=0x154) returned 0x1 [0103.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0103.969] GetFileType (hFile=0x154) returned 0x1 [0103.969] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x419 [0103.969] ReadFile (in: hFile=0x154, lpBuffer=0x19d1f54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19d1f54*, lpNumberOfBytesRead=0x2ae390*=0x419, lpOverlapped=0x0) returned 1 [0104.029] CloseHandle (hObject=0x154) returned 1 [0104.043] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip", lpFilePart=0x0) returned 0x6f [0104.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0104.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.044] GetFileType (hFile=0x154) returned 0x1 [0104.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0104.044] GetFileType (hFile=0x154) returned 0x1 [0104.044] WriteFile (in: hFile=0x154, lpBuffer=0x1a214cc*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a214cc*, lpNumberOfBytesWritten=0x2ae358*=0x420, lpOverlapped=0x0) returned 1 [0104.045] CloseHandle (hObject=0x154) returned 1 [0104.045] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip", lpFilePart=0x0) returned 0x6f [0104.045] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip.anonymous", lpFilePart=0x0) returned 0x79 [0104.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0104.045] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcf51210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x420)) returned 1 [0104.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0104.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip.anonymous")) returned 1 [0104.046] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip", lpFilePart=0x0) returned 0x6b [0104.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0104.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.047] GetFileType (hFile=0x154) returned 0x1 [0104.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0104.047] GetFileType (hFile=0x154) returned 0x1 [0104.047] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xec16 [0104.047] ReadFile (in: hFile=0x154, lpBuffer=0x1a22948, nNumberOfBytesToRead=0xec16, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a22948*, lpNumberOfBytesRead=0x2ae390*=0xec16, lpOverlapped=0x0) returned 1 [0104.055] CloseHandle (hObject=0x154) returned 1 [0104.069] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip", lpFilePart=0x0) returned 0x6b [0104.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0104.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.071] GetFileType (hFile=0x154) returned 0x1 [0104.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0104.071] GetFileType (hFile=0x154) returned 0x1 [0104.071] WriteFile (in: hFile=0x154, lpBuffer=0x1a9bba8*, nNumberOfBytesToWrite=0xec20, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a9bba8*, lpNumberOfBytesWritten=0x2ae384*=0xec20, lpOverlapped=0x0) returned 1 [0104.073] CloseHandle (hObject=0x154) returned 1 [0104.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip", lpFilePart=0x0) returned 0x6b [0104.073] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip.anonymous", lpFilePart=0x0) returned 0x75 [0104.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0104.073] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x591cc930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcf77370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xec20)) returned 1 [0104.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0104.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip.anonymous")) returned 1 [0104.074] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip", lpFilePart=0x0) returned 0x63 [0104.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0104.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.074] GetFileType (hFile=0x154) returned 0x1 [0104.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0104.074] GetFileType (hFile=0x154) returned 0x1 [0104.074] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x22b [0104.074] ReadFile (in: hFile=0x154, lpBuffer=0x1aaafb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aaafb4*, lpNumberOfBytesRead=0x2ae390*=0x22b, lpOverlapped=0x0) returned 1 [0104.075] CloseHandle (hObject=0x154) returned 1 [0104.087] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip", lpFilePart=0x0) returned 0x63 [0104.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0104.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.089] GetFileType (hFile=0x154) returned 0x1 [0104.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0104.089] GetFileType (hFile=0x154) returned 0x1 [0104.089] WriteFile (in: hFile=0x154, lpBuffer=0x1af99f0*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1af99f0*, lpNumberOfBytesWritten=0x2ae358*=0x230, lpOverlapped=0x0) returned 1 [0104.090] CloseHandle (hObject=0x154) returned 1 [0104.090] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip", lpFilePart=0x0) returned 0x63 [0104.090] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip.anonymous", lpFilePart=0x0) returned 0x6d [0104.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0104.090] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x592b1170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcfc3630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0104.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0104.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip.anonymous")) returned 1 [0104.091] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip", lpFilePart=0x0) returned 0x6a [0104.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0104.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.091] GetFileType (hFile=0x154) returned 0x1 [0104.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0104.091] GetFileType (hFile=0x154) returned 0x1 [0104.091] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x5b1 [0104.091] ReadFile (in: hFile=0x154, lpBuffer=0x1afb3e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1afb3e0*, lpNumberOfBytesRead=0x2ae390*=0x5b1, lpOverlapped=0x0) returned 1 [0104.093] CloseHandle (hObject=0x154) returned 1 [0104.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip", lpFilePart=0x0) returned 0x6a [0104.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0104.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.107] GetFileType (hFile=0x154) returned 0x1 [0104.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0104.107] GetFileType (hFile=0x154) returned 0x1 [0104.107] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b010*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b4b010*, lpNumberOfBytesWritten=0x2ae358*=0x5c0, lpOverlapped=0x0) returned 1 [0104.108] CloseHandle (hObject=0x154) returned 1 [0104.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip", lpFilePart=0x0) returned 0x6a [0104.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip.anonymous", lpFilePart=0x0) returned 0x74 [0104.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0104.109] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2184f900, ftCreationTime.dwHighDateTime=0x1c9e4a1, ftLastAccessTime.dwLowDateTime=0x592b1170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xdcfe9790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0104.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0104.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip.anonymous" (normalized: "c:\\program files\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip.anonymous")) returned 1 [0104.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.109] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages", lpFilePart=0x0) returned 0x3b [0104.109] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\", lpFilePart=0x0) returned 0x3c [0104.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0104.110] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.110] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.110] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.110] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.110] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages", lpFilePart=0x0) returned 0x3b [0104.110] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\", lpFilePart=0x0) returned 0x3c [0104.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0104.110] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.111] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.111] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger", lpFilePart=0x0) returned 0x44 [0104.111] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\", lpFilePart=0x0) returned 0x45 [0104.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0104.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.111] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.112] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger", lpFilePart=0x0) returned 0x44 [0104.112] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\", lpFilePart=0x0) returned 0x45 [0104.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0104.112] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.112] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.112] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.112] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\SDK", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\SDK", lpFilePart=0x0) returned 0x2e [0104.112] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\SDK\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\SDK\\", lpFilePart=0x0) returned 0x2f [0104.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.113] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.113] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.113] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.114] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\SDK", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\SDK", lpFilePart=0x0) returned 0x2e [0104.114] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\SDK\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\SDK\\", lpFilePart=0x0) returned 0x2f [0104.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.114] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.114] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.114] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.114] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\VSTA", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA", lpFilePart=0x0) returned 0x2f [0104.114] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\", lpFilePart=0x0) returned 0x30 [0104.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.115] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.115] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\VSTA", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA", lpFilePart=0x0) returned 0x2f [0104.115] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\", lpFilePart=0x0) returned 0x30 [0104.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.116] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.116] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.116] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin", lpFilePart=0x0) returned 0x33 [0104.116] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\", lpFilePart=0x0) returned 0x34 [0104.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0104.116] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.117] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.117] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.117] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.117] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.117] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.117] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin", lpFilePart=0x0) returned 0x33 [0104.117] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\", lpFilePart=0x0) returned 0x34 [0104.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0104.117] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.118] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.118] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.118] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.118] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.118] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033", lpFilePart=0x0) returned 0x38 [0104.118] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\", lpFilePart=0x0) returned 0x39 [0104.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0104.118] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.119] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.119] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.119] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.119] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.119] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033", lpFilePart=0x0) returned 0x38 [0104.119] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\", lpFilePart=0x0) returned 0x39 [0104.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0104.119] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.119] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.119] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.120] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.120] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.120] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET", lpFilePart=0x0) returned 0x1e [0104.120] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\", lpFilePart=0x0) returned 0x1f [0104.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec98 [0104.120] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.120] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.120] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.121] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.121] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET", lpFilePart=0x0) returned 0x1e [0104.121] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\", lpFilePart=0x0) returned 0x1f [0104.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec98 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.121] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.122] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.122] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\Primary Interop Assemblies", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies", lpFilePart=0x0) returned 0x39 [0104.122] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies\\", lpFilePart=0x0) returned 0x3a [0104.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.136] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.136] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.137] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.137] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.137] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.137] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.137] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.137] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.138] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\Primary Interop Assemblies", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies", lpFilePart=0x0) returned 0x39 [0104.138] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies\\", lpFilePart=0x0) returned 0x3a [0104.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.139] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.139] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.139] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.139] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.140] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.140] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.140] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.140] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.141] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList", lpFilePart=0x0) returned 0x29 [0104.141] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\", lpFilePart=0x0) returned 0x2a [0104.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.141] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.141] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.141] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.142] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.142] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.142] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList", lpFilePart=0x0) returned 0x29 [0104.142] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\", lpFilePart=0x0) returned 0x2a [0104.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec98 [0104.142] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.142] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.142] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.142] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.142] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.143] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", lpFilePart=0x0) returned 0x43 [0104.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0104.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.143] GetFileType (hFile=0x154) returned 0x1 [0104.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0104.143] GetFileType (hFile=0x154) returned 0x1 [0104.143] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x3d63 [0104.143] ReadFile (in: hFile=0x154, lpBuffer=0x1b59db0, nNumberOfBytesToRead=0x3d63, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b59db0*, lpNumberOfBytesRead=0x2ae5d4*=0x3d63, lpOverlapped=0x0) returned 1 [0104.149] CloseHandle (hObject=0x154) returned 1 [0104.164] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", lpFilePart=0x0) returned 0x43 [0104.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0104.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.166] GetFileType (hFile=0x154) returned 0x1 [0104.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0104.166] GetFileType (hFile=0x154) returned 0x1 [0104.167] WriteFile (in: hFile=0x154, lpBuffer=0x19c1048*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19c1048*, lpNumberOfBytesWritten=0x2ae5c8*=0x3d70, lpOverlapped=0x0) returned 1 [0104.168] CloseHandle (hObject=0x154) returned 1 [0104.168] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", lpFilePart=0x0) returned 0x43 [0104.168] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.anonymous", lpFilePart=0x0) returned 0x4d [0104.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0104.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e2b00, ftCreationTime.dwHighDateTime=0x1cd906a, ftLastAccessTime.dwLowDateTime=0x4e6f04a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xdd05bbb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d70)) returned 1 [0104.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), lpNewFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.anonymous" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_client.xml.anonymous")) returned 1 [0104.171] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", lpFilePart=0x0) returned 0x45 [0104.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0104.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.172] GetFileType (hFile=0x154) returned 0x1 [0104.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0104.172] GetFileType (hFile=0x154) returned 0x1 [0104.172] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x201c [0104.172] ReadFile (in: hFile=0x154, lpBuffer=0x19c5224, nNumberOfBytesToRead=0x201c, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19c5224*, lpNumberOfBytesRead=0x2ae5d4*=0x201c, lpOverlapped=0x0) returned 1 [0104.186] CloseHandle (hObject=0x154) returned 1 [0104.220] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", lpFilePart=0x0) returned 0x45 [0104.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0104.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.222] GetFileType (hFile=0x154) returned 0x1 [0104.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0104.222] GetFileType (hFile=0x154) returned 0x1 [0104.222] WriteFile (in: hFile=0x154, lpBuffer=0x1a1c208*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a1c208*, lpNumberOfBytesWritten=0x2ae5c8*=0x2020, lpOverlapped=0x0) returned 1 [0104.223] CloseHandle (hObject=0x154) returned 1 [0104.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", lpFilePart=0x0) returned 0x45 [0104.223] GetFullPathNameW (in: lpFileName="\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.anonymous", lpFilePart=0x0) returned 0x4f [0104.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0104.223] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e2b00, ftCreationTime.dwHighDateTime=0x1cd906a, ftLastAccessTime.dwLowDateTime=0x4e6f04a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xdd0f4130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2020)) returned 1 [0104.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), lpNewFileName="C:\\Program Files\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.anonymous" (normalized: "c:\\program files\\microsoft.net\\redistlist\\assemblylist_4_extended.xml.anonymous")) returned 1 [0104.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.224] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox", lpFilePart=0x0) returned 0x20 [0104.224] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\", lpFilePart=0x0) returned 0x21 [0104.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0104.224] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.225] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.227] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.228] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.229] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.230] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0104.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.230] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox", lpFilePart=0x0) returned 0x20 [0104.230] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\", lpFilePart=0x0) returned 0x21 [0104.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe9d8 [0104.231] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.231] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.231] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.231] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.231] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.231] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.232] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.234] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.235] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.235] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0104.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.236] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser", lpFilePart=0x0) returned 0x28 [0104.236] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\", lpFilePart=0x0) returned 0x29 [0104.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe9d8 [0104.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.252] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.252] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.252] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.252] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.252] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0104.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.254] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser", lpFilePart=0x0) returned 0x28 [0104.254] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\", lpFilePart=0x0) returned 0x29 [0104.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe9d8 [0104.256] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.258] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.258] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.258] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.258] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0104.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.260] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml", lpFilePart=0x0) returned 0x36 [0104.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0104.260] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\blocklist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.262] GetFileType (hFile=0x154) returned 0x1 [0104.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0104.262] GetFileType (hFile=0x154) returned 0x1 [0104.262] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x14623 [0104.262] ReadFile (in: hFile=0x154, lpBuffer=0x1a290d4, nNumberOfBytesToRead=0x14623, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a290d4*, lpNumberOfBytesRead=0x2ae5d4*=0x14623, lpOverlapped=0x0) returned 1 [0104.297] CloseHandle (hObject=0x154) returned 1 [0104.316] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml", lpFilePart=0x0) returned 0x36 [0104.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0104.316] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\blocklist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.319] GetFileType (hFile=0x154) returned 0x1 [0104.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0104.319] GetFileType (hFile=0x154) returned 0x1 [0104.319] WriteFile (in: hFile=0x154, lpBuffer=0x1ab3164*, nNumberOfBytesToWrite=0x14630, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1ab3164*, lpNumberOfBytesWritten=0x2ae5c8*=0x14630, lpOverlapped=0x0) returned 1 [0104.322] CloseHandle (hObject=0x154) returned 1 [0104.322] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml", lpFilePart=0x0) returned 0x36 [0104.323] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml.anonymous", lpFilePart=0x0) returned 0x40 [0104.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0104.323] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\blocklist.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7489ecf0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x7489ecf0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd1d8970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14630)) returned 1 [0104.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\blocklist.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\blocklist.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\blocklist.xml.anonymous")) returned 1 [0104.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.324] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\components", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\components", lpFilePart=0x0) returned 0x33 [0104.325] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\components\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\components\\", lpFilePart=0x0) returned 0x34 [0104.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\components\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0104.326] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.326] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.326] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.326] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.326] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0104.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.327] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\components", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\components", lpFilePart=0x0) returned 0x33 [0104.327] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\components\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\components\\", lpFilePart=0x0) returned 0x34 [0104.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\components\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0104.327] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.327] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.327] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.327] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.327] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0104.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.328] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions", lpFilePart=0x0) returned 0x33 [0104.328] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\", lpFilePart=0x0) returned 0x34 [0104.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0104.328] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.328] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.328] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.329] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0104.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.329] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions", lpFilePart=0x0) returned 0x33 [0104.329] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\", lpFilePart=0x0) returned 0x34 [0104.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0104.329] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.329] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.329] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.330] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0104.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.330] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}", lpFilePart=0x0) returned 0x5a [0104.330] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\", lpFilePart=0x0) returned 0x5b [0104.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0104.331] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.331] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.331] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.331] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.331] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0104.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.332] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}", lpFilePart=0x0) returned 0x5a [0104.332] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\", lpFilePart=0x0) returned 0x5b [0104.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0104.332] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.332] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.332] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.332] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.332] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0104.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.333] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png", lpFilePart=0x0) returned 0x63 [0104.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0104.333] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.333] GetFileType (hFile=0x154) returned 0x1 [0104.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0104.333] GetFileType (hFile=0x154) returned 0x1 [0104.333] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x889 [0104.333] ReadFile (in: hFile=0x154, lpBuffer=0x1acd6cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1acd6cc*, lpNumberOfBytesRead=0x2ae4ec*=0x889, lpOverlapped=0x0) returned 1 [0104.336] CloseHandle (hObject=0x154) returned 1 [0104.355] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png", lpFilePart=0x0) returned 0x63 [0104.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0104.355] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.357] GetFileType (hFile=0x154) returned 0x1 [0104.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0104.357] GetFileType (hFile=0x154) returned 0x1 [0104.359] CloseHandle (hObject=0x154) returned 1 [0104.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png", lpFilePart=0x0) returned 0x63 [0104.359] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.anonymous", lpFilePart=0x0) returned 0x6d [0104.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0104.359] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74937270, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x74937270, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd24ad90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x890)) returned 1 [0104.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.anonymous")) returned 1 [0104.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.360] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins", lpFilePart=0x0) returned 0x36 [0104.360] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\", lpFilePart=0x0) returned 0x37 [0104.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee58 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.366] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.366] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0104.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.367] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins", lpFilePart=0x0) returned 0x36 [0104.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\", lpFilePart=0x0) returned 0x37 [0104.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee58 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.369] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.369] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0104.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.371] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml", lpFilePart=0x0) returned 0x47 [0104.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.371] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\amazondotcom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.372] GetFileType (hFile=0x154) returned 0x1 [0104.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.373] GetFileType (hFile=0x154) returned 0x1 [0104.373] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9a0 [0104.373] ReadFile (in: hFile=0x154, lpBuffer=0x1b226b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b226b8*, lpNumberOfBytesRead=0x2ae560*=0x9a0, lpOverlapped=0x0) returned 1 [0104.375] CloseHandle (hObject=0x154) returned 1 [0104.393] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml", lpFilePart=0x0) returned 0x47 [0104.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.393] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\amazondotcom.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.395] GetFileType (hFile=0x154) returned 0x1 [0104.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.395] GetFileType (hFile=0x154) returned 0x1 [0104.395] WriteFile (in: hFile=0x154, lpBuffer=0x1b73654*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b73654*, lpNumberOfBytesWritten=0x2ae528*=0x9b0, lpOverlapped=0x0) returned 1 [0104.396] CloseHandle (hObject=0x154) returned 1 [0104.397] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml", lpFilePart=0x0) returned 0x47 [0104.397] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml.anonymous", lpFilePart=0x0) returned 0x51 [0104.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.397] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\amazondotcom.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x748eafb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x748eafb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd297050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0104.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\amazondotcom.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\amazondotcom.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\amazondotcom.xml.anonymous")) returned 1 [0104.398] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml", lpFilePart=0x0) returned 0x3f [0104.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.398] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\bing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.398] GetFileType (hFile=0x154) returned 0x1 [0104.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.398] GetFileType (hFile=0x154) returned 0x1 [0104.398] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb3e [0104.398] ReadFile (in: hFile=0x154, lpBuffer=0x1b754c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b754c4*, lpNumberOfBytesRead=0x2ae560*=0xb3e, lpOverlapped=0x0) returned 1 [0104.400] CloseHandle (hObject=0x154) returned 1 [0104.454] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml", lpFilePart=0x0) returned 0x3f [0104.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.454] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\bing.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.455] GetFileType (hFile=0x154) returned 0x1 [0104.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.455] GetFileType (hFile=0x154) returned 0x1 [0104.455] WriteFile (in: hFile=0x154, lpBuffer=0x19bd500*, nNumberOfBytesToWrite=0xb40, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19bd500*, lpNumberOfBytesWritten=0x2ae528*=0xb40, lpOverlapped=0x0) returned 1 [0104.456] CloseHandle (hObject=0x154) returned 1 [0104.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml", lpFilePart=0x0) returned 0x3f [0104.456] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml.anonymous", lpFilePart=0x0) returned 0x49 [0104.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\bing.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x748eafb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x748eafb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd32f5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb40)) returned 1 [0104.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\bing.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\bing.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\bing.xml.anonymous")) returned 1 [0104.457] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml", lpFilePart=0x0) returned 0x3f [0104.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.457] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\ebay.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.457] GetFileType (hFile=0x154) returned 0x1 [0104.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.458] GetFileType (hFile=0x154) returned 0x1 [0104.458] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa17 [0104.458] ReadFile (in: hFile=0x154, lpBuffer=0x19bf218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19bf218*, lpNumberOfBytesRead=0x2ae560*=0xa17, lpOverlapped=0x0) returned 1 [0104.459] CloseHandle (hObject=0x154) returned 1 [0104.474] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml", lpFilePart=0x0) returned 0x3f [0104.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.475] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\ebay.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.476] GetFileType (hFile=0x154) returned 0x1 [0104.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.476] GetFileType (hFile=0x154) returned 0x1 [0104.476] WriteFile (in: hFile=0x154, lpBuffer=0x1a1051c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a1051c*, lpNumberOfBytesWritten=0x2ae528*=0xa20, lpOverlapped=0x0) returned 1 [0104.477] CloseHandle (hObject=0x154) returned 1 [0104.477] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml", lpFilePart=0x0) returned 0x3f [0104.477] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml.anonymous", lpFilePart=0x0) returned 0x49 [0104.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.477] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\ebay.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x748eafb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x748eafb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd355730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa20)) returned 1 [0104.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\ebay.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\eBay.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\ebay.xml.anonymous")) returned 1 [0104.478] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml", lpFilePart=0x0) returned 0x41 [0104.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.478] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\google.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.479] GetFileType (hFile=0x154) returned 0x1 [0104.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.479] GetFileType (hFile=0x154) returned 0x1 [0104.479] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb9b [0104.479] ReadFile (in: hFile=0x154, lpBuffer=0x1a123c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a123c0*, lpNumberOfBytesRead=0x2ae560*=0xb9b, lpOverlapped=0x0) returned 1 [0104.480] CloseHandle (hObject=0x154) returned 1 [0104.492] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml", lpFilePart=0x0) returned 0x41 [0104.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.492] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\google.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.494] GetFileType (hFile=0x154) returned 0x1 [0104.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.494] GetFileType (hFile=0x154) returned 0x1 [0104.494] WriteFile (in: hFile=0x154, lpBuffer=0x1a63cec*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1a63cec*, lpNumberOfBytesWritten=0x2ae528*=0xba0, lpOverlapped=0x0) returned 1 [0104.495] CloseHandle (hObject=0x154) returned 1 [0104.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml", lpFilePart=0x0) returned 0x41 [0104.495] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml.anonymous", lpFilePart=0x0) returned 0x4b [0104.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.496] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\google.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x748eafb0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x748eafb0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd3a19f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xba0)) returned 1 [0104.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\google.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\google.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\google.xml.anonymous")) returned 1 [0104.496] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml", lpFilePart=0x0) returned 0x42 [0104.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.496] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\twitter.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.497] GetFileType (hFile=0x154) returned 0x1 [0104.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.497] GetFileType (hFile=0x154) returned 0x1 [0104.497] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb91 [0104.497] ReadFile (in: hFile=0x154, lpBuffer=0x1a65b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a65b98*, lpNumberOfBytesRead=0x2ae560*=0xb91, lpOverlapped=0x0) returned 1 [0104.498] CloseHandle (hObject=0x154) returned 1 [0104.510] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml", lpFilePart=0x0) returned 0x42 [0104.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.510] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\twitter.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.512] GetFileType (hFile=0x154) returned 0x1 [0104.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.512] GetFileType (hFile=0x154) returned 0x1 [0104.512] WriteFile (in: hFile=0x154, lpBuffer=0x1ab74d0*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ab74d0*, lpNumberOfBytesWritten=0x2ae528*=0xba0, lpOverlapped=0x0) returned 1 [0104.513] CloseHandle (hObject=0x154) returned 1 [0104.513] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml", lpFilePart=0x0) returned 0x42 [0104.513] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml.anonymous", lpFilePart=0x0) returned 0x4c [0104.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.513] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\twitter.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74911110, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x74911110, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd3c7b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xba0)) returned 1 [0104.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\twitter.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\twitter.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\twitter.xml.anonymous")) returned 1 [0104.516] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml", lpFilePart=0x0) returned 0x44 [0104.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.517] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\wikipedia.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.517] GetFileType (hFile=0x154) returned 0x1 [0104.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.517] GetFileType (hFile=0x154) returned 0x1 [0104.517] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8b2 [0104.517] ReadFile (in: hFile=0x154, lpBuffer=0x1ab90b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab90b0*, lpNumberOfBytesRead=0x2ae560*=0x8b2, lpOverlapped=0x0) returned 1 [0104.518] CloseHandle (hObject=0x154) returned 1 [0104.530] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml", lpFilePart=0x0) returned 0x44 [0104.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.530] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\wikipedia.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.532] GetFileType (hFile=0x154) returned 0x1 [0104.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.532] GetFileType (hFile=0x154) returned 0x1 [0104.532] WriteFile (in: hFile=0x154, lpBuffer=0x1b09b90*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b09b90*, lpNumberOfBytesWritten=0x2ae528*=0x8c0, lpOverlapped=0x0) returned 1 [0104.533] CloseHandle (hObject=0x154) returned 1 [0104.533] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml", lpFilePart=0x0) returned 0x44 [0104.533] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml.anonymous", lpFilePart=0x0) returned 0x4e [0104.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\wikipedia.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74911110, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x74911110, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd3edcb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8c0)) returned 1 [0104.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\wikipedia.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\wikipedia.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\wikipedia.xml.anonymous")) returned 1 [0104.534] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml", lpFilePart=0x0) returned 0x40 [0104.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0104.534] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\yahoo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.534] GetFileType (hFile=0x154) returned 0x1 [0104.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0104.534] GetFileType (hFile=0x154) returned 0x1 [0104.534] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa73 [0104.534] ReadFile (in: hFile=0x154, lpBuffer=0x1b0b92c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0b92c*, lpNumberOfBytesRead=0x2ae560*=0xa73, lpOverlapped=0x0) returned 1 [0104.536] CloseHandle (hObject=0x154) returned 1 [0104.548] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml", lpFilePart=0x0) returned 0x40 [0104.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0104.548] CreateFileW (lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\yahoo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.549] GetFileType (hFile=0x154) returned 0x1 [0104.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0104.549] GetFileType (hFile=0x154) returned 0x1 [0104.549] WriteFile (in: hFile=0x154, lpBuffer=0x1b5ccbc*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b5ccbc*, lpNumberOfBytesWritten=0x2ae528*=0xa80, lpOverlapped=0x0) returned 1 [0104.550] CloseHandle (hObject=0x154) returned 1 [0104.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml", lpFilePart=0x0) returned 0x40 [0104.551] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml.anonymous", lpFilePart=0x0) returned 0x4a [0104.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0104.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\yahoo.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74911110, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x74911110, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdd413e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa80)) returned 1 [0104.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\yahoo.xml"), lpNewFileName="C:\\Program Files\\Mozilla Firefox\\browser\\searchplugins\\yahoo.xml.anonymous" (normalized: "c:\\program files\\mozilla firefox\\browser\\searchplugins\\yahoo.xml.anonymous")) returned 1 [0104.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.552] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\defaults", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults", lpFilePart=0x0) returned 0x29 [0104.552] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults\\", lpFilePart=0x0) returned 0x2a [0104.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.552] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.552] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.552] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.553] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.553] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\defaults", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults", lpFilePart=0x0) returned 0x29 [0104.553] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults\\", lpFilePart=0x0) returned 0x2a [0104.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.553] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.553] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.553] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.554] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.554] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\defaults\\pref", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults\\pref", lpFilePart=0x0) returned 0x2e [0104.554] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\", lpFilePart=0x0) returned 0x2f [0104.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0104.554] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.554] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.555] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.555] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.555] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\defaults\\pref", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults\\pref", lpFilePart=0x0) returned 0x2e [0104.555] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\", lpFilePart=0x0) returned 0x2f [0104.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0104.555] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.555] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.555] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.555] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.556] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\dictionaries", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\dictionaries", lpFilePart=0x0) returned 0x2d [0104.556] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\dictionaries\\", lpFilePart=0x0) returned 0x2e [0104.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.556] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.556] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.556] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.556] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.557] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\dictionaries", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\dictionaries", lpFilePart=0x0) returned 0x2d [0104.557] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\dictionaries\\", lpFilePart=0x0) returned 0x2e [0104.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.557] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.557] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.557] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.557] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.557] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.558] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\uninstall", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\uninstall", lpFilePart=0x0) returned 0x2a [0104.558] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\uninstall\\", lpFilePart=0x0) returned 0x2b [0104.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.558] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.558] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.558] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.558] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.558] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.559] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\uninstall", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\uninstall", lpFilePart=0x0) returned 0x2a [0104.559] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\uninstall\\", lpFilePart=0x0) returned 0x2b [0104.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.559] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.559] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.559] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.559] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.560] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.560] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.560] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\webapprt", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\webapprt", lpFilePart=0x0) returned 0x29 [0104.560] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\webapprt\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\webapprt\\", lpFilePart=0x0) returned 0x2a [0104.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\webapprt\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.561] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.561] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.561] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.561] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.561] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Firefox\\webapprt", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\webapprt", lpFilePart=0x0) returned 0x29 [0104.562] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\webapprt\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Firefox\\webapprt\\", lpFilePart=0x0) returned 0x2a [0104.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\webapprt\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.562] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.562] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.562] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.562] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.562] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Maintenance Service", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Maintenance Service", lpFilePart=0x0) returned 0x2c [0104.563] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Maintenance Service\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Maintenance Service\\", lpFilePart=0x0) returned 0x2d [0104.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Maintenance Service\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.563] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.564] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.564] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.564] GetFullPathNameW (in: lpFileName="\\Program Files\\Mozilla Maintenance Service", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Maintenance Service", lpFilePart=0x0) returned 0x2c [0104.564] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Mozilla Maintenance Service\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Mozilla Maintenance Service\\", lpFilePart=0x0) returned 0x2d [0104.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Maintenance Service\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0104.564] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.564] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.564] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.565] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.565] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.565] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.565] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.565] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.565] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.565] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild", lpFilePart=0x0) returned 0x18 [0104.565] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\", lpFilePart=0x0) returned 0x19 [0104.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0104.566] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.566] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.566] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.566] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.566] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.566] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild", lpFilePart=0x0) returned 0x18 [0104.566] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\", lpFilePart=0x0) returned 0x19 [0104.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0104.567] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.567] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.567] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.567] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.567] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.567] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft", lpFilePart=0x0) returned 0x22 [0104.567] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\", lpFilePart=0x0) returned 0x23 [0104.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.568] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.568] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.568] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.568] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.568] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft", lpFilePart=0x0) returned 0x22 [0104.568] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\", lpFilePart=0x0) returned 0x23 [0104.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.569] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.569] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.569] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.569] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.569] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation", lpFilePart=0x0) returned 0x3e [0104.569] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", lpFilePart=0x0) returned 0x3f [0104.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0104.569] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.569] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.570] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.570] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.570] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.570] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation", lpFilePart=0x0) returned 0x3e [0104.570] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", lpFilePart=0x0) returned 0x3f [0104.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0104.570] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.570] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.570] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.571] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.571] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.571] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0", lpFilePart=0x0) returned 0x43 [0104.571] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpFilePart=0x0) returned 0x44 [0104.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0104.571] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.571] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.571] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.571] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.572] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.572] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0", lpFilePart=0x0) returned 0x43 [0104.572] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpFilePart=0x0) returned 0x44 [0104.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0104.572] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.572] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.572] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.572] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.573] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.573] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5", lpFilePart=0x0) returned 0x43 [0104.573] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpFilePart=0x0) returned 0x44 [0104.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0104.573] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.573] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.573] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.574] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.574] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.574] GetFullPathNameW (in: lpFileName="\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5", lpFilePart=0x0) returned 0x43 [0104.574] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpFilePart=0x0) returned 0x44 [0104.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0104.574] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.574] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.574] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.574] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.575] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.575] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies", lpFilePart=0x0) returned 0x25 [0104.575] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\", lpFilePart=0x0) returned 0x26 [0104.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0104.575] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.575] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.575] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.575] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies", lpFilePart=0x0) returned 0x25 [0104.576] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\", lpFilePart=0x0) returned 0x26 [0104.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbec18 [0104.576] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.576] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.576] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.576] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.576] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft", lpFilePart=0x0) returned 0x2f [0104.576] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\", lpFilePart=0x0) returned 0x30 [0104.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.577] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.577] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.577] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.577] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.577] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft", lpFilePart=0x0) returned 0x2f [0104.577] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\", lpFilePart=0x0) returned 0x30 [0104.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbec18 [0104.577] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.577] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.577] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.578] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework", lpFilePart=0x0) returned 0x39 [0104.578] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", lpFilePart=0x0) returned 0x3a [0104.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0104.578] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.578] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.578] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.578] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.578] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0104.578] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework", lpFilePart=0x0) returned 0x39 [0104.578] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", lpFilePart=0x0) returned 0x3a [0104.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec18 [0104.578] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.579] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.579] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0104.579] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0104.579] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0104.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0104.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.579] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0", lpFilePart=0x0) returned 0x3e [0104.579] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpFilePart=0x0) returned 0x3f [0104.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0104.580] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.580] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.580] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.581] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.581] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.582] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0", lpFilePart=0x0) returned 0x3e [0104.583] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpFilePart=0x0) returned 0x3f [0104.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec18 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.584] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.585] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.585] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.585] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.585] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0104.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.586] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", lpFilePart=0x0) returned 0x4c [0104.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0104.586] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.587] GetFileType (hFile=0x154) returned 0x1 [0104.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0104.587] GetFileType (hFile=0x154) returned 0x1 [0104.587] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xa12 [0104.587] ReadFile (in: hFile=0x154, lpBuffer=0x1b7b3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b7b3e8*, lpNumberOfBytesRead=0x2ae4ec*=0xa12, lpOverlapped=0x0) returned 1 [0104.598] CloseHandle (hObject=0x154) returned 1 [0104.634] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", lpFilePart=0x0) returned 0x4c [0104.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0104.634] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.636] GetFileType (hFile=0x154) returned 0x1 [0104.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0104.636] GetFileType (hFile=0x154) returned 0x1 [0104.636] WriteFile (in: hFile=0x154, lpBuffer=0x19cc0a0*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19cc0a0*, lpNumberOfBytesWritten=0x2ae4b4*=0xa20, lpOverlapped=0x0) returned 1 [0104.637] CloseHandle (hObject=0x154) returned 1 [0104.637] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", lpFilePart=0x0) returned 0x4c [0104.637] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.anonymous", lpFilePart=0x0) returned 0x56 [0104.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0104.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e0b6fa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe21a484a, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xdd4f8650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa20)) returned 1 [0104.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.anonymous" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml.anonymous")) returned 1 [0104.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.638] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList", lpFilePart=0x0) returned 0x49 [0104.638] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", lpFilePart=0x0) returned 0x4a [0104.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0104.639] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.639] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.639] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.639] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0104.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.639] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList", lpFilePart=0x0) returned 0x49 [0104.639] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", lpFilePart=0x0) returned 0x4a [0104.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0104.639] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.640] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.640] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.640] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0104.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.640] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", lpFilePart=0x0) returned 0x5b [0104.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0104.640] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.640] GetFileType (hFile=0x154) returned 0x1 [0104.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0104.640] GetFileType (hFile=0x154) returned 0x1 [0104.640] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1632 [0104.640] ReadFile (in: hFile=0x154, lpBuffer=0x19cef04, nNumberOfBytesToRead=0x1632, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19cef04*, lpNumberOfBytesRead=0x2ae478*=0x1632, lpOverlapped=0x0) returned 1 [0104.642] CloseHandle (hObject=0x154) returned 1 [0104.654] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", lpFilePart=0x0) returned 0x5b [0104.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0104.654] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.656] GetFileType (hFile=0x154) returned 0x1 [0104.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0104.656] GetFileType (hFile=0x154) returned 0x1 [0104.656] WriteFile (in: hFile=0x154, lpBuffer=0x1a22d8c*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a22d8c*, lpNumberOfBytesWritten=0x2ae46c*=0x1640, lpOverlapped=0x0) returned 1 [0104.657] CloseHandle (hObject=0x154) returned 1 [0104.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", lpFilePart=0x0) returned 0x5b [0104.657] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.anonymous", lpFilePart=0x0) returned 0x65 [0104.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0104.657] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e3185a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe21ca9ab, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xdd51e7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1640)) returned 1 [0104.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0104.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.anonymous" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml.anonymous")) returned 1 [0104.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.658] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList", lpFilePart=0x0) returned 0x49 [0104.658] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\", lpFilePart=0x0) returned 0x4a [0104.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0104.659] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.659] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.659] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.659] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0104.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.659] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList", lpFilePart=0x0) returned 0x49 [0104.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\", lpFilePart=0x0) returned 0x4a [0104.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0104.659] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.660] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.660] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.660] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0104.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.660] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", lpFilePart=0x0) returned 0x54 [0104.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0104.660] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.660] GetFileType (hFile=0x154) returned 0x1 [0104.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0104.660] GetFileType (hFile=0x154) returned 0x1 [0104.660] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xda7 [0104.660] ReadFile (in: hFile=0x154, lpBuffer=0x1a270a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a270a4*, lpNumberOfBytesRead=0x2ae478*=0xda7, lpOverlapped=0x0) returned 1 [0104.677] CloseHandle (hObject=0x154) returned 1 [0104.689] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", lpFilePart=0x0) returned 0x54 [0104.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0104.689] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0104.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0104.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.691] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5", lpFilePart=0x0) returned 0x3e [0104.691] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpFilePart=0x0) returned 0x3f [0104.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0104.693] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.693] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.693] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.693] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.693] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.694] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.695] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.696] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.697] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0104.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5", lpFilePart=0x0) returned 0x3e [0104.698] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpFilePart=0x0) returned 0x3f [0104.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0104.699] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.699] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.699] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.699] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.700] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.701] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.702] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.703] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.703] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.703] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.703] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.703] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0104.703] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0104.703] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0104.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0104.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList", lpFilePart=0x0) returned 0x49 [0104.704] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", lpFilePart=0x0) returned 0x4a [0104.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec98 [0104.706] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.706] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.706] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.706] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.706] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList", lpFilePart=0x0) returned 0x49 [0104.706] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", lpFilePart=0x0) returned 0x4a [0104.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec98 [0104.706] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.707] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.707] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.707] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0104.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.707] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", lpFilePart=0x0) returned 0x5b [0104.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0104.707] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.708] GetFileType (hFile=0x154) returned 0x1 [0104.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0104.708] GetFileType (hFile=0x154) returned 0x1 [0104.708] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2fa0 [0104.708] ReadFile (in: hFile=0x154, lpBuffer=0x1a8500c, nNumberOfBytesToRead=0x2fa0, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a8500c*, lpNumberOfBytesRead=0x2ae478*=0x2fa0, lpOverlapped=0x0) returned 1 [0104.722] CloseHandle (hObject=0x154) returned 1 [0104.757] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", lpFilePart=0x0) returned 0x5b [0104.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0104.757] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0104.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0104.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList", lpFilePart=0x0) returned 0x49 [0104.759] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\", lpFilePart=0x0) returned 0x4a [0104.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0104.759] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.759] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.759] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.759] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0104.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0104.759] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList", lpFilePart=0x0) returned 0x49 [0104.760] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\", lpFilePart=0x0) returned 0x4a [0104.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0104.760] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.760] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0104.760] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0104.760] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0104.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0104.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0104.761] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", lpFilePart=0x0) returned 0x54 [0104.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0104.761] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.761] GetFileType (hFile=0x154) returned 0x1 [0104.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0104.761] GetFileType (hFile=0x154) returned 0x1 [0104.761] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xd76 [0104.761] ReadFile (in: hFile=0x154, lpBuffer=0x1ae6c90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae6c90*, lpNumberOfBytesRead=0x2ae478*=0xd76, lpOverlapped=0x0) returned 1 [0104.784] CloseHandle (hObject=0x154) returned 1 [0104.817] GetFullPathNameW (in: lpFileName="\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", lpFilePart=0x0) returned 0x54 [0104.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0104.817] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0104.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0104.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Uninstall Information", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Uninstall Information", lpFilePart=0x0) returned 0x26 [0104.819] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Uninstall Information\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Uninstall Information\\", lpFilePart=0x0) returned 0x27 [0104.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.819] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.819] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.819] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.819] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.819] GetFullPathNameW (in: lpFileName="\\Program Files\\Uninstall Information", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Uninstall Information", lpFilePart=0x0) returned 0x26 [0104.820] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Uninstall Information\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Uninstall Information\\", lpFilePart=0x0) returned 0x27 [0104.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.820] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.820] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.820] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.820] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.820] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Defender", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender", lpFilePart=0x0) returned 0x21 [0104.820] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender\\", lpFilePart=0x0) returned 0x22 [0104.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.821] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.822] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.822] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.822] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.822] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.822] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.823] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.823] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.823] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.823] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Defender", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender", lpFilePart=0x0) returned 0x21 [0104.823] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender\\", lpFilePart=0x0) returned 0x22 [0104.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.824] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.825] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.826] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.826] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Defender\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender\\en-US", lpFilePart=0x0) returned 0x27 [0104.826] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender\\en-US\\", lpFilePart=0x0) returned 0x28 [0104.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.826] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.826] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.826] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.826] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.827] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.827] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.827] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Defender\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender\\en-US", lpFilePart=0x0) returned 0x27 [0104.827] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Defender\\en-US\\", lpFilePart=0x0) returned 0x28 [0104.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.827] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.827] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.827] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.827] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.828] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.828] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.828] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Journal", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal", lpFilePart=0x0) returned 0x20 [0104.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\", lpFilePart=0x0) returned 0x21 [0104.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.828] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.828] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.828] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.829] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.830] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.830] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.830] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.830] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Journal", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal", lpFilePart=0x0) returned 0x20 [0104.830] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\", lpFilePart=0x0) returned 0x21 [0104.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.830] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.830] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.830] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.831] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.832] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.832] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.832] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.832] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.832] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.832] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.832] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Journal\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US", lpFilePart=0x0) returned 0x26 [0104.832] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\", lpFilePart=0x0) returned 0x27 [0104.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.834] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.834] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.834] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.834] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.834] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.835] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.835] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.835] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.835] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.835] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.836] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Journal\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US", lpFilePart=0x0) returned 0x26 [0104.836] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\", lpFilePart=0x0) returned 0x27 [0104.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.837] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.837] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.837] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.837] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.838] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.838] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.838] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.838] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.838] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.838] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.839] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Journal\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates", lpFilePart=0x0) returned 0x2a [0104.839] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\", lpFilePart=0x0) returned 0x2b [0104.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.869] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.882] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.883] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.884] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Journal\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates", lpFilePart=0x0) returned 0x2a [0104.884] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\", lpFilePart=0x0) returned 0x2b [0104.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.885] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.885] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.885] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.885] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.886] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.886] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.887] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Mail", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail", lpFilePart=0x0) returned 0x1d [0104.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail\\", lpFilePart=0x0) returned 0x1e [0104.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.915] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.915] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.916] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.916] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.923] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Mail", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail", lpFilePart=0x0) returned 0x1d [0104.943] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail\\", lpFilePart=0x0) returned 0x1e [0104.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.945] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.946] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.946] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.947] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Mail\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US", lpFilePart=0x0) returned 0x23 [0104.947] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US\\", lpFilePart=0x0) returned 0x24 [0104.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.949] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.949] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.950] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.950] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.950] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.950] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Mail\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US", lpFilePart=0x0) returned 0x23 [0104.950] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US\\", lpFilePart=0x0) returned 0x24 [0104.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.950] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.950] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.950] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.950] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.950] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.951] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player", lpFilePart=0x0) returned 0x25 [0104.951] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\", lpFilePart=0x0) returned 0x26 [0104.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.951] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.952] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.953] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.953] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.955] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.955] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.955] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.955] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.955] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.955] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0104.956] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player", lpFilePart=0x0) returned 0x25 [0104.956] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\", lpFilePart=0x0) returned 0x26 [0104.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.956] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.957] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0104.958] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0104.958] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0104.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0104.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.958] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\en-US", lpFilePart=0x0) returned 0x2b [0104.958] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\en-US\\", lpFilePart=0x0) returned 0x2c [0104.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.959] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.979] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.980] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.980] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\en-US", lpFilePart=0x0) returned 0x2b [0104.980] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\en-US\\", lpFilePart=0x0) returned 0x2c [0104.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.980] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.981] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.981] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.981] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.981] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.981] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Icons", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Icons", lpFilePart=0x0) returned 0x2b [0104.981] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Icons\\", lpFilePart=0x0) returned 0x2c [0104.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.981] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.981] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.981] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.981] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Icons", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Icons", lpFilePart=0x0) returned 0x2b [0104.981] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Icons\\", lpFilePart=0x0) returned 0x2c [0104.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.982] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.982] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.982] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.982] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Media Renderer", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Media Renderer", lpFilePart=0x0) returned 0x34 [0104.982] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpFilePart=0x0) returned 0x35 [0104.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.983] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.983] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.983] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.983] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.983] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.984] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.984] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.984] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0104.984] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0104.984] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0104.985] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Media Renderer", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Media Renderer", lpFilePart=0x0) returned 0x34 [0104.985] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpFilePart=0x0) returned 0x35 [0104.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0104.987] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0104.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0104.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0104.989] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml", lpFilePart=0x0) returned 0x44 [0104.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0104.989] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0104.991] GetFileType (hFile=0x154) returned 0x1 [0104.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0104.991] GetFileType (hFile=0x154) returned 0x1 [0104.991] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x4d82 [0105.016] CloseHandle (hObject=0x154) returned 1 [0105.054] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml", lpFilePart=0x0) returned 0x44 [0105.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0105.055] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad3a8) returned 1 [0105.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.056] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Network Sharing", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Network Sharing", lpFilePart=0x0) returned 0x35 [0105.056] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpFilePart=0x0) returned 0x36 [0105.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.058] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.059] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.061] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Network Sharing", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Network Sharing", lpFilePart=0x0) returned 0x35 [0105.061] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpFilePart=0x0) returned 0x36 [0105.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.063] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.064] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.064] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.064] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.064] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.065] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml", lpFilePart=0x0) returned 0x4b [0105.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0105.065] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.067] GetFileType (hFile=0x154) returned 0x1 [0105.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0105.067] GetFileType (hFile=0x154) returned 0x1 [0105.067] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x152e [0105.067] ReadFile (in: hFile=0x154, lpBuffer=0x19cf2d8, nNumberOfBytesToRead=0x152e, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19cf2d8*, lpNumberOfBytesRead=0x2ae5d4*=0x152e, lpOverlapped=0x0) returned 1 [0105.068] CloseHandle (hObject=0x154) returned 1 [0105.104] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml", lpFilePart=0x0) returned 0x4b [0105.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0105.104] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad3a8) returned 1 [0105.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.105] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Skins", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Skins", lpFilePart=0x0) returned 0x2b [0105.106] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Skins\\", lpFilePart=0x0) returned 0x2c [0105.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.106] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.106] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.106] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.106] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.106] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Skins", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Skins", lpFilePart=0x0) returned 0x2b [0105.106] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Skins\\", lpFilePart=0x0) returned 0x2c [0105.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.107] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.107] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.107] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.107] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.107] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Visualizations", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Visualizations", lpFilePart=0x0) returned 0x34 [0105.107] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Visualizations\\", lpFilePart=0x0) returned 0x35 [0105.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.108] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.108] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.108] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.108] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Media Player\\Visualizations", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Visualizations", lpFilePart=0x0) returned 0x34 [0105.108] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Media Player\\Visualizations\\", lpFilePart=0x0) returned 0x35 [0105.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.108] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.108] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.108] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.109] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT", lpFilePart=0x0) returned 0x1b [0105.109] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\", lpFilePart=0x0) returned 0x1c [0105.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbefd8 [0105.109] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.109] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.109] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.109] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.109] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.109] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.110] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT", lpFilePart=0x0) returned 0x1b [0105.110] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\", lpFilePart=0x0) returned 0x1c [0105.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbefd8 [0105.110] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.110] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.110] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.110] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.110] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.110] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.111] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\Accessories", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories", lpFilePart=0x0) returned 0x27 [0105.111] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\", lpFilePart=0x0) returned 0x28 [0105.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.111] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.111] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.111] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.111] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.111] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.111] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.112] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\Accessories", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories", lpFilePart=0x0) returned 0x27 [0105.112] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\", lpFilePart=0x0) returned 0x28 [0105.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.112] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.112] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.112] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.112] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.112] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.112] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.113] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\Accessories\\en-US", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US", lpFilePart=0x0) returned 0x2d [0105.113] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US\\", lpFilePart=0x0) returned 0x2e [0105.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0105.113] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.113] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.113] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.113] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.113] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\Accessories\\en-US", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US", lpFilePart=0x0) returned 0x2d [0105.113] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\Accessories\\en-US\\", lpFilePart=0x0) returned 0x2e [0105.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0105.114] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.114] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.114] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.114] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.114] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\TableTextService", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\TableTextService", lpFilePart=0x0) returned 0x2c [0105.114] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\TableTextService\\", lpFilePart=0x0) returned 0x2d [0105.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.114] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.115] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.116] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.116] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\TableTextService", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\TableTextService", lpFilePart=0x0) returned 0x2c [0105.116] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\TableTextService\\", lpFilePart=0x0) returned 0x2d [0105.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbefd8 [0105.116] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.116] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.116] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.116] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.117] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.117] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0105.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.118] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", lpFilePart=0x0) returned 0x48 [0105.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0105.118] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.118] GetFileType (hFile=0x154) returned 0x1 [0105.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0105.119] GetFileType (hFile=0x154) returned 0x1 [0105.119] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x3f54 [0105.119] ReadFile (in: hFile=0x154, lpBuffer=0x1a2de24, nNumberOfBytesToRead=0x3f54, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a2de24*, lpNumberOfBytesRead=0x2ae5d4*=0x3f54, lpOverlapped=0x0) returned 1 [0105.138] CloseHandle (hObject=0x154) returned 1 [0105.172] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt", lpFilePart=0x0) returned 0x48 [0105.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0105.172] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad3a8) returned 1 [0105.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.173] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Photo Viewer", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer", lpFilePart=0x0) returned 0x25 [0105.173] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\", lpFilePart=0x0) returned 0x26 [0105.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.175] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.175] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.175] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.175] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.175] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Photo Viewer", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer", lpFilePart=0x0) returned 0x25 [0105.175] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\", lpFilePart=0x0) returned 0x26 [0105.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0105.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.177] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.178] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Photo Viewer\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US", lpFilePart=0x0) returned 0x2b [0105.178] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\", lpFilePart=0x0) returned 0x2c [0105.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0105.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.179] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.179] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.179] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.179] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Photo Viewer\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US", lpFilePart=0x0) returned 0x2b [0105.179] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\", lpFilePart=0x0) returned 0x2c [0105.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0105.179] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.180] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.180] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Portable Devices", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Portable Devices", lpFilePart=0x0) returned 0x29 [0105.180] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Portable Devices\\", lpFilePart=0x0) returned 0x2a [0105.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0105.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.182] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.182] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Portable Devices", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Portable Devices", lpFilePart=0x0) returned 0x29 [0105.182] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Portable Devices\\", lpFilePart=0x0) returned 0x2a [0105.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0105.182] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.182] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.182] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.183] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.183] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.183] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar", lpFilePart=0x0) returned 0x20 [0105.183] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\", lpFilePart=0x0) returned 0x21 [0105.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0105.184] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.184] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.185] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.186] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar", lpFilePart=0x0) returned 0x20 [0105.186] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\", lpFilePart=0x0) returned 0x21 [0105.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbea98 [0105.187] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.188] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.189] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\en-US", lpFilePart=0x0) returned 0x26 [0105.189] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\en-US\\", lpFilePart=0x0) returned 0x27 [0105.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0105.191] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.191] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.191] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.191] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.192] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.192] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\en-US", lpFilePart=0x0) returned 0x26 [0105.192] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\en-US\\", lpFilePart=0x0) returned 0x27 [0105.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0105.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.192] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.193] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x28 [0105.193] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x29 [0105.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0105.194] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.194] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.194] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.195] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.196] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.196] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.197] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x28 [0105.197] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x29 [0105.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0105.198] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.198] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.198] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.198] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.199] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.199] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.200] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget", lpFilePart=0x0) returned 0x38 [0105.200] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\", lpFilePart=0x0) returned 0x39 [0105.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0105.201] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.202] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.202] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget", lpFilePart=0x0) returned 0x38 [0105.202] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\", lpFilePart=0x0) returned 0x39 [0105.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0105.202] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.203] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.203] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.203] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.203] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.203] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.203] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.203] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.203] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png", lpFilePart=0x0) returned 0x41 [0105.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.203] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.204] GetFileType (hFile=0x154) returned 0x1 [0105.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.204] GetFileType (hFile=0x154) returned 0x1 [0105.204] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1a74 [0105.204] ReadFile (in: hFile=0x154, lpBuffer=0x1aa0820, nNumberOfBytesToRead=0x1a74, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aa0820*, lpNumberOfBytesRead=0x2ae560*=0x1a74, lpOverlapped=0x0) returned 1 [0105.258] CloseHandle (hObject=0x154) returned 1 [0105.296] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png", lpFilePart=0x0) returned 0x41 [0105.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.296] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\calendar.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.297] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget", lpFilePart=0x0) returned 0x35 [0105.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\", lpFilePart=0x0) returned 0x36 [0105.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf2d8 [0105.304] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.304] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.305] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.305] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.305] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.305] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.305] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.305] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0105.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.305] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget", lpFilePart=0x0) returned 0x35 [0105.305] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\", lpFilePart=0x0) returned 0x36 [0105.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf2d8 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.306] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.306] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0105.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.307] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png", lpFilePart=0x0) returned 0x3e [0105.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.307] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.307] GetFileType (hFile=0x154) returned 0x1 [0105.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.307] GetFileType (hFile=0x154) returned 0x1 [0105.308] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5b85 [0105.308] ReadFile (in: hFile=0x154, lpBuffer=0x1af9c84, nNumberOfBytesToRead=0x5b85, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af9c84*, lpNumberOfBytesRead=0x2ae560*=0x5b85, lpOverlapped=0x0) returned 1 [0105.324] CloseHandle (hObject=0x154) returned 1 [0105.360] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png", lpFilePart=0x0) returned 0x3e [0105.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.360] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\clock.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.361] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget", lpFilePart=0x0) returned 0x33 [0105.361] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\", lpFilePart=0x0) returned 0x34 [0105.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.362] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.363] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0105.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.363] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget", lpFilePart=0x0) returned 0x33 [0105.363] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\", lpFilePart=0x0) returned 0x34 [0105.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0105.363] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.363] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.363] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.363] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.364] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.364] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.364] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.364] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0105.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.364] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png", lpFilePart=0x0) returned 0x3c [0105.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.364] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.366] GetFileType (hFile=0x154) returned 0x1 [0105.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.366] GetFileType (hFile=0x154) returned 0x1 [0105.366] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4f1c [0105.366] ReadFile (in: hFile=0x154, lpBuffer=0x1b6b688, nNumberOfBytesToRead=0x4f1c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b6b688*, lpNumberOfBytesRead=0x2ae560*=0x4f1c, lpOverlapped=0x0) returned 1 [0105.386] CloseHandle (hObject=0x154) returned 1 [0105.428] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png", lpFilePart=0x0) returned 0x3c [0105.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.428] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\cpu.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.429] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget", lpFilePart=0x0) returned 0x38 [0105.429] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\", lpFilePart=0x0) returned 0x39 [0105.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0105.430] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.431] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.431] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.431] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.431] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.431] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.431] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.431] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0105.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.431] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget", lpFilePart=0x0) returned 0x38 [0105.431] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\", lpFilePart=0x0) returned 0x39 [0105.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.432] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.432] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0105.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.433] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png", lpFilePart=0x0) returned 0x41 [0105.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.433] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.433] GetFileType (hFile=0x154) returned 0x1 [0105.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.434] GetFileType (hFile=0x154) returned 0x1 [0105.434] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x406b [0105.434] ReadFile (in: hFile=0x154, lpBuffer=0x19d1d98, nNumberOfBytesToRead=0x406b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19d1d98*, lpNumberOfBytesRead=0x2ae560*=0x406b, lpOverlapped=0x0) returned 1 [0105.449] CloseHandle (hObject=0x154) returned 1 [0105.486] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png", lpFilePart=0x0) returned 0x41 [0105.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.486] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\currency.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.487] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget", lpFilePart=0x0) returned 0x3b [0105.487] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\", lpFilePart=0x0) returned 0x3c [0105.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0105.492] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.492] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.492] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.492] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.492] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.492] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.493] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.493] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.493] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.493] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.493] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0105.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.494] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget", lpFilePart=0x0) returned 0x3b [0105.494] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\", lpFilePart=0x0) returned 0x3c [0105.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec98 [0105.495] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.495] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.495] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.495] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.496] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.496] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.496] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.496] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.496] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.496] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.496] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0105.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.497] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html", lpFilePart=0x0) returned 0x47 [0105.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.497] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.509] GetFileType (hFile=0x154) returned 0x1 [0105.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.509] GetFileType (hFile=0x154) returned 0x1 [0105.509] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x19f2 [0105.509] ReadFile (in: hFile=0x154, lpBuffer=0x1a3a270, nNumberOfBytesToRead=0x19f2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a3a270*, lpNumberOfBytesRead=0x2ae560*=0x19f2, lpOverlapped=0x0) returned 1 [0105.523] CloseHandle (hObject=0x154) returned 1 [0105.557] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html", lpFilePart=0x0) returned 0x47 [0105.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.558] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\flyout.html" (normalized: "c:\\program files\\windows sidebar\\gadgets\\mediacenter.gadget\\flyout.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.559] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget", lpFilePart=0x0) returned 0x3d [0105.559] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\", lpFilePart=0x0) returned 0x3e [0105.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec58 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.560] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.560] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0105.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.561] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget", lpFilePart=0x0) returned 0x3d [0105.561] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\", lpFilePart=0x0) returned 0x3e [0105.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec58 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.561] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.562] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0105.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.562] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png", lpFilePart=0x0) returned 0x46 [0105.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.562] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.562] GetFileType (hFile=0x154) returned 0x1 [0105.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.562] GetFileType (hFile=0x154) returned 0x1 [0105.563] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7a53 [0105.563] ReadFile (in: hFile=0x154, lpBuffer=0x1a936e4, nNumberOfBytesToRead=0x7a53, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a936e4*, lpNumberOfBytesRead=0x2ae560*=0x7a53, lpOverlapped=0x0) returned 1 [0105.578] CloseHandle (hObject=0x154) returned 1 [0105.627] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png", lpFilePart=0x0) returned 0x46 [0105.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.627] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\picturepuzzle.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.629] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget", lpFilePart=0x0) returned 0x38 [0105.629] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\", lpFilePart=0x0) returned 0x39 [0105.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0105.630] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.630] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.630] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.631] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.631] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.631] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.631] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.631] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0105.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.631] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget", lpFilePart=0x0) returned 0x38 [0105.631] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\", lpFilePart=0x0) returned 0x39 [0105.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0105.632] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.632] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.632] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.632] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.632] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.633] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.633] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.633] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0105.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.633] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png", lpFilePart=0x0) returned 0x41 [0105.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.633] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.634] GetFileType (hFile=0x154) returned 0x1 [0105.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.634] GetFileType (hFile=0x154) returned 0x1 [0105.634] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2141 [0105.634] ReadFile (in: hFile=0x154, lpBuffer=0x1b10bb8, nNumberOfBytesToRead=0x2141, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b10bb8*, lpNumberOfBytesRead=0x2ae560*=0x2141, lpOverlapped=0x0) returned 1 [0105.651] CloseHandle (hObject=0x154) returned 1 [0105.698] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png", lpFilePart=0x0) returned 0x41 [0105.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.698] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\rssfeeds.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.700] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget", lpFilePart=0x0) returned 0x39 [0105.700] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\", lpFilePart=0x0) returned 0x3a [0105.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0105.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.701] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.702] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.702] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.702] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.702] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget", lpFilePart=0x0) returned 0x39 [0105.702] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\", lpFilePart=0x0) returned 0x3a [0105.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0105.702] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.702] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.703] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.703] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0105.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.704] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png", lpFilePart=0x0) returned 0x42 [0105.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.704] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.704] GetFileType (hFile=0x154) returned 0x1 [0105.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.705] GetFileType (hFile=0x154) returned 0x1 [0105.705] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7575 [0105.705] ReadFile (in: hFile=0x154, lpBuffer=0x1b6ca78, nNumberOfBytesToRead=0x7575, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b6ca78*, lpNumberOfBytesRead=0x2ae560*=0x7575, lpOverlapped=0x0) returned 1 [0105.718] CloseHandle (hObject=0x154) returned 1 [0105.770] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png", lpFilePart=0x0) returned 0x42 [0105.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.770] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\slideshow.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.772] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget", lpFilePart=0x0) returned 0x37 [0105.772] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\", lpFilePart=0x0) returned 0x38 [0105.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0105.773] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.773] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.773] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.773] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.773] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.773] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.774] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.774] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0105.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.774] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget", lpFilePart=0x0) returned 0x37 [0105.774] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\", lpFilePart=0x0) returned 0x38 [0105.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.775] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.776] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0105.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.776] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png", lpFilePart=0x0) returned 0x40 [0105.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0105.776] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.777] GetFileType (hFile=0x154) returned 0x1 [0105.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0105.777] GetFileType (hFile=0x154) returned 0x1 [0105.777] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3260 [0105.777] ReadFile (in: hFile=0x154, lpBuffer=0x19e5574, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e5574*, lpNumberOfBytesRead=0x2ae560*=0x3260, lpOverlapped=0x0) returned 1 [0105.794] CloseHandle (hObject=0x154) returned 1 [0105.831] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png", lpFilePart=0x0) returned 0x40 [0105.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0105.831] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\drag.png" (normalized: "c:\\program files\\windows sidebar\\gadgets\\weather.gadget\\drag.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0105.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.833] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Shared Gadgets", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Shared Gadgets", lpFilePart=0x0) returned 0x2f [0105.833] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\", lpFilePart=0x0) returned 0x30 [0105.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.834] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.834] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.834] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.834] GetFullPathNameW (in: lpFileName="\\Program Files\\Windows Sidebar\\Shared Gadgets", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Shared Gadgets", lpFilePart=0x0) returned 0x2f [0105.834] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\", lpFilePart=0x0) returned 0x30 [0105.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.835] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0105.835] GetFullPathNameW (in: lpFileName="\\ProgramData", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0105.835] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0105.835] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbf258 [0105.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0105.837] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0105.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0105.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0105.838] GetFullPathNameW (in: lpFileName="\\ProgramData", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0105.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0105.838] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbf258 [0105.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0105.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0105.840] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0105.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0105.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.840] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0105.840] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15 [0105.840] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf258 [0105.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.842] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.842] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0105.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15 [0105.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf258 [0105.842] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.842] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.842] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.842] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.842] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0105.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d [0105.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.843] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.843] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0105.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d [0105.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.844] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.844] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0105.844] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22 [0105.844] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.845] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.845] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0105.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22 [0105.845] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.845] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.845] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.845] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.845] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.845] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0105.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c [0105.846] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.846] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.846] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.846] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.846] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.846] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0105.846] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c [0105.846] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.847] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.847] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.847] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.847] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0105.847] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0105.847] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35 [0105.847] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0105.847] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.847] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.848] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0105.848] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0105.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0105.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0105.848] GetFullPathNameW (in: lpFileName="\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0105.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35 [0105.848] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0105.848] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.848] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.848] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0105.848] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0105.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0105.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.849] GetFullPathNameW (in: lpFileName="\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f [0105.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\", lpFilePart=0x0) returned 0x20 [0105.849] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0105.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0105.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.850] GetFullPathNameW (in: lpFileName="\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16 [0105.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\", lpFilePart=0x0) returned 0x17 [0105.850] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0105.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0105.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.851] GetFullPathNameW (in: lpFileName="\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18 [0105.851] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\", lpFilePart=0x0) returned 0x19 [0105.851] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0105.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0105.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.853] GetFullPathNameW (in: lpFileName="\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18 [0105.853] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\", lpFilePart=0x0) returned 0x19 [0105.853] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0105.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0105.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.854] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0105.854] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19 [0105.854] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf258 [0105.854] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.855] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.856] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.857] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.858] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.858] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.858] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.858] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0105.858] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0105.858] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19 [0105.858] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf258 [0105.858] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.859] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.860] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.861] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.861] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.861] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.861] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0105.861] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0105.861] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0105.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0105.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.861] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0105.861] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24 [0105.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.862] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.862] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.862] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.862] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.862] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0105.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24 [0105.862] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.862] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.862] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.863] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.863] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.863] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0105.863] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b [0105.863] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.863] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.863] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.863] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.863] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.864] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0105.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b [0105.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.864] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.864] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.864] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.864] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.864] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0105.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f [0105.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.866] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.866] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0105.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f [0105.866] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.866] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.866] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.866] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.866] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0105.866] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0105.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35 [0105.867] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0105.905] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.905] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.905] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.905] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.906] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.906] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.906] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.906] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.906] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0105.906] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0105.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0105.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0105.907] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0105.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35 [0105.907] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0105.908] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.908] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0105.909] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0105.909] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0105.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0105.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.910] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0105.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0105.911] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.911] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.911] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.911] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.911] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.911] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.911] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.912] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0105.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0105.912] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.912] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.912] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.912] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.912] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.912] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.912] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.912] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0105.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0105.913] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.913] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.913] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.913] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.913] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.913] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0105.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0105.913] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.914] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.914] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.914] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.914] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.914] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0105.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0105.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.915] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.915] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.915] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.915] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0105.915] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0105.915] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.915] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.915] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.915] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.916] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0105.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0105.916] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.916] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.916] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.916] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.916] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0105.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0105.916] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.916] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.916] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.916] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.917] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0105.917] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0105.917] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.917] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.917] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.917] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.917] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.917] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.917] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0105.917] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0105.917] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.917] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.918] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.918] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0105.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0105.918] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.918] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.918] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0105.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0105.918] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.918] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.919] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.919] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0105.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0105.919] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.919] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.919] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.919] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.919] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.919] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0105.919] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0105.919] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.919] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.919] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.919] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.920] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.920] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0105.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0105.920] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.920] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.920] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.920] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.921] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0105.921] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0105.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0105.921] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0105.921] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0105.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0105.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.921] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0105.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0105.921] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.921] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.922] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.922] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.922] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0105.922] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0105.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0105.922] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0105.922] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.922] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.922] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0105.922] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0105.922] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0105.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0105.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.922] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0105.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0105.922] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.924] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.924] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.925] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0105.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0105.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0105.926] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.926] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.926] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.926] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.926] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.927] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.927] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.927] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0105.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.928] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0105.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0105.928] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.929] GetFileType (hFile=0x154) returned 0x1 [0105.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0105.929] GetFileType (hFile=0x154) returned 0x1 [0105.929] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1fad1 [0105.930] ReadFile (in: hFile=0x154, lpBuffer=0xbc8fea8, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xbc8fea8*, lpNumberOfBytesRead=0x2ae4ec*=0x1fad1, lpOverlapped=0x0) returned 1 [0105.933] CloseHandle (hObject=0x154) returned 1 [0105.967] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0105.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0105.967] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0105.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.969] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0105.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0105.969] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0105.970] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.970] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.970] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.970] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.970] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.971] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0105.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0105.971] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0105.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0105.971] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0105.971] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.971] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.971] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.972] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0105.972] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0105.972] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0105.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0105.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0105.972] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0105.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0105.972] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0105.973] GetFileType (hFile=0x154) returned 0x1 [0105.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0105.973] GetFileType (hFile=0x154) returned 0x1 [0105.973] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1fad1 [0105.974] ReadFile (in: hFile=0x154, lpBuffer=0xbd4e038, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0xbd4e038*, lpNumberOfBytesRead=0x2ae4ec*=0x1fad1, lpOverlapped=0x0) returned 1 [0105.994] CloseHandle (hObject=0x154) returned 1 [0106.041] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0106.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.041] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0106.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0106.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.042] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0106.043] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0106.043] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0106.043] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.044] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.044] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.044] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.044] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0106.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.044] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0106.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0106.044] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0106.044] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.045] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.045] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.045] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.045] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0106.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.045] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0106.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0106.045] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0106.062] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.062] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.062] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.063] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.063] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0106.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.064] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0106.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0106.065] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.066] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.067] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.067] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.067] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.067] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.067] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.067] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0106.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.068] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e [0106.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.070] GetFileType (hFile=0x154) returned 0x1 [0106.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.070] GetFileType (hFile=0x154) returned 0x1 [0106.070] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x536 [0106.070] ReadFile (in: hFile=0x154, lpBuffer=0x1b0b4fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b0b4fc*, lpNumberOfBytesRead=0x2ae4ec*=0x536, lpOverlapped=0x0) returned 1 [0106.072] CloseHandle (hObject=0x154) returned 1 [0106.107] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e [0106.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0106.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0106.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.109] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0106.109] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0106.109] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.111] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.112] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.112] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.112] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.112] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.112] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0106.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.113] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0106.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0106.113] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec98 [0106.114] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.114] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.114] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.114] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.115] FindNextFileW (in: hFindFile=0xbec98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.115] FindClose (in: hFindFile=0xbec98 | out: hFindFile=0xbec98) returned 1 [0106.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.116] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0106.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.116] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.118] GetFileType (hFile=0x154) returned 0x1 [0106.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.118] GetFileType (hFile=0x154) returned 0x1 [0106.118] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2c64 [0106.118] ReadFile (in: hFile=0x154, lpBuffer=0x1b5f100, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b5f100*, lpNumberOfBytesRead=0x2ae4ec*=0x2c64, lpOverlapped=0x0) returned 1 [0106.120] CloseHandle (hObject=0x154) returned 1 [0106.154] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0106.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0106.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0106.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.155] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0106.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0106.155] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0106.156] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.156] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.156] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0106.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.156] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0106.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0106.157] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0106.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.157] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0106.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.157] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0106.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0106.161] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.161] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.162] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.162] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.162] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.162] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0106.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0106.162] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.162] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.162] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.162] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.163] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.163] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0106.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0106.163] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.163] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.163] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.163] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.164] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0106.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0106.164] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.164] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.164] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.164] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.164] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e [0106.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f [0106.165] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.166] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.166] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.166] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.166] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.166] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e [0106.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f [0106.167] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.167] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.167] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.167] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.167] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.167] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23 [0106.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24 [0106.167] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.168] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.168] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.168] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.168] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23 [0106.168] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24 [0106.168] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.168] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.168] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.169] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.169] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0106.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0106.169] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.170] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.170] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.170] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.170] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.170] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0106.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0106.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.170] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.171] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.171] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.171] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.171] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0106.171] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0106.171] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.172] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.172] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.172] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.172] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.172] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0106.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0106.172] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.172] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.173] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.173] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.173] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.173] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0106.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0106.173] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.173] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.173] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.173] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.174] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0106.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0106.174] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.174] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.174] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.174] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\HTML Help", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\HTML Help", lpFilePart=0x0) returned 0x22 [0106.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\HTML Help\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\HTML Help\\", lpFilePart=0x0) returned 0x23 [0106.174] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\HTML Help\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.175] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.175] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.175] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.176] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\HTML Help", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\HTML Help", lpFilePart=0x0) returned 0x22 [0106.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\HTML Help\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\HTML Help\\", lpFilePart=0x0) returned 0x23 [0106.176] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\HTML Help\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.176] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.176] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.176] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0106.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0106.176] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.177] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.177] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0106.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0106.177] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.177] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.178] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.178] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25 [0106.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26 [0106.178] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.178] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.179] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.179] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.179] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25 [0106.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26 [0106.179] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.179] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.179] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.179] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.179] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b [0106.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c [0106.180] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.180] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.180] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.180] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b [0106.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c [0106.180] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.181] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.181] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.181] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d [0106.181] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e [0106.181] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.182] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.182] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.182] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.182] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.182] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d [0106.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e [0106.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.183] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.183] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.183] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.183] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.183] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21 [0106.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22 [0106.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.184] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.184] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.184] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.184] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21 [0106.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22 [0106.184] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.184] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.184] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.184] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.184] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25 [0106.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26 [0106.185] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.185] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.186] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.186] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.186] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25 [0106.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26 [0106.186] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.186] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.186] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.186] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.186] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.187] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35 [0106.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36 [0106.187] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.188] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.188] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35 [0106.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36 [0106.188] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.188] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.188] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.189] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20 [0106.189] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21 [0106.189] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.189] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.189] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.189] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.189] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.189] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.190] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20 [0106.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21 [0106.190] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.190] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.190] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.190] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.190] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.190] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.191] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c [0106.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d [0106.191] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.191] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.191] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.191] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.191] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c [0106.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d [0106.191] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.192] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.192] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b [0106.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c [0106.192] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.192] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.193] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.193] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.193] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.193] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.193] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b [0106.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c [0106.193] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.193] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.193] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.193] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.194] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.194] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.194] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f [0106.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20 [0106.194] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.208] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.209] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.209] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.210] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f [0106.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20 [0106.210] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.211] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.212] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.212] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.213] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a [0106.213] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b [0106.213] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.214] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.214] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.214] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.214] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.214] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.214] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a [0106.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b [0106.214] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.215] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.215] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.215] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.215] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.215] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.215] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f [0106.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30 [0106.215] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.235] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.236] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.237] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.238] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.238] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.239] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f [0106.239] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30 [0106.239] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.240] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.241] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.242] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.242] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.243] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f [0106.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30 [0106.243] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.250] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.251] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.252] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.252] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.253] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f [0106.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30 [0106.253] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.254] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.255] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.255] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.256] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39 [0106.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a [0106.256] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.257] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.257] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.257] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.257] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.257] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39 [0106.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a [0106.257] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.257] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.258] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f [0106.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40 [0106.258] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.258] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.258] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f [0106.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40 [0106.258] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.258] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.258] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c [0106.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d [0106.259] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.259] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.259] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c [0106.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d [0106.259] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.259] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.259] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25 [0106.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26 [0106.259] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.260] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.260] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25 [0106.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26 [0106.260] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.260] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.260] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a [0106.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b [0106.260] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.260] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.260] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a [0106.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b [0106.261] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.261] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.261] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26 [0106.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27 [0106.261] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.261] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.261] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26 [0106.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27 [0106.261] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.261] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.262] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21 [0106.262] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22 [0106.262] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.262] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.262] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21 [0106.262] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22 [0106.262] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.262] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.262] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f [0106.262] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20 [0106.262] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.263] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.263] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.263] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea98 [0106.264] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.264] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.264] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.265] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0106.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0106.288] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0106.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0106.289] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea98 [0106.290] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0106.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0106.291] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0106.293] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0106.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0106.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0106.293] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0106.293] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0106.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0106.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0106.294] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0106.295] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0106.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0106.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0106.295] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0106.295] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0106.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0106.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0106.295] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0106.296] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0106.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0106.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0106.296] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0106.296] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0106.297] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0106.297] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0106.297] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0106.297] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0106.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0106.297] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0106.298] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0106.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0106.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0106.298] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0106.298] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0106.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0106.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0106.298] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0106.305] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0106.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0106.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0106.305] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0106.305] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0106.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0106.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0106.306] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea98 [0106.316] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0106.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0106.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0106.317] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea98 [0106.318] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0106.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0106.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0106.319] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0106.319] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0106.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0106.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0106.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0106.320] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0106.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0106.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0106.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0106.321] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0106.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0106.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0106.321] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea98 [0106.321] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.321] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.321] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.321] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea98 [0106.322] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.322] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea98 [0106.322] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0106.322] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.322] GetFileType (hFile=0x154) returned 0x1 [0106.322] GetFileType (hFile=0x154) returned 0x1 [0106.322] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xc038 [0106.340] CloseHandle (hObject=0x154) returned 1 [0106.370] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.371] GetFileType (hFile=0x154) returned 0x1 [0106.371] GetFileType (hFile=0x154) returned 0x1 [0106.371] WriteFile (in: hFile=0x154, lpBuffer=0x1a24440*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a24440*, lpNumberOfBytesWritten=0x2ae5c8*=0xc040, lpOverlapped=0x0) returned 1 [0106.373] CloseHandle (hObject=0x154) returned 1 [0106.373] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d7a1c3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xde57bef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc040)) returned 1 [0106.374] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.anonymous" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.anonymous")) returned 1 [0106.374] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.374] GetFileType (hFile=0x154) returned 0x1 [0106.374] GetFileType (hFile=0x154) returned 0x1 [0106.375] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xc038 [0106.376] CloseHandle (hObject=0x154) returned 1 [0106.391] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.393] GetFileType (hFile=0x154) returned 0x1 [0106.393] GetFileType (hFile=0x154) returned 0x1 [0106.393] WriteFile (in: hFile=0x154, lpBuffer=0x1aa16f8*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1aa16f8*, lpNumberOfBytesWritten=0x2ae5c8*=0xc040, lpOverlapped=0x0) returned 1 [0106.395] CloseHandle (hObject=0x154) returned 1 [0106.395] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d7a1c3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xde5a2050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc040)) returned 1 [0106.395] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.anonymous" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.anonymous")) returned 1 [0106.396] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0106.397] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0106.398] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed98 [0106.399] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0106.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.402] GetFileType (hFile=0x154) returned 0x1 [0106.402] GetFileType (hFile=0x154) returned 0x1 [0106.402] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc038 [0106.423] CloseHandle (hObject=0x154) returned 1 [0106.438] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0106.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0106.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.439] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e [0106.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f [0106.439] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0106.440] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.440] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.440] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.440] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e [0106.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f [0106.440] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0106.440] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.441] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.441] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.441] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e [0106.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f [0106.441] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0106.441] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.441] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.441] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.442] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e [0106.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f [0106.442] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0106.442] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.442] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.442] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.442] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows", lpFilePart=0x0) returned 0x20 [0106.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x21 [0106.442] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0106.442] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.443] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.444] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.444] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.444] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.444] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.444] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0106.444] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows", lpFilePart=0x0) returned 0x20 [0106.444] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x21 [0106.444] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.445] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.446] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.446] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.446] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.446] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.446] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0106.446] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0106.446] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0106.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0106.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.446] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x24 [0106.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x25 [0106.446] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.447] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.447] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.447] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.447] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x24 [0106.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x25 [0106.447] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.447] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.447] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.448] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.448] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x27 [0106.448] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x28 [0106.448] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.448] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.448] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.448] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.448] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.448] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.449] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.449] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.449] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.449] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.449] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.449] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.449] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x27 [0106.449] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x28 [0106.449] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.449] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.450] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.451] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.451] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.451] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x34 [0106.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x35 [0106.451] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.451] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.451] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.452] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.452] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.452] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x34 [0106.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x35 [0106.452] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.452] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.452] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.452] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.452] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.453] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3a [0106.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3b [0106.453] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0106.453] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.454] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.454] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.454] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.454] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.454] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3a [0106.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3b [0106.454] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0106.454] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.454] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.454] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.455] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.455] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.455] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x24 [0106.455] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x25 [0106.455] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.455] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.455] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.456] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.456] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.456] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.456] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.456] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.456] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.456] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x24 [0106.457] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x25 [0106.457] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.457] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.457] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.457] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.457] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.458] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.458] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.458] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.458] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.458] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2a [0106.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2b [0106.458] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0106.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.459] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.459] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2a [0106.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2b [0106.459] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0106.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.460] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.460] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x2d [0106.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x2e [0106.460] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.461] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.461] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.461] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.461] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x2d [0106.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x2e [0106.461] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.461] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.462] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.462] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.462] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x3d [0106.462] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x3e [0106.462] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.476] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.476] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.476] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.476] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.477] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.477] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.477] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.477] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.477] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.478] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x3d [0106.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x3e [0106.478] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0106.479] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.479] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.479] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.480] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.480] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.480] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.480] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.480] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.480] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0106.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.481] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml", lpFilePart=0x0) returned 0x5a [0106.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0106.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-05.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.491] GetFileType (hFile=0x154) returned 0x1 [0106.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0106.491] GetFileType (hFile=0x154) returned 0x1 [0106.491] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x704f [0106.491] ReadFile (in: hFile=0x154, lpBuffer=0x1b4674c, nNumberOfBytesToRead=0x704f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b4674c*, lpNumberOfBytesRead=0x2ae560*=0x704f, lpOverlapped=0x0) returned 1 [0106.504] CloseHandle (hObject=0x154) returned 1 [0106.544] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml", lpFilePart=0x0) returned 0x5a [0106.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0106.544] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-05.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.546] GetFileType (hFile=0x154) returned 0x1 [0106.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0106.546] GetFileType (hFile=0x154) returned 0x1 [0106.546] WriteFile (in: hFile=0x154, lpBuffer=0x19bdd00*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19bdd00*, lpNumberOfBytesWritten=0x2ae554*=0x7050, lpOverlapped=0x0) returned 1 [0106.547] CloseHandle (hObject=0x154) returned 1 [0106.548] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml", lpFilePart=0x0) returned 0x5a [0106.548] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml.anonymous", lpFilePart=0x0) returned 0x64 [0106.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0106.548] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-05.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd048af20, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0xd048af20, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0xde71ee10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7050)) returned 1 [0106.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.548] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-05.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-05.xml.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-05.xml.anonymous")) returned 1 [0106.549] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml", lpFilePart=0x0) returned 0x5a [0106.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0106.549] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-21.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.549] GetFileType (hFile=0x154) returned 0x1 [0106.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0106.549] GetFileType (hFile=0x154) returned 0x1 [0106.549] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3eb7 [0106.550] ReadFile (in: hFile=0x154, lpBuffer=0x19c52b4, nNumberOfBytesToRead=0x3eb7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19c52b4*, lpNumberOfBytesRead=0x2ae560*=0x3eb7, lpOverlapped=0x0) returned 1 [0106.571] CloseHandle (hObject=0x154) returned 1 [0106.605] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml", lpFilePart=0x0) returned 0x5a [0106.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0106.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-21.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.606] GetFileType (hFile=0x154) returned 0x1 [0106.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0106.606] GetFileType (hFile=0x154) returned 0x1 [0106.606] WriteFile (in: hFile=0x154, lpBuffer=0x1a25bbc*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a25bbc*, lpNumberOfBytesWritten=0x2ae554*=0x3ec0, lpOverlapped=0x0) returned 1 [0106.608] CloseHandle (hObject=0x154) returned 1 [0106.608] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml", lpFilePart=0x0) returned 0x5a [0106.608] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml.anonymous", lpFilePart=0x0) returned 0x64 [0106.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0106.608] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-21.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7202b9f0, ftCreationTime.dwHighDateTime=0x1d30232, ftLastAccessTime.dwLowDateTime=0x7202b9f0, ftLastAccessTime.dwHighDateTime=0x1d30232, ftLastWriteTime.dwLowDateTime=0xde7b7390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0)) returned 1 [0106.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.608] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-21.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-21.xml.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-21.xml.anonymous")) returned 1 [0106.609] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", lpFilePart=0x0) returned 0x56 [0106.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0106.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.609] GetFileType (hFile=0x154) returned 0x1 [0106.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0106.609] GetFileType (hFile=0x154) returned 0x1 [0106.609] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3eb7 [0106.609] ReadFile (in: hFile=0x154, lpBuffer=0x1a29fd0, nNumberOfBytesToRead=0x3eb7, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a29fd0*, lpNumberOfBytesRead=0x2ae560*=0x3eb7, lpOverlapped=0x0) returned 1 [0106.620] CloseHandle (hObject=0x154) returned 1 [0106.633] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", lpFilePart=0x0) returned 0x56 [0106.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0106.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.635] GetFileType (hFile=0x154) returned 0x1 [0106.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0106.635] GetFileType (hFile=0x154) returned 0x1 [0106.635] WriteFile (in: hFile=0x154, lpBuffer=0x1a8a77c*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a8a77c*, lpNumberOfBytesWritten=0x2ae554*=0x3ec0, lpOverlapped=0x0) returned 1 [0106.636] CloseHandle (hObject=0x154) returned 1 [0106.636] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml", lpFilePart=0x0) returned 0x56 [0106.636] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.anonymous", lpFilePart=0x0) returned 0x60 [0106.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0106.636] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe716c0, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0xcfe716c0, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0xde803650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0)) returned 1 [0106.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.637] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml.anonymous")) returned 1 [0106.637] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFilePart=0x0) returned 0x50 [0106.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0106.637] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.638] GetFileType (hFile=0x154) returned 0x1 [0106.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0106.638] GetFileType (hFile=0x154) returned 0x1 [0106.638] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3344 [0106.638] ReadFile (in: hFile=0x154, lpBuffer=0x1a8eb50, nNumberOfBytesToRead=0x3344, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a8eb50*, lpNumberOfBytesRead=0x2ae560*=0x3344, lpOverlapped=0x0) returned 1 [0106.640] CloseHandle (hObject=0x154) returned 1 [0106.652] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFilePart=0x0) returned 0x50 [0106.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0106.652] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.653] GetFileType (hFile=0x154) returned 0x1 [0106.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0106.653] GetFileType (hFile=0x154) returned 0x1 [0106.653] WriteFile (in: hFile=0x154, lpBuffer=0x1aeb9c8*, nNumberOfBytesToWrite=0x3350, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aeb9c8*, lpNumberOfBytesWritten=0x2ae554*=0x3350, lpOverlapped=0x0) returned 1 [0106.655] CloseHandle (hObject=0x154) returned 1 [0106.655] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFilePart=0x0) returned 0x50 [0106.655] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.anonymous", lpFilePart=0x0) returned 0x5a [0106.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0106.655] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d47720, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0xd6d47720, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0xde8297b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3350)) returned 1 [0106.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.655] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.anonymous")) returned 1 [0106.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.656] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2a [0106.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2b [0106.656] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0106.657] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.658] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.659] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.659] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.659] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.660] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2a [0106.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2b [0106.660] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0106.661] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.661] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.661] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.662] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.662] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.662] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.662] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.662] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.662] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.663] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.663] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.663] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.663] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.663] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.665] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm", lpFilePart=0x0) returned 0x24 [0106.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", lpFilePart=0x0) returned 0x25 [0106.665] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0106.665] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.665] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.665] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.666] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.666] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.666] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.666] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm", lpFilePart=0x0) returned 0x24 [0106.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", lpFilePart=0x0) returned 0x25 [0106.666] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0106.666] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.666] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.666] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.667] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.667] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.667] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.667] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", lpFilePart=0x0) returned 0x2d [0106.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", lpFilePart=0x0) returned 0x2e [0106.667] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf098 [0106.668] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.668] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.668] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.668] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", lpFilePart=0x0) returned 0x2d [0106.668] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", lpFilePart=0x0) returned 0x2e [0106.668] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf098 [0106.668] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.669] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.669] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.669] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", lpFilePart=0x0) returned 0x2d [0106.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", lpFilePart=0x0) returned 0x2e [0106.669] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf098 [0106.669] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.669] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.669] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.669] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", lpFilePart=0x0) returned 0x2d [0106.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", lpFilePart=0x0) returned 0x2e [0106.670] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf098 [0106.670] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.670] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.670] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.670] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", lpFilePart=0x0) returned 0x2b [0106.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", lpFilePart=0x0) returned 0x2c [0106.670] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf098 [0106.670] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.671] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.671] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.671] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", lpFilePart=0x0) returned 0x2b [0106.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", lpFilePart=0x0) returned 0x2c [0106.671] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf098 [0106.671] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.671] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.671] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.671] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x2b [0106.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x2c [0106.672] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0106.672] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.672] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.672] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.672] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.672] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.672] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.672] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0106.672] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x2b [0106.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x2c [0106.673] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0106.673] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.673] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.673] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.673] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.673] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0106.673] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0106.673] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0106.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0106.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0106.673] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", lpFilePart=0x0) returned 0x40 [0106.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0106.674] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.674] GetFileType (hFile=0x154) returned 0x1 [0106.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0106.674] GetFileType (hFile=0x154) returned 0x1 [0106.674] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x502 [0106.674] ReadFile (in: hFile=0x154, lpBuffer=0x1af8e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af8e68*, lpNumberOfBytesRead=0x2ae560*=0x502, lpOverlapped=0x0) returned 1 [0106.684] CloseHandle (hObject=0x154) returned 1 [0106.697] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", lpFilePart=0x0) returned 0x40 [0106.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0106.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.699] GetFileType (hFile=0x154) returned 0x1 [0106.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0106.699] GetFileType (hFile=0x154) returned 0x1 [0106.699] WriteFile (in: hFile=0x154, lpBuffer=0x1b486e0*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b486e0*, lpNumberOfBytesWritten=0x2ae528*=0x510, lpOverlapped=0x0) returned 1 [0106.700] CloseHandle (hObject=0x154) returned 1 [0106.700] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", lpFilePart=0x0) returned 0x40 [0106.701] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.anonymous", lpFilePart=0x0) returned 0x4a [0106.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0106.701] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112b4ab2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x112b4ab2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xde89bbd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0106.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.701] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk.anonymous")) returned 1 [0106.702] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", lpFilePart=0x0) returned 0x3e [0106.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0106.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.702] GetFileType (hFile=0x154) returned 0x1 [0106.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0106.702] GetFileType (hFile=0x154) returned 0x1 [0106.702] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4f2 [0106.702] ReadFile (in: hFile=0x154, lpBuffer=0x1b49f0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b49f0c*, lpNumberOfBytesRead=0x2ae560*=0x4f2, lpOverlapped=0x0) returned 1 [0106.705] CloseHandle (hObject=0x154) returned 1 [0106.737] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", lpFilePart=0x0) returned 0x3e [0106.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0106.737] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.739] GetFileType (hFile=0x154) returned 0x1 [0106.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0106.739] GetFileType (hFile=0x154) returned 0x1 [0106.739] WriteFile (in: hFile=0x154, lpBuffer=0x19a83f4*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x19a83f4*, lpNumberOfBytesWritten=0x2ae528*=0x500, lpOverlapped=0x0) returned 1 [0106.740] CloseHandle (hObject=0x154) returned 1 [0106.741] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", lpFilePart=0x0) returned 0x3e [0106.741] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.anonymous", lpFilePart=0x0) returned 0x48 [0106.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0106.741] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd426c681, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0xd426c681, ftLastAccessTime.dwHighDateTime=0x1ca043c, ftLastWriteTime.dwLowDateTime=0xde8e7e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0106.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.742] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk.anonymous")) returned 1 [0106.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.743] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x34 [0106.743] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x35 [0106.743] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0106.743] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.743] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.744] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.745] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.746] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.746] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.746] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.746] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0106.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0106.746] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x34 [0106.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x35 [0106.746] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0106.746] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.747] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.748] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.749] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.749] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.749] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0106.749] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0106.749] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0106.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0106.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0106.749] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", lpFilePart=0x0) returned 0x47 [0106.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.749] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.750] GetFileType (hFile=0x154) returned 0x1 [0106.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.750] GetFileType (hFile=0x154) returned 0x1 [0106.750] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x989 [0106.750] ReadFile (in: hFile=0x154, lpBuffer=0x19af600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19af600*, lpNumberOfBytesRead=0x2ae4ec*=0x989, lpOverlapped=0x0) returned 1 [0106.771] CloseHandle (hObject=0x154) returned 1 [0106.782] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", lpFilePart=0x0) returned 0x47 [0106.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.782] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.784] GetFileType (hFile=0x154) returned 0x1 [0106.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0106.784] GetFileType (hFile=0x154) returned 0x1 [0106.784] WriteFile (in: hFile=0x154, lpBuffer=0x1a00654*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a00654*, lpNumberOfBytesWritten=0x2ae4b4*=0x990, lpOverlapped=0x0) returned 1 [0106.785] CloseHandle (hObject=0x154) returned 1 [0106.786] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", lpFilePart=0x0) returned 0x47 [0106.786] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0106.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0106.786] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f02380, ftCreationTime.dwHighDateTime=0x1d2da17, ftLastAccessTime.dwLowDateTime=0xe1f02380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xde95a2b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1 [0106.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.786] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.anonymous")) returned 1 [0106.787] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", lpFilePart=0x0) returned 0x46 [0106.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.787] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.787] GetFileType (hFile=0x154) returned 0x1 [0106.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.788] GetFileType (hFile=0x154) returned 0x1 [0106.788] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x8a3 [0106.788] ReadFile (in: hFile=0x154, lpBuffer=0x1a02260, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a02260*, lpNumberOfBytesRead=0x2ae4ec*=0x8a3, lpOverlapped=0x0) returned 1 [0106.812] CloseHandle (hObject=0x154) returned 1 [0106.826] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", lpFilePart=0x0) returned 0x46 [0106.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.826] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.827] GetFileType (hFile=0x154) returned 0x1 [0106.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0106.827] GetFileType (hFile=0x154) returned 0x1 [0106.827] WriteFile (in: hFile=0x154, lpBuffer=0x1a52cfc*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a52cfc*, lpNumberOfBytesWritten=0x2ae4b4*=0x8b0, lpOverlapped=0x0) returned 1 [0106.828] CloseHandle (hObject=0x154) returned 1 [0106.829] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", lpFilePart=0x0) returned 0x46 [0106.829] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0106.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0106.829] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21b3df0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe21b3df0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xde9cc6d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1 [0106.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.829] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.anonymous")) returned 1 [0106.830] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", lpFilePart=0x0) returned 0x45 [0106.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.830] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.831] GetFileType (hFile=0x154) returned 0x1 [0106.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.831] GetFileType (hFile=0x154) returned 0x1 [0106.831] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x541 [0106.831] ReadFile (in: hFile=0x154, lpBuffer=0x1a5458c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a5458c*, lpNumberOfBytesRead=0x2ae4ec*=0x541, lpOverlapped=0x0) returned 1 [0106.832] CloseHandle (hObject=0x154) returned 1 [0106.844] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", lpFilePart=0x0) returned 0x45 [0106.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.844] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.845] GetFileType (hFile=0x154) returned 0x1 [0106.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0106.846] GetFileType (hFile=0x154) returned 0x1 [0106.846] WriteFile (in: hFile=0x154, lpBuffer=0x1aa3f44*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1aa3f44*, lpNumberOfBytesWritten=0x2ae4b4*=0x550, lpOverlapped=0x0) returned 1 [0106.847] CloseHandle (hObject=0x154) returned 1 [0106.847] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", lpFilePart=0x0) returned 0x45 [0106.847] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0106.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0106.847] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed7b8cc0, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xed7b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xde9f2830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0106.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.847] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk.anonymous")) returned 1 [0106.848] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x48 [0106.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.848] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.849] GetFileType (hFile=0x154) returned 0x1 [0106.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.849] GetFileType (hFile=0x154) returned 0x1 [0106.849] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x463 [0106.849] ReadFile (in: hFile=0x154, lpBuffer=0x1aa56f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aa56f4*, lpNumberOfBytesRead=0x2ae4ec*=0x463, lpOverlapped=0x0) returned 1 [0106.880] CloseHandle (hObject=0x154) returned 1 [0106.906] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x48 [0106.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.906] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.908] GetFileType (hFile=0x154) returned 0x1 [0106.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0106.908] GetFileType (hFile=0x154) returned 0x1 [0106.908] WriteFile (in: hFile=0x154, lpBuffer=0x1af4c58*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1af4c58*, lpNumberOfBytesWritten=0x2ae4b4*=0x470, lpOverlapped=0x0) returned 1 [0106.909] CloseHandle (hObject=0x154) returned 1 [0106.909] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x48 [0106.909] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0106.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0106.909] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77031ab0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x77057c10, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xdea8adb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x470)) returned 1 [0106.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.909] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.anonymous")) returned 1 [0106.911] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", lpFilePart=0x0) returned 0x40 [0106.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.911] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.911] GetFileType (hFile=0x154) returned 0x1 [0106.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.911] GetFileType (hFile=0x154) returned 0x1 [0106.911] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x532 [0106.911] ReadFile (in: hFile=0x154, lpBuffer=0x1af64d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1af64d0*, lpNumberOfBytesRead=0x2ae4ec*=0x532, lpOverlapped=0x0) returned 1 [0106.926] CloseHandle (hObject=0x154) returned 1 [0106.984] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", lpFilePart=0x0) returned 0x40 [0106.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0106.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.986] GetFileType (hFile=0x154) returned 0x1 [0106.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0106.986] GetFileType (hFile=0x154) returned 0x1 [0106.986] WriteFile (in: hFile=0x154, lpBuffer=0x1b45e24*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b45e24*, lpNumberOfBytesWritten=0x2ae4b4*=0x540, lpOverlapped=0x0) returned 1 [0106.987] CloseHandle (hObject=0x154) returned 1 [0106.987] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", lpFilePart=0x0) returned 0x40 [0106.987] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.anonymous", lpFilePart=0x0) returned 0x4a [0106.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0106.987] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e4ae24a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7e4ae24a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdeb49490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0106.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0106.988] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.anonymous")) returned 1 [0106.989] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", lpFilePart=0x0) returned 0x50 [0106.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0106.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0106.989] GetFileType (hFile=0x154) returned 0x1 [0106.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0106.989] GetFileType (hFile=0x154) returned 0x1 [0106.989] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x548 [0106.989] ReadFile (in: hFile=0x154, lpBuffer=0x1b476c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b476c0*, lpNumberOfBytesRead=0x2ae4ec*=0x548, lpOverlapped=0x0) returned 1 [0106.991] CloseHandle (hObject=0x154) returned 1 [0107.087] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", lpFilePart=0x0) returned 0x50 [0107.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0107.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.089] GetFileType (hFile=0x154) returned 0x1 [0107.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0107.089] GetFileType (hFile=0x154) returned 0x1 [0107.089] WriteFile (in: hFile=0x154, lpBuffer=0x1999170*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1999170*, lpNumberOfBytesWritten=0x2ae4b4*=0x550, lpOverlapped=0x0) returned 1 [0107.090] CloseHandle (hObject=0x154) returned 1 [0107.090] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", lpFilePart=0x0) returned 0x50 [0107.090] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0107.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0107.091] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ecb6c98, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7ecb6c98, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdec53e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0107.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.091] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.anonymous")) returned 1 [0107.092] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", lpFilePart=0x0) returned 0x4a [0107.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0107.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.092] GetFileType (hFile=0x154) returned 0x1 [0107.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0107.092] GetFileType (hFile=0x154) returned 0x1 [0107.092] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x52e [0107.092] ReadFile (in: hFile=0x154, lpBuffer=0x199aa3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x199aa3c*, lpNumberOfBytesRead=0x2ae4ec*=0x52e, lpOverlapped=0x0) returned 1 [0107.099] CloseHandle (hObject=0x154) returned 1 [0107.117] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", lpFilePart=0x0) returned 0x4a [0107.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0107.117] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.119] GetFileType (hFile=0x154) returned 0x1 [0107.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0107.119] GetFileType (hFile=0x154) returned 0x1 [0107.119] WriteFile (in: hFile=0x154, lpBuffer=0x19ea4b8*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19ea4b8*, lpNumberOfBytesWritten=0x2ae4b4*=0x530, lpOverlapped=0x0) returned 1 [0107.120] CloseHandle (hObject=0x154) returned 1 [0107.120] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", lpFilePart=0x0) returned 0x4a [0107.120] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0107.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0107.120] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea595d60, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xea595d60, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdeca00f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0107.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.121] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.anonymous")) returned 1 [0107.122] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", lpFilePart=0x0) returned 0x4d [0107.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0107.122] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.122] GetFileType (hFile=0x154) returned 0x1 [0107.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0107.122] GetFileType (hFile=0x154) returned 0x1 [0107.122] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x4ba [0107.122] ReadFile (in: hFile=0x154, lpBuffer=0x19ebcf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19ebcf8*, lpNumberOfBytesRead=0x2ae4ec*=0x4ba, lpOverlapped=0x0) returned 1 [0107.140] CloseHandle (hObject=0x154) returned 1 [0107.154] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", lpFilePart=0x0) returned 0x4d [0107.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0107.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.156] GetFileType (hFile=0x154) returned 0x1 [0107.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0107.156] GetFileType (hFile=0x154) returned 0x1 [0107.156] WriteFile (in: hFile=0x154, lpBuffer=0x1a3b3f8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a3b3f8*, lpNumberOfBytesWritten=0x2ae4b4*=0x4c0, lpOverlapped=0x0) returned 1 [0107.157] CloseHandle (hObject=0x154) returned 1 [0107.157] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", lpFilePart=0x0) returned 0x4d [0107.157] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.anonymous", lpFilePart=0x0) returned 0x57 [0107.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0107.158] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b74de96, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7b74de96, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdecec3b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4c0)) returned 1 [0107.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.158] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.anonymous")) returned 1 [0107.159] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x4d [0107.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0107.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.159] GetFileType (hFile=0x154) returned 0x1 [0107.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0107.160] GetFileType (hFile=0x154) returned 0x1 [0107.160] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5eb [0107.160] ReadFile (in: hFile=0x154, lpBuffer=0x1a3cd74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a3cd74*, lpNumberOfBytesRead=0x2ae4ec*=0x5eb, lpOverlapped=0x0) returned 1 [0107.179] CloseHandle (hObject=0x154) returned 1 [0107.194] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x4d [0107.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0107.194] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.195] GetFileType (hFile=0x154) returned 0x1 [0107.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0107.196] GetFileType (hFile=0x154) returned 0x1 [0107.196] WriteFile (in: hFile=0x154, lpBuffer=0x1a8ca64*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a8ca64*, lpNumberOfBytesWritten=0x2ae4b4*=0x5f0, lpOverlapped=0x0) returned 1 [0107.197] CloseHandle (hObject=0x154) returned 1 [0107.197] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x4d [0107.197] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.anonymous", lpFilePart=0x0) returned 0x57 [0107.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0107.197] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1172b3fa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x1172b3fa, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xded5e7d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f0)) returned 1 [0107.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.197] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.anonymous")) returned 1 [0107.199] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", lpFilePart=0x0) returned 0x43 [0107.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0107.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.199] GetFileType (hFile=0x154) returned 0x1 [0107.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0107.199] GetFileType (hFile=0x154) returned 0x1 [0107.199] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x4de [0107.199] ReadFile (in: hFile=0x154, lpBuffer=0x1a8e2ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a8e2ac*, lpNumberOfBytesRead=0x2ae4ec*=0x4de, lpOverlapped=0x0) returned 1 [0107.200] CloseHandle (hObject=0x154) returned 1 [0107.213] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", lpFilePart=0x0) returned 0x43 [0107.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0107.214] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.215] GetFileType (hFile=0x154) returned 0x1 [0107.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0107.215] GetFileType (hFile=0x154) returned 0x1 [0107.215] WriteFile (in: hFile=0x154, lpBuffer=0x1adda20*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1adda20*, lpNumberOfBytesWritten=0x2ae4b4*=0x4e0, lpOverlapped=0x0) returned 1 [0107.216] CloseHandle (hObject=0x154) returned 1 [0107.217] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", lpFilePart=0x0) returned 0x43 [0107.217] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0107.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0107.217] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eecbfdc, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7eecbfdc, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xded84930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0107.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.217] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.anonymous")) returned 1 [0107.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0107.218] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x40 [0107.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x41 [0107.218] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.221] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.221] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.221] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0107.221] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0107.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0107.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0107.221] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x40 [0107.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x41 [0107.221] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0107.221] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.222] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.223] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.224] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.224] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0107.224] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0107.224] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0107.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0107.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0107.224] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", lpFilePart=0x0) returned 0x4f [0107.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.224] GetFileType (hFile=0x154) returned 0x1 [0107.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.224] GetFileType (hFile=0x154) returned 0x1 [0107.224] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4ce [0107.224] ReadFile (in: hFile=0x154, lpBuffer=0x1ae4b18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae4b18*, lpNumberOfBytesRead=0x2ae478*=0x4ce, lpOverlapped=0x0) returned 1 [0107.226] CloseHandle (hObject=0x154) returned 1 [0107.238] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", lpFilePart=0x0) returned 0x4f [0107.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.238] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.240] GetFileType (hFile=0x154) returned 0x1 [0107.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.240] GetFileType (hFile=0x154) returned 0x1 [0107.240] WriteFile (in: hFile=0x154, lpBuffer=0x1b34254*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b34254*, lpNumberOfBytesWritten=0x2ae440*=0x4d0, lpOverlapped=0x0) returned 1 [0107.241] CloseHandle (hObject=0x154) returned 1 [0107.241] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", lpFilePart=0x0) returned 0x4f [0107.242] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0107.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.242] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8b5f96, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7c8b5f96, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdedd0bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0107.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.242] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.anonymous")) returned 1 [0107.243] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", lpFilePart=0x0) returned 0x52 [0107.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.243] GetFileType (hFile=0x154) returned 0x1 [0107.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.243] GetFileType (hFile=0x154) returned 0x1 [0107.243] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4f2 [0107.243] ReadFile (in: hFile=0x154, lpBuffer=0x1b35af8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b35af8*, lpNumberOfBytesRead=0x2ae478*=0x4f2, lpOverlapped=0x0) returned 1 [0107.244] CloseHandle (hObject=0x154) returned 1 [0107.280] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", lpFilePart=0x0) returned 0x52 [0107.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.282] GetFileType (hFile=0x154) returned 0x1 [0107.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.282] GetFileType (hFile=0x154) returned 0x1 [0107.282] WriteFile (in: hFile=0x154, lpBuffer=0x1987518*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1987518*, lpNumberOfBytesWritten=0x2ae440*=0x500, lpOverlapped=0x0) returned 1 [0107.283] CloseHandle (hObject=0x154) returned 1 [0107.283] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", lpFilePart=0x0) returned 0x52 [0107.283] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.anonymous", lpFilePart=0x0) returned 0x5c [0107.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.284] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b19ca14, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6b19ca14, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdee1ceb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0107.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.284] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.anonymous")) returned 1 [0107.285] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFilePart=0x0) returned 0x55 [0107.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.285] GetFileType (hFile=0x154) returned 0x1 [0107.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.285] GetFileType (hFile=0x154) returned 0x1 [0107.285] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x554 [0107.285] ReadFile (in: hFile=0x154, lpBuffer=0x1988e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1988e28*, lpNumberOfBytesRead=0x2ae478*=0x554, lpOverlapped=0x0) returned 1 [0107.428] CloseHandle (hObject=0x154) returned 1 [0107.446] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFilePart=0x0) returned 0x55 [0107.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.446] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.448] GetFileType (hFile=0x154) returned 0x1 [0107.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.448] GetFileType (hFile=0x154) returned 0x1 [0107.448] WriteFile (in: hFile=0x154, lpBuffer=0x19d89b0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19d89b0*, lpNumberOfBytesWritten=0x2ae440*=0x560, lpOverlapped=0x0) returned 1 [0107.450] CloseHandle (hObject=0x154) returned 1 [0107.450] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFilePart=0x0) returned 0x55 [0107.450] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.anonymous", lpFilePart=0x0) returned 0x5f [0107.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.450] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea56fc00, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xea56fc00, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdefbfdd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0107.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.451] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.anonymous")) returned 1 [0107.452] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", lpFilePart=0x0) returned 0x54 [0107.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.453] GetFileType (hFile=0x154) returned 0x1 [0107.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.453] GetFileType (hFile=0x154) returned 0x1 [0107.453] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4d6 [0107.453] ReadFile (in: hFile=0x154, lpBuffer=0x19da24c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19da24c*, lpNumberOfBytesRead=0x2ae478*=0x4d6, lpOverlapped=0x0) returned 1 [0107.523] CloseHandle (hObject=0x154) returned 1 [0107.540] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", lpFilePart=0x0) returned 0x54 [0107.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.540] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.542] GetFileType (hFile=0x154) returned 0x1 [0107.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.542] GetFileType (hFile=0x154) returned 0x1 [0107.542] WriteFile (in: hFile=0x154, lpBuffer=0x1a299f4*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a299f4*, lpNumberOfBytesWritten=0x2ae440*=0x4e0, lpOverlapped=0x0) returned 1 [0107.544] CloseHandle (hObject=0x154) returned 1 [0107.544] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", lpFilePart=0x0) returned 0x54 [0107.544] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.anonymous", lpFilePart=0x0) returned 0x5e [0107.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.544] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9479f40, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xe9479f40, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf0a4610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0107.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.544] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.anonymous")) returned 1 [0107.546] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", lpFilePart=0x0) returned 0x56 [0107.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.546] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.547] GetFileType (hFile=0x154) returned 0x1 [0107.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.547] GetFileType (hFile=0x154) returned 0x1 [0107.547] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4da [0107.547] ReadFile (in: hFile=0x154, lpBuffer=0x1a2b29c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2b29c*, lpNumberOfBytesRead=0x2ae478*=0x4da, lpOverlapped=0x0) returned 1 [0107.555] CloseHandle (hObject=0x154) returned 1 [0107.573] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", lpFilePart=0x0) returned 0x56 [0107.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.573] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.575] GetFileType (hFile=0x154) returned 0x1 [0107.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.575] GetFileType (hFile=0x154) returned 0x1 [0107.575] WriteFile (in: hFile=0x154, lpBuffer=0x1a7aa48*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a7aa48*, lpNumberOfBytesWritten=0x2ae440*=0x4e0, lpOverlapped=0x0) returned 1 [0107.577] CloseHandle (hObject=0x154) returned 1 [0107.577] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", lpFilePart=0x0) returned 0x56 [0107.577] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.anonymous", lpFilePart=0x0) returned 0x60 [0107.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.577] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a13760, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xe6a13760, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf0f08d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0107.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.577] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.anonymous")) returned 1 [0107.582] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFilePart=0x0) returned 0x4a [0107.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.583] GetFileType (hFile=0x154) returned 0x1 [0107.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.583] GetFileType (hFile=0x154) returned 0x1 [0107.583] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4da [0107.583] ReadFile (in: hFile=0x154, lpBuffer=0x1a7c2cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a7c2cc*, lpNumberOfBytesRead=0x2ae478*=0x4da, lpOverlapped=0x0) returned 1 [0107.584] CloseHandle (hObject=0x154) returned 1 [0107.602] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFilePart=0x0) returned 0x4a [0107.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.604] GetFileType (hFile=0x154) returned 0x1 [0107.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.604] GetFileType (hFile=0x154) returned 0x1 [0107.604] WriteFile (in: hFile=0x154, lpBuffer=0x1acba48*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1acba48*, lpNumberOfBytesWritten=0x2ae440*=0x4e0, lpOverlapped=0x0) returned 1 [0107.605] CloseHandle (hObject=0x154) returned 1 [0107.606] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFilePart=0x0) returned 0x4a [0107.606] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0107.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.606] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f821656, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6f821656, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf13cb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0107.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.606] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.anonymous")) returned 1 [0107.608] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFilePart=0x0) returned 0x5e [0107.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.608] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.608] GetFileType (hFile=0x154) returned 0x1 [0107.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.609] GetFileType (hFile=0x154) returned 0x1 [0107.609] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x557 [0107.609] ReadFile (in: hFile=0x154, lpBuffer=0x1acd350, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1acd350*, lpNumberOfBytesRead=0x2ae478*=0x557, lpOverlapped=0x0) returned 1 [0107.611] CloseHandle (hObject=0x154) returned 1 [0107.628] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFilePart=0x0) returned 0x5e [0107.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.628] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.630] GetFileType (hFile=0x154) returned 0x1 [0107.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.630] GetFileType (hFile=0x154) returned 0x1 [0107.631] WriteFile (in: hFile=0x154, lpBuffer=0x1b1cda0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b1cda0*, lpNumberOfBytesWritten=0x2ae440*=0x560, lpOverlapped=0x0) returned 1 [0107.632] CloseHandle (hObject=0x154) returned 1 [0107.632] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFilePart=0x0) returned 0x5e [0107.632] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0107.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.633] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f6c09bc, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5f6c09bc, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf188e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0107.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.633] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.anonymous")) returned 1 [0107.634] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFilePart=0x0) returned 0x52 [0107.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.635] GetFileType (hFile=0x154) returned 0x1 [0107.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.635] GetFileType (hFile=0x154) returned 0x1 [0107.635] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4f8 [0107.635] ReadFile (in: hFile=0x154, lpBuffer=0x1b1e690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b1e690*, lpNumberOfBytesRead=0x2ae478*=0x4f8, lpOverlapped=0x0) returned 1 [0107.636] CloseHandle (hObject=0x154) returned 1 [0107.653] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFilePart=0x0) returned 0x52 [0107.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.656] GetFileType (hFile=0x154) returned 0x1 [0107.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.656] GetFileType (hFile=0x154) returned 0x1 [0107.656] WriteFile (in: hFile=0x154, lpBuffer=0x1b6decc*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b6decc*, lpNumberOfBytesWritten=0x2ae440*=0x500, lpOverlapped=0x0) returned 1 [0107.657] CloseHandle (hObject=0x154) returned 1 [0107.657] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFilePart=0x0) returned 0x52 [0107.658] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.anonymous", lpFilePart=0x0) returned 0x5c [0107.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.658] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e2020, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xea5e2020, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf1aefb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0107.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.658] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.anonymous")) returned 1 [0107.660] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", lpFilePart=0x0) returned 0x53 [0107.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.660] GetFileType (hFile=0x154) returned 0x1 [0107.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.660] GetFileType (hFile=0x154) returned 0x1 [0107.660] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x532 [0107.661] ReadFile (in: hFile=0x154, lpBuffer=0x1b6f7b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b6f7b4*, lpNumberOfBytesRead=0x2ae478*=0x532, lpOverlapped=0x0) returned 1 [0107.663] CloseHandle (hObject=0x154) returned 1 [0107.720] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", lpFilePart=0x0) returned 0x53 [0107.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.720] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.722] GetFileType (hFile=0x154) returned 0x1 [0107.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.722] GetFileType (hFile=0x154) returned 0x1 [0107.722] WriteFile (in: hFile=0x154, lpBuffer=0x19c052c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19c052c*, lpNumberOfBytesWritten=0x2ae440*=0x540, lpOverlapped=0x0) returned 1 [0107.723] CloseHandle (hObject=0x154) returned 1 [0107.723] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", lpFilePart=0x0) returned 0x53 [0107.723] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.anonymous", lpFilePart=0x0) returned 0x5d [0107.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e52066a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7e52066a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf247530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0107.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.724] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.anonymous")) returned 1 [0107.725] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", lpFilePart=0x0) returned 0x51 [0107.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.725] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.725] GetFileType (hFile=0x154) returned 0x1 [0107.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.725] GetFileType (hFile=0x154) returned 0x1 [0107.725] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x547 [0107.725] ReadFile (in: hFile=0x154, lpBuffer=0x19c1e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19c1e20*, lpNumberOfBytesRead=0x2ae478*=0x547, lpOverlapped=0x0) returned 1 [0107.726] CloseHandle (hObject=0x154) returned 1 [0107.739] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", lpFilePart=0x0) returned 0x51 [0107.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.740] GetFileType (hFile=0x154) returned 0x1 [0107.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.741] GetFileType (hFile=0x154) returned 0x1 [0107.741] WriteFile (in: hFile=0x154, lpBuffer=0x1a11948*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a11948*, lpNumberOfBytesWritten=0x2ae440*=0x550, lpOverlapped=0x0) returned 1 [0107.742] CloseHandle (hObject=0x154) returned 1 [0107.742] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", lpFilePart=0x0) returned 0x51 [0107.742] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0107.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.742] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea4fd7e0, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xea4fd7e0, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf2937f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0107.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.742] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.anonymous")) returned 1 [0107.743] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", lpFilePart=0x0) returned 0x50 [0107.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.743] GetFileType (hFile=0x154) returned 0x1 [0107.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.744] GetFileType (hFile=0x154) returned 0x1 [0107.744] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4e6 [0107.744] ReadFile (in: hFile=0x154, lpBuffer=0x1a131cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a131cc*, lpNumberOfBytesRead=0x2ae478*=0x4e6, lpOverlapped=0x0) returned 1 [0107.757] CloseHandle (hObject=0x154) returned 1 [0107.770] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", lpFilePart=0x0) returned 0x50 [0107.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.770] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.771] GetFileType (hFile=0x154) returned 0x1 [0107.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.771] GetFileType (hFile=0x154) returned 0x1 [0107.771] WriteFile (in: hFile=0x154, lpBuffer=0x1a629b4*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a629b4*, lpNumberOfBytesWritten=0x2ae440*=0x4f0, lpOverlapped=0x0) returned 1 [0107.772] CloseHandle (hObject=0x154) returned 1 [0107.773] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", lpFilePart=0x0) returned 0x50 [0107.773] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0107.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.773] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ae14945, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7ae14945, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf2dfab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0107.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.anonymous")) returned 1 [0107.774] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", lpFilePart=0x0) returned 0x53 [0107.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.774] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.774] GetFileType (hFile=0x154) returned 0x1 [0107.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.774] GetFileType (hFile=0x154) returned 0x1 [0107.774] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x62b [0107.774] ReadFile (in: hFile=0x154, lpBuffer=0x1a64388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a64388*, lpNumberOfBytesRead=0x2ae478*=0x62b, lpOverlapped=0x0) returned 1 [0107.776] CloseHandle (hObject=0x154) returned 1 [0107.793] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", lpFilePart=0x0) returned 0x53 [0107.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.795] GetFileType (hFile=0x154) returned 0x1 [0107.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.795] GetFileType (hFile=0x154) returned 0x1 [0107.795] WriteFile (in: hFile=0x154, lpBuffer=0x1ab41b8*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ab41b8*, lpNumberOfBytesWritten=0x2ae440*=0x630, lpOverlapped=0x0) returned 1 [0107.797] CloseHandle (hObject=0x154) returned 1 [0107.797] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", lpFilePart=0x0) returned 0x53 [0107.797] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.anonymous", lpFilePart=0x0) returned 0x5d [0107.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.797] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec6a9d8, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7ec6a9d8, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf305c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x630)) returned 1 [0107.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.797] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.anonymous")) returned 1 [0107.798] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFilePart=0x0) returned 0x4c [0107.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0107.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.799] GetFileType (hFile=0x154) returned 0x1 [0107.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0107.799] GetFileType (hFile=0x154) returned 0x1 [0107.799] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x52a [0107.799] ReadFile (in: hFile=0x154, lpBuffer=0x1ab5a7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ab5a7c*, lpNumberOfBytesRead=0x2ae478*=0x52a, lpOverlapped=0x0) returned 1 [0107.801] CloseHandle (hObject=0x154) returned 1 [0107.819] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFilePart=0x0) returned 0x4c [0107.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0107.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.821] GetFileType (hFile=0x154) returned 0x1 [0107.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0107.821] GetFileType (hFile=0x154) returned 0x1 [0107.821] WriteFile (in: hFile=0x154, lpBuffer=0x1b05390*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b05390*, lpNumberOfBytesWritten=0x2ae440*=0x530, lpOverlapped=0x0) returned 1 [0107.822] CloseHandle (hObject=0x154) returned 1 [0107.822] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFilePart=0x0) returned 0x4c [0107.823] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0107.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0107.823] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2fd6ae, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7b2fd6ae, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf351ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0107.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.823] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.anonymous")) returned 1 [0107.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0107.824] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x4e [0107.824] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x4f [0107.824] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0107.824] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.825] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.825] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.825] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0107.825] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0107.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0107.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0107.825] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x4e [0107.825] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x4f [0107.826] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0107.826] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.826] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.826] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.826] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0107.826] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0107.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0107.827] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", lpFilePart=0x0) returned 0x65 [0107.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0107.827] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.827] GetFileType (hFile=0x154) returned 0x1 [0107.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0107.827] GetFileType (hFile=0x154) returned 0x1 [0107.827] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x56c [0107.827] ReadFile (in: hFile=0x154, lpBuffer=0x1b08ce8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b08ce8*, lpNumberOfBytesRead=0x2ae404*=0x56c, lpOverlapped=0x0) returned 1 [0107.829] CloseHandle (hObject=0x154) returned 1 [0107.846] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", lpFilePart=0x0) returned 0x65 [0107.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0107.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.848] GetFileType (hFile=0x154) returned 0x1 [0107.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0107.849] GetFileType (hFile=0x154) returned 0x1 [0107.849] WriteFile (in: hFile=0x154, lpBuffer=0x1b58780*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b58780*, lpNumberOfBytesWritten=0x2ae3cc*=0x570, lpOverlapped=0x0) returned 1 [0107.850] CloseHandle (hObject=0x154) returned 1 [0107.850] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", lpFilePart=0x0) returned 0x65 [0107.850] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.anonymous", lpFilePart=0x0) returned 0x6f [0107.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0107.851] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef8a6be, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7ef8a6be, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf39e190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x570)) returned 1 [0107.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0107.851] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.anonymous")) returned 1 [0107.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0107.852] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x4d [0107.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x4e [0107.852] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf098 [0107.853] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.853] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.853] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.853] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.853] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.853] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.854] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.854] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.854] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.854] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.854] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.854] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0107.854] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0107.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0107.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0107.855] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x4d [0107.855] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x4e [0107.855] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf098 [0107.855] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.855] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.855] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.856] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.856] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.856] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.856] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.856] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.856] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.857] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.857] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0107.857] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0107.857] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0107.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0107.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0107.857] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFilePart=0x0) returned 0x5f [0107.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0107.857] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.858] GetFileType (hFile=0x154) returned 0x1 [0107.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0107.858] GetFileType (hFile=0x154) returned 0x1 [0107.858] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4e0 [0107.858] ReadFile (in: hFile=0x154, lpBuffer=0x1b5e3b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b5e3b8*, lpNumberOfBytesRead=0x2ae404*=0x4e0, lpOverlapped=0x0) returned 1 [0107.860] CloseHandle (hObject=0x154) returned 1 [0107.927] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFilePart=0x0) returned 0x5f [0107.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0107.927] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.929] GetFileType (hFile=0x154) returned 0x1 [0107.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0107.929] GetFileType (hFile=0x154) returned 0x1 [0107.929] WriteFile (in: hFile=0x154, lpBuffer=0x19af8e8*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19af8e8*, lpNumberOfBytesWritten=0x2ae3cc*=0x4f0, lpOverlapped=0x0) returned 1 [0107.930] CloseHandle (hObject=0x154) returned 1 [0107.930] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFilePart=0x0) returned 0x5f [0107.930] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.anonymous", lpFilePart=0x0) returned 0x69 [0107.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0107.930] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c902257, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7c902257, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf45c870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0107.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0107.930] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.anonymous")) returned 1 [0107.931] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", lpFilePart=0x0) returned 0x58 [0107.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0107.931] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.932] GetFileType (hFile=0x154) returned 0x1 [0107.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0107.932] GetFileType (hFile=0x154) returned 0x1 [0107.932] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x50a [0107.932] ReadFile (in: hFile=0x154, lpBuffer=0x19b1204, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19b1204*, lpNumberOfBytesRead=0x2ae404*=0x50a, lpOverlapped=0x0) returned 1 [0107.933] CloseHandle (hObject=0x154) returned 1 [0107.945] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", lpFilePart=0x0) returned 0x58 [0107.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0107.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.947] GetFileType (hFile=0x154) returned 0x1 [0107.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0107.947] GetFileType (hFile=0x154) returned 0x1 [0107.947] WriteFile (in: hFile=0x154, lpBuffer=0x1a00bec*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a00bec*, lpNumberOfBytesWritten=0x2ae3cc*=0x510, lpOverlapped=0x0) returned 1 [0107.948] CloseHandle (hObject=0x154) returned 1 [0107.948] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", lpFilePart=0x0) returned 0x58 [0107.948] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.anonymous", lpFilePart=0x0) returned 0x62 [0107.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0107.948] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c00af8f, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6c00af8f, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf4829d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0107.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0107.948] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.anonymous")) returned 1 [0107.949] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", lpFilePart=0x0) returned 0x5e [0107.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0107.949] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.950] GetFileType (hFile=0x154) returned 0x1 [0107.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0107.950] GetFileType (hFile=0x154) returned 0x1 [0107.950] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4e4 [0107.950] ReadFile (in: hFile=0x154, lpBuffer=0x1a024bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a024bc*, lpNumberOfBytesRead=0x2ae404*=0x4e4, lpOverlapped=0x0) returned 1 [0107.951] CloseHandle (hObject=0x154) returned 1 [0107.963] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", lpFilePart=0x0) returned 0x5e [0107.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0107.963] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.966] GetFileType (hFile=0x154) returned 0x1 [0107.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0107.966] GetFileType (hFile=0x154) returned 0x1 [0107.966] WriteFile (in: hFile=0x154, lpBuffer=0x1a51cc4*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a51cc4*, lpNumberOfBytesWritten=0x2ae3cc*=0x4f0, lpOverlapped=0x0) returned 1 [0107.967] CloseHandle (hObject=0x154) returned 1 [0107.967] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", lpFilePart=0x0) returned 0x5e [0107.967] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0107.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0107.967] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b3e1ef0, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7b3e1ef0, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf4a8b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0107.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0107.967] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.anonymous")) returned 1 [0107.968] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", lpFilePart=0x0) returned 0x62 [0107.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0107.968] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.969] GetFileType (hFile=0x154) returned 0x1 [0107.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0107.969] GetFileType (hFile=0x154) returned 0x1 [0107.969] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4da [0107.969] ReadFile (in: hFile=0x154, lpBuffer=0x1a535c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a535c0*, lpNumberOfBytesRead=0x2ae404*=0x4da, lpOverlapped=0x0) returned 1 [0107.971] CloseHandle (hObject=0x154) returned 1 [0107.983] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", lpFilePart=0x0) returned 0x62 [0107.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0107.983] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.985] GetFileType (hFile=0x154) returned 0x1 [0107.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0107.985] GetFileType (hFile=0x154) returned 0x1 [0107.985] WriteFile (in: hFile=0x154, lpBuffer=0x1aa2d84*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aa2d84*, lpNumberOfBytesWritten=0x2ae3cc*=0x4e0, lpOverlapped=0x0) returned 1 [0107.986] CloseHandle (hObject=0x154) returned 1 [0107.986] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", lpFilePart=0x0) returned 0x62 [0107.986] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.anonymous", lpFilePart=0x0) returned 0x6c [0107.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0107.986] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d2e5e1a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5d2e5e1a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf4cec90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0107.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0107.987] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.anonymous")) returned 1 [0107.987] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", lpFilePart=0x0) returned 0x64 [0107.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0107.987] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0107.988] GetFileType (hFile=0x154) returned 0x1 [0107.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0107.989] GetFileType (hFile=0x154) returned 0x1 [0107.989] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4e2 [0107.989] ReadFile (in: hFile=0x154, lpBuffer=0x1aa46a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa46a8*, lpNumberOfBytesRead=0x2ae404*=0x4e2, lpOverlapped=0x0) returned 1 [0107.990] CloseHandle (hObject=0x154) returned 1 [0108.004] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", lpFilePart=0x0) returned 0x64 [0108.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.004] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.006] GetFileType (hFile=0x154) returned 0x1 [0108.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.006] GetFileType (hFile=0x154) returned 0x1 [0108.006] WriteFile (in: hFile=0x154, lpBuffer=0x1af3ecc*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1af3ecc*, lpNumberOfBytesWritten=0x2ae3cc*=0x4f0, lpOverlapped=0x0) returned 1 [0108.007] CloseHandle (hObject=0x154) returned 1 [0108.008] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", lpFilePart=0x0) returned 0x64 [0108.008] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.anonymous", lpFilePart=0x0) returned 0x6e [0108.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.008] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5597fb3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5597fb3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf51af50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0108.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.008] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.anonymous")) returned 1 [0108.009] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", lpFilePart=0x0) returned 0x60 [0108.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.009] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.010] GetFileType (hFile=0x154) returned 0x1 [0108.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.010] GetFileType (hFile=0x154) returned 0x1 [0108.010] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4de [0108.010] ReadFile (in: hFile=0x154, lpBuffer=0x1af57e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af57e8*, lpNumberOfBytesRead=0x2ae404*=0x4de, lpOverlapped=0x0) returned 1 [0108.012] CloseHandle (hObject=0x154) returned 1 [0108.029] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", lpFilePart=0x0) returned 0x60 [0108.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.029] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.031] GetFileType (hFile=0x154) returned 0x1 [0108.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.031] GetFileType (hFile=0x154) returned 0x1 [0108.031] WriteFile (in: hFile=0x154, lpBuffer=0x1b44fa0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b44fa0*, lpNumberOfBytesWritten=0x2ae3cc*=0x4e0, lpOverlapped=0x0) returned 1 [0108.033] CloseHandle (hObject=0x154) returned 1 [0108.033] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", lpFilePart=0x0) returned 0x60 [0108.033] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.anonymous", lpFilePart=0x0) returned 0x6a [0108.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.033] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad30103, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7ad30103, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf5410b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0108.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.033] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.anonymous")) returned 1 [0108.034] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", lpFilePart=0x0) returned 0x60 [0108.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.035] GetFileType (hFile=0x154) returned 0x1 [0108.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.035] GetFileType (hFile=0x154) returned 0x1 [0108.035] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4f4 [0108.035] ReadFile (in: hFile=0x154, lpBuffer=0x1b468b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b468b8*, lpNumberOfBytesRead=0x2ae404*=0x4f4, lpOverlapped=0x0) returned 1 [0108.037] CloseHandle (hObject=0x154) returned 1 [0108.086] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", lpFilePart=0x0) returned 0x60 [0108.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.087] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.088] GetFileType (hFile=0x154) returned 0x1 [0108.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.088] GetFileType (hFile=0x154) returned 0x1 [0108.088] WriteFile (in: hFile=0x154, lpBuffer=0x19974c8*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19974c8*, lpNumberOfBytesWritten=0x2ae3cc*=0x500, lpOverlapped=0x0) returned 1 [0108.089] CloseHandle (hObject=0x154) returned 1 [0108.089] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", lpFilePart=0x0) returned 0x60 [0108.089] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.anonymous", lpFilePart=0x0) returned 0x6a [0108.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.089] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df49088, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6df49088, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf5d9630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0108.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.089] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.anonymous")) returned 1 [0108.090] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", lpFilePart=0x0) returned 0x6f [0108.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.090] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.091] GetFileType (hFile=0x154) returned 0x1 [0108.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.091] GetFileType (hFile=0x154) returned 0x1 [0108.091] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x528 [0108.091] ReadFile (in: hFile=0x154, lpBuffer=0x1998e4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1998e4c*, lpNumberOfBytesRead=0x2ae404*=0x528, lpOverlapped=0x0) returned 1 [0108.092] CloseHandle (hObject=0x154) returned 1 [0108.104] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", lpFilePart=0x0) returned 0x6f [0108.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.104] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.106] GetFileType (hFile=0x154) returned 0x1 [0108.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.106] GetFileType (hFile=0x154) returned 0x1 [0108.106] WriteFile (in: hFile=0x154, lpBuffer=0x19e892c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19e892c*, lpNumberOfBytesWritten=0x2ae3cc*=0x530, lpOverlapped=0x0) returned 1 [0108.107] CloseHandle (hObject=0x154) returned 1 [0108.107] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", lpFilePart=0x0) returned 0x6f [0108.107] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.anonymous", lpFilePart=0x0) returned 0x79 [0108.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.107] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e62b00c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7e62b00c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf5ff790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0108.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.107] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.anonymous")) returned 1 [0108.108] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", lpFilePart=0x0) returned 0x67 [0108.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.108] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.108] GetFileType (hFile=0x154) returned 0x1 [0108.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.108] GetFileType (hFile=0x154) returned 0x1 [0108.108] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x524 [0108.109] ReadFile (in: hFile=0x154, lpBuffer=0x19ea2e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ea2e0*, lpNumberOfBytesRead=0x2ae404*=0x524, lpOverlapped=0x0) returned 1 [0108.110] CloseHandle (hObject=0x154) returned 1 [0108.122] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", lpFilePart=0x0) returned 0x67 [0108.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.122] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.123] GetFileType (hFile=0x154) returned 0x1 [0108.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.123] GetFileType (hFile=0x154) returned 0x1 [0108.123] WriteFile (in: hFile=0x154, lpBuffer=0x1a39c48*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a39c48*, lpNumberOfBytesWritten=0x2ae3cc*=0x530, lpOverlapped=0x0) returned 1 [0108.124] CloseHandle (hObject=0x154) returned 1 [0108.125] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", lpFilePart=0x0) returned 0x67 [0108.125] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.anonymous", lpFilePart=0x0) returned 0x71 [0108.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.125] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5b8beb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7e5b8beb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf6258f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0108.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.125] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.anonymous")) returned 1 [0108.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0108.126] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", lpFilePart=0x0) returned 0x4a [0108.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", lpFilePart=0x0) returned 0x4b [0108.126] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0108.126] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.126] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.126] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.126] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.126] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.126] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0108.127] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0108.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0108.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0108.127] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", lpFilePart=0x0) returned 0x4a [0108.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", lpFilePart=0x0) returned 0x4b [0108.127] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0108.127] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.127] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.127] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.127] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.127] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.128] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0108.128] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0108.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0108.128] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", lpFilePart=0x0) returned 0x5d [0108.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.128] GetFileType (hFile=0x154) returned 0x1 [0108.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.128] GetFileType (hFile=0x154) returned 0x1 [0108.128] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x59c [0108.128] ReadFile (in: hFile=0x154, lpBuffer=0x1a3dcdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3dcdc*, lpNumberOfBytesRead=0x2ae404*=0x59c, lpOverlapped=0x0) returned 1 [0108.136] CloseHandle (hObject=0x154) returned 1 [0108.149] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", lpFilePart=0x0) returned 0x5d [0108.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.150] GetFileType (hFile=0x154) returned 0x1 [0108.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.150] GetFileType (hFile=0x154) returned 0x1 [0108.150] WriteFile (in: hFile=0x154, lpBuffer=0x1a8d84c*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a8d84c*, lpNumberOfBytesWritten=0x2ae3cc*=0x5a0, lpOverlapped=0x0) returned 1 [0108.151] CloseHandle (hObject=0x154) returned 1 [0108.152] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", lpFilePart=0x0) returned 0x5d [0108.152] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.anonymous", lpFilePart=0x0) returned 0x67 [0108.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.152] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe95124c0, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xe95124c0, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf671bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5a0)) returned 1 [0108.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.152] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.anonymous")) returned 1 [0108.153] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", lpFilePart=0x0) returned 0x55 [0108.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.153] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.153] GetFileType (hFile=0x154) returned 0x1 [0108.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.153] GetFileType (hFile=0x154) returned 0x1 [0108.153] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x56a [0108.153] ReadFile (in: hFile=0x154, lpBuffer=0x1a8f19c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8f19c*, lpNumberOfBytesRead=0x2ae404*=0x56a, lpOverlapped=0x0) returned 1 [0108.174] CloseHandle (hObject=0x154) returned 1 [0108.186] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", lpFilePart=0x0) returned 0x55 [0108.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.186] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.187] GetFileType (hFile=0x154) returned 0x1 [0108.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.187] GetFileType (hFile=0x154) returned 0x1 [0108.187] WriteFile (in: hFile=0x154, lpBuffer=0x1adec00*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1adec00*, lpNumberOfBytesWritten=0x2ae3cc*=0x570, lpOverlapped=0x0) returned 1 [0108.188] CloseHandle (hObject=0x154) returned 1 [0108.189] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", lpFilePart=0x0) returned 0x55 [0108.189] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.anonymous", lpFilePart=0x0) returned 0x5f [0108.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.189] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe95aaa40, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xe95aaa40, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf6bde70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x570)) returned 1 [0108.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.189] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.anonymous")) returned 1 [0108.190] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", lpFilePart=0x0) returned 0x5e [0108.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.190] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.190] GetFileType (hFile=0x154) returned 0x1 [0108.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.190] GetFileType (hFile=0x154) returned 0x1 [0108.190] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x524 [0108.190] ReadFile (in: hFile=0x154, lpBuffer=0x1ae04fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ae04fc*, lpNumberOfBytesRead=0x2ae404*=0x524, lpOverlapped=0x0) returned 1 [0108.192] CloseHandle (hObject=0x154) returned 1 [0108.204] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", lpFilePart=0x0) returned 0x5e [0108.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.204] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.205] GetFileType (hFile=0x154) returned 0x1 [0108.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.205] GetFileType (hFile=0x154) returned 0x1 [0108.206] WriteFile (in: hFile=0x154, lpBuffer=0x1b2fe48*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b2fe48*, lpNumberOfBytesWritten=0x2ae3cc*=0x530, lpOverlapped=0x0) returned 1 [0108.207] CloseHandle (hObject=0x154) returned 1 [0108.207] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", lpFilePart=0x0) returned 0x5e [0108.207] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0108.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.207] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec3a3320, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xec3a3320, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdf6e3fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0108.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.207] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.anonymous")) returned 1 [0108.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0108.209] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", lpFilePart=0x0) returned 0x53 [0108.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", lpFilePart=0x0) returned 0x54 [0108.209] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0108.209] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.209] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.209] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.209] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.209] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0108.209] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0108.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0108.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0108.210] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", lpFilePart=0x0) returned 0x53 [0108.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", lpFilePart=0x0) returned 0x54 [0108.210] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0108.210] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.210] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.210] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.210] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0108.210] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0108.210] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0108.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0108.211] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFilePart=0x0) returned 0x6e [0108.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.211] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.211] GetFileType (hFile=0x154) returned 0x1 [0108.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.211] GetFileType (hFile=0x154) returned 0x1 [0108.211] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5bc [0108.211] ReadFile (in: hFile=0x154, lpBuffer=0x1b33ea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b33ea0*, lpNumberOfBytesRead=0x2ae404*=0x5bc, lpOverlapped=0x0) returned 1 [0108.213] CloseHandle (hObject=0x154) returned 1 [0108.225] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFilePart=0x0) returned 0x6e [0108.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.225] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.227] GetFileType (hFile=0x154) returned 0x1 [0108.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.227] GetFileType (hFile=0x154) returned 0x1 [0108.228] WriteFile (in: hFile=0x154, lpBuffer=0x1b83ae4*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b83ae4*, lpNumberOfBytesWritten=0x2ae3cc*=0x5c0, lpOverlapped=0x0) returned 1 [0108.229] CloseHandle (hObject=0x154) returned 1 [0108.229] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFilePart=0x0) returned 0x6e [0108.229] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.anonymous", lpFilePart=0x0) returned 0x78 [0108.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.229] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119d8cbf, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x119d8cbf, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xdf730290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0108.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.229] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.anonymous")) returned 1 [0108.230] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", lpFilePart=0x0) returned 0x6a [0108.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0108.230] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.254] GetFileType (hFile=0x154) returned 0x1 [0108.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0108.254] GetFileType (hFile=0x154) returned 0x1 [0108.254] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x76b [0108.257] ReadFile (in: hFile=0x154, lpBuffer=0x1985958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1985958*, lpNumberOfBytesRead=0x2ae404*=0x76b, lpOverlapped=0x0) returned 1 [0108.258] CloseHandle (hObject=0x154) returned 1 [0108.308] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", lpFilePart=0x0) returned 0x6a [0108.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0108.308] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.310] GetFileType (hFile=0x154) returned 0x1 [0108.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0108.310] GetFileType (hFile=0x154) returned 0x1 [0108.310] WriteFile (in: hFile=0x154, lpBuffer=0x19d5f5c*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19d5f5c*, lpNumberOfBytesWritten=0x2ae3cc*=0x770, lpOverlapped=0x0) returned 1 [0108.311] CloseHandle (hObject=0x154) returned 1 [0108.311] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", lpFilePart=0x0) returned 0x6a [0108.311] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.anonymous", lpFilePart=0x0) returned 0x74 [0108.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0108.311] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5166202, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1da0323, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xdf7ee970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x770)) returned 1 [0108.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0108.311] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.anonymous")) returned 1 [0108.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0108.313] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x49 [0108.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x4a [0108.313] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0108.313] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.314] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.315] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.315] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.315] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.315] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.315] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.315] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0108.315] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0108.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0108.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0108.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0108.315] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x49 [0108.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x4a [0108.315] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0108.316] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.316] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.316] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.316] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.316] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.317] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.317] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.317] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.317] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.317] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.318] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.318] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.318] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.318] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.318] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.318] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.319] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0108.319] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0108.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0108.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0108.319] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFilePart=0x0) returned 0x60 [0108.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.319] GetFileType (hFile=0x154) returned 0x1 [0108.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.319] GetFileType (hFile=0x154) returned 0x1 [0108.320] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4da [0108.320] ReadFile (in: hFile=0x154, lpBuffer=0x19dd1d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19dd1d8*, lpNumberOfBytesRead=0x2ae478*=0x4da, lpOverlapped=0x0) returned 1 [0108.327] CloseHandle (hObject=0x154) returned 1 [0108.346] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFilePart=0x0) returned 0x60 [0108.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.347] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.348] GetFileType (hFile=0x154) returned 0x1 [0108.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.349] GetFileType (hFile=0x154) returned 0x1 [0108.349] WriteFile (in: hFile=0x154, lpBuffer=0x1a2c99c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a2c99c*, lpNumberOfBytesWritten=0x2ae440*=0x4e0, lpOverlapped=0x0) returned 1 [0108.350] CloseHandle (hObject=0x154) returned 1 [0108.350] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFilePart=0x0) returned 0x60 [0108.350] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.anonymous", lpFilePart=0x0) returned 0x6a [0108.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.350] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11bc7ea2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x11bc7ea2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xdf860d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0108.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.351] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.anonymous")) returned 1 [0108.352] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFilePart=0x0) returned 0x61 [0108.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.352] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.352] GetFileType (hFile=0x154) returned 0x1 [0108.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.353] GetFileType (hFile=0x154) returned 0x1 [0108.353] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x50e [0108.353] ReadFile (in: hFile=0x154, lpBuffer=0x1a2e2d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2e2d8*, lpNumberOfBytesRead=0x2ae478*=0x50e, lpOverlapped=0x0) returned 1 [0108.356] CloseHandle (hObject=0x154) returned 1 [0108.368] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFilePart=0x0) returned 0x61 [0108.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.368] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.370] GetFileType (hFile=0x154) returned 0x1 [0108.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.370] GetFileType (hFile=0x154) returned 0x1 [0108.370] WriteFile (in: hFile=0x154, lpBuffer=0x1a7db88*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a7db88*, lpNumberOfBytesWritten=0x2ae440*=0x510, lpOverlapped=0x0) returned 1 [0108.371] CloseHandle (hObject=0x154) returned 1 [0108.372] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFilePart=0x0) returned 0x61 [0108.372] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.anonymous", lpFilePart=0x0) returned 0x6b [0108.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.372] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3ecb7b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6a3ecb7b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf886ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0108.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.372] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.anonymous")) returned 1 [0108.373] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", lpFilePart=0x0) returned 0x61 [0108.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.374] GetFileType (hFile=0x154) returned 0x1 [0108.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.374] GetFileType (hFile=0x154) returned 0x1 [0108.374] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4f6 [0108.374] ReadFile (in: hFile=0x154, lpBuffer=0x1a7f4ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a7f4ac*, lpNumberOfBytesRead=0x2ae478*=0x4f6, lpOverlapped=0x0) returned 1 [0108.376] CloseHandle (hObject=0x154) returned 1 [0108.389] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", lpFilePart=0x0) returned 0x61 [0108.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.389] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.391] GetFileType (hFile=0x154) returned 0x1 [0108.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.391] GetFileType (hFile=0x154) returned 0x1 [0108.391] WriteFile (in: hFile=0x154, lpBuffer=0x1aced14*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1aced14*, lpNumberOfBytesWritten=0x2ae440*=0x500, lpOverlapped=0x0) returned 1 [0108.392] CloseHandle (hObject=0x154) returned 1 [0108.392] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", lpFilePart=0x0) returned 0x61 [0108.392] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.anonymous", lpFilePart=0x0) returned 0x6b [0108.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.392] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dffd732, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5dffd732, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf8ad050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0108.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.392] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.anonymous")) returned 1 [0108.394] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFilePart=0x0) returned 0x5a [0108.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.394] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.394] GetFileType (hFile=0x154) returned 0x1 [0108.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.395] GetFileType (hFile=0x154) returned 0x1 [0108.395] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x512 [0108.395] ReadFile (in: hFile=0x154, lpBuffer=0x1ad0654, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ad0654*, lpNumberOfBytesRead=0x2ae478*=0x512, lpOverlapped=0x0) returned 1 [0108.396] CloseHandle (hObject=0x154) returned 1 [0108.408] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFilePart=0x0) returned 0x5a [0108.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.410] GetFileType (hFile=0x154) returned 0x1 [0108.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.410] GetFileType (hFile=0x154) returned 0x1 [0108.410] WriteFile (in: hFile=0x154, lpBuffer=0x1b1ff48*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b1ff48*, lpNumberOfBytesWritten=0x2ae440*=0x520, lpOverlapped=0x0) returned 1 [0108.411] CloseHandle (hObject=0x154) returned 1 [0108.412] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFilePart=0x0) returned 0x5a [0108.412] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.anonymous", lpFilePart=0x0) returned 0x64 [0108.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.412] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6de18586, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6de18586, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf8f9310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0108.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.412] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.anonymous")) returned 1 [0108.413] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFilePart=0x0) returned 0x5d [0108.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.414] GetFileType (hFile=0x154) returned 0x1 [0108.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.414] GetFileType (hFile=0x154) returned 0x1 [0108.414] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4fa [0108.414] ReadFile (in: hFile=0x154, lpBuffer=0x1b2183c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2183c*, lpNumberOfBytesRead=0x2ae478*=0x4fa, lpOverlapped=0x0) returned 1 [0108.415] CloseHandle (hObject=0x154) returned 1 [0108.427] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFilePart=0x0) returned 0x5d [0108.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.428] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.429] GetFileType (hFile=0x154) returned 0x1 [0108.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.429] GetFileType (hFile=0x154) returned 0x1 [0108.430] WriteFile (in: hFile=0x154, lpBuffer=0x1b71090*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b71090*, lpNumberOfBytesWritten=0x2ae440*=0x500, lpOverlapped=0x0) returned 1 [0108.431] CloseHandle (hObject=0x154) returned 1 [0108.431] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFilePart=0x0) returned 0x5d [0108.431] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.anonymous", lpFilePart=0x0) returned 0x67 [0108.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.431] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a77ec81, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6a77ec81, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf91f470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0108.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.431] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.anonymous")) returned 1 [0108.433] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFilePart=0x0) returned 0x65 [0108.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.433] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.433] GetFileType (hFile=0x154) returned 0x1 [0108.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.433] GetFileType (hFile=0x154) returned 0x1 [0108.433] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4f4 [0108.433] ReadFile (in: hFile=0x154, lpBuffer=0x1b729a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b729a8*, lpNumberOfBytesRead=0x2ae478*=0x4f4, lpOverlapped=0x0) returned 1 [0108.435] CloseHandle (hObject=0x154) returned 1 [0108.474] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFilePart=0x0) returned 0x65 [0108.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.474] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.475] GetFileType (hFile=0x154) returned 0x1 [0108.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.476] GetFileType (hFile=0x154) returned 0x1 [0108.476] WriteFile (in: hFile=0x154, lpBuffer=0x19c2b48*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19c2b48*, lpNumberOfBytesWritten=0x2ae440*=0x500, lpOverlapped=0x0) returned 1 [0108.477] CloseHandle (hObject=0x154) returned 1 [0108.477] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFilePart=0x0) returned 0x65 [0108.477] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.anonymous", lpFilePart=0x0) returned 0x6f [0108.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.477] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x556f83d6, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x556f83d6, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf991890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0108.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.477] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.anonymous")) returned 1 [0108.479] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFilePart=0x0) returned 0x61 [0108.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.479] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.480] GetFileType (hFile=0x154) returned 0x1 [0108.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.480] GetFileType (hFile=0x154) returned 0x1 [0108.480] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4d0 [0108.480] ReadFile (in: hFile=0x154, lpBuffer=0x19c445c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19c445c*, lpNumberOfBytesRead=0x2ae478*=0x4d0, lpOverlapped=0x0) returned 1 [0108.481] CloseHandle (hObject=0x154) returned 1 [0108.494] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFilePart=0x0) returned 0x61 [0108.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.496] GetFileType (hFile=0x154) returned 0x1 [0108.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.496] GetFileType (hFile=0x154) returned 0x1 [0108.496] WriteFile (in: hFile=0x154, lpBuffer=0x1a13d84*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a13d84*, lpNumberOfBytesWritten=0x2ae440*=0x4e0, lpOverlapped=0x0) returned 1 [0108.497] CloseHandle (hObject=0x154) returned 1 [0108.497] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFilePart=0x0) returned 0x61 [0108.497] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.anonymous", lpFilePart=0x0) returned 0x6b [0108.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.498] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d227738, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5d227738, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdf9b79f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0108.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.498] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.anonymous")) returned 1 [0108.507] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFilePart=0x0) returned 0x5e [0108.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.507] GetFileType (hFile=0x154) returned 0x1 [0108.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.507] GetFileType (hFile=0x154) returned 0x1 [0108.507] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4ee [0108.507] ReadFile (in: hFile=0x154, lpBuffer=0x1a15698, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a15698*, lpNumberOfBytesRead=0x2ae478*=0x4ee, lpOverlapped=0x0) returned 1 [0108.509] CloseHandle (hObject=0x154) returned 1 [0108.523] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFilePart=0x0) returned 0x5e [0108.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.524] GetFileType (hFile=0x154) returned 0x1 [0108.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.524] GetFileType (hFile=0x154) returned 0x1 [0108.524] WriteFile (in: hFile=0x154, lpBuffer=0x1a64ea0*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a64ea0*, lpNumberOfBytesWritten=0x2ae440*=0x4f0, lpOverlapped=0x0) returned 1 [0108.525] CloseHandle (hObject=0x154) returned 1 [0108.526] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFilePart=0x0) returned 0x5e [0108.526] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0108.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.526] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4a63280, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xe4a63280, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdfa03cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0108.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.526] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.anonymous")) returned 1 [0108.527] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFilePart=0x0) returned 0x6f [0108.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.528] GetFileType (hFile=0x154) returned 0x1 [0108.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.528] GetFileType (hFile=0x154) returned 0x1 [0108.528] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4e0 [0108.528] ReadFile (in: hFile=0x154, lpBuffer=0x1a667d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a667d8*, lpNumberOfBytesRead=0x2ae478*=0x4e0, lpOverlapped=0x0) returned 1 [0108.535] CloseHandle (hObject=0x154) returned 1 [0108.547] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFilePart=0x0) returned 0x6f [0108.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.547] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.549] GetFileType (hFile=0x154) returned 0x1 [0108.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.549] GetFileType (hFile=0x154) returned 0x1 [0108.549] WriteFile (in: hFile=0x154, lpBuffer=0x1ab602c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ab602c*, lpNumberOfBytesWritten=0x2ae440*=0x4f0, lpOverlapped=0x0) returned 1 [0108.550] CloseHandle (hObject=0x154) returned 1 [0108.550] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFilePart=0x0) returned 0x6f [0108.551] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.anonymous", lpFilePart=0x0) returned 0x79 [0108.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.551] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed792b60, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xed792b60, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0xdfa29e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0108.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.551] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.anonymous")) returned 1 [0108.552] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFilePart=0x0) returned 0x56 [0108.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.552] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.553] GetFileType (hFile=0x154) returned 0x1 [0108.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.553] GetFileType (hFile=0x154) returned 0x1 [0108.553] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x508 [0108.553] ReadFile (in: hFile=0x154, lpBuffer=0x1ab798c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ab798c*, lpNumberOfBytesRead=0x2ae478*=0x508, lpOverlapped=0x0) returned 1 [0108.556] CloseHandle (hObject=0x154) returned 1 [0108.569] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFilePart=0x0) returned 0x56 [0108.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.569] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.570] GetFileType (hFile=0x154) returned 0x1 [0108.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.571] GetFileType (hFile=0x154) returned 0x1 [0108.571] WriteFile (in: hFile=0x154, lpBuffer=0x1b07218*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b07218*, lpNumberOfBytesWritten=0x2ae440*=0x510, lpOverlapped=0x0) returned 1 [0108.572] CloseHandle (hObject=0x154) returned 1 [0108.572] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFilePart=0x0) returned 0x56 [0108.572] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.anonymous", lpFilePart=0x0) returned 0x60 [0108.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.572] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x645e65ce, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x645e65ce, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdfa760d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0108.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.572] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.anonymous")) returned 1 [0108.573] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFilePart=0x0) returned 0x62 [0108.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.573] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.573] GetFileType (hFile=0x154) returned 0x1 [0108.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.573] GetFileType (hFile=0x154) returned 0x1 [0108.573] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4de [0108.573] ReadFile (in: hFile=0x154, lpBuffer=0x1b08af0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b08af0*, lpNumberOfBytesRead=0x2ae478*=0x4de, lpOverlapped=0x0) returned 1 [0108.575] CloseHandle (hObject=0x154) returned 1 [0108.587] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFilePart=0x0) returned 0x62 [0108.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.587] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.589] GetFileType (hFile=0x154) returned 0x1 [0108.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.589] GetFileType (hFile=0x154) returned 0x1 [0108.589] WriteFile (in: hFile=0x154, lpBuffer=0x1b582b8*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b582b8*, lpNumberOfBytesWritten=0x2ae440*=0x4e0, lpOverlapped=0x0) returned 1 [0108.590] CloseHandle (hObject=0x154) returned 1 [0108.590] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFilePart=0x0) returned 0x62 [0108.590] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.anonymous", lpFilePart=0x0) returned 0x6c [0108.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.590] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5590d719, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5590d719, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdfa9c230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0108.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.591] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.anonymous")) returned 1 [0108.592] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFilePart=0x0) returned 0x5c [0108.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.592] GetFileType (hFile=0x154) returned 0x1 [0108.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.592] GetFileType (hFile=0x154) returned 0x1 [0108.592] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4ee [0108.592] ReadFile (in: hFile=0x154, lpBuffer=0x1b59bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b59bd0*, lpNumberOfBytesRead=0x2ae478*=0x4ee, lpOverlapped=0x0) returned 1 [0108.601] CloseHandle (hObject=0x154) returned 1 [0108.637] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFilePart=0x0) returned 0x5c [0108.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.638] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.639] GetFileType (hFile=0x154) returned 0x1 [0108.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.639] GetFileType (hFile=0x154) returned 0x1 [0108.643] CloseHandle (hObject=0x154) returned 1 [0108.643] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFilePart=0x0) returned 0x5c [0108.643] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.anonymous", lpFilePart=0x0) returned 0x66 [0108.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.643] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6defcdc8, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6defcdc8, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdfb0e650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0108.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.644] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.anonymous")) returned 1 [0108.645] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFilePart=0x0) returned 0x75 [0108.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.645] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.646] GetFileType (hFile=0x154) returned 0x1 [0108.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.646] GetFileType (hFile=0x154) returned 0x1 [0108.646] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4fa [0108.646] ReadFile (in: hFile=0x154, lpBuffer=0x19aad00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19aad00*, lpNumberOfBytesRead=0x2ae478*=0x4fa, lpOverlapped=0x0) returned 1 [0108.665] CloseHandle (hObject=0x154) returned 1 [0108.683] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFilePart=0x0) returned 0x75 [0108.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.684] GetFileType (hFile=0x154) returned 0x1 [0108.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.684] GetFileType (hFile=0x154) returned 0x1 [0108.684] WriteFile (in: hFile=0x154, lpBuffer=0x19fa710*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19fa710*, lpNumberOfBytesWritten=0x2ae440*=0x500, lpOverlapped=0x0) returned 1 [0108.685] CloseHandle (hObject=0x154) returned 1 [0108.686] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFilePart=0x0) returned 0x75 [0108.686] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.anonymous", lpFilePart=0x0) returned 0x7f [0108.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.686] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614cdfb3, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x614cdfb3, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdfb80a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0108.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.686] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.anonymous")) returned 1 [0108.687] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", lpFilePart=0x0) returned 0x68 [0108.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.687] GetFileType (hFile=0x154) returned 0x1 [0108.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.687] GetFileType (hFile=0x154) returned 0x1 [0108.687] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xab5 [0108.687] ReadFile (in: hFile=0x154, lpBuffer=0x19fc68c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19fc68c*, lpNumberOfBytesRead=0x2ae478*=0xab5, lpOverlapped=0x0) returned 1 [0108.699] CloseHandle (hObject=0x154) returned 1 [0108.711] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", lpFilePart=0x0) returned 0x68 [0108.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.711] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.713] GetFileType (hFile=0x154) returned 0x1 [0108.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.713] GetFileType (hFile=0x154) returned 0x1 [0108.715] CloseHandle (hObject=0x154) returned 1 [0108.715] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", lpFilePart=0x0) returned 0x68 [0108.715] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.anonymous", lpFilePart=0x0) returned 0x72 [0108.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.715] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5166202, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1da0323, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xdfbccd30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xac0)) returned 1 [0108.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.715] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.anonymous")) returned 1 [0108.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0108.717] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", lpFilePart=0x0) returned 0x3a [0108.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", lpFilePart=0x0) returned 0x3b [0108.717] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0108.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.717] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0108.718] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0108.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0108.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0108.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0108.718] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", lpFilePart=0x0) returned 0x3a [0108.718] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", lpFilePart=0x0) returned 0x3b [0108.718] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0108.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.718] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0108.719] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0108.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0108.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0108.719] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", lpFilePart=0x0) returned 0x4b [0108.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.719] GetFileType (hFile=0x154) returned 0x1 [0108.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.719] GetFileType (hFile=0x154) returned 0x1 [0108.719] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x102 [0108.719] ReadFile (in: hFile=0x154, lpBuffer=0x1a50b88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a50b88*, lpNumberOfBytesRead=0x2ae478*=0x102, lpOverlapped=0x0) returned 1 [0108.720] CloseHandle (hObject=0x154) returned 1 [0108.734] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", lpFilePart=0x0) returned 0x4b [0108.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.734] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.736] GetFileType (hFile=0x154) returned 0x1 [0108.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.736] GetFileType (hFile=0x154) returned 0x1 [0108.736] WriteFile (in: hFile=0x154, lpBuffer=0x1a9f00c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a9f00c*, lpNumberOfBytesWritten=0x2ae440*=0x110, lpOverlapped=0x0) returned 1 [0108.737] CloseHandle (hObject=0x154) returned 1 [0108.737] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", lpFilePart=0x0) returned 0x4b [0108.737] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0108.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.737] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3f338d, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7c3f338d, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdfbf2e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0108.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.737] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.anonymous")) returned 1 [0108.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0108.739] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", lpFilePart=0x0) returned 0x39 [0108.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", lpFilePart=0x0) returned 0x3a [0108.739] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf2d8 [0108.740] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.740] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.740] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.740] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.740] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.740] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.741] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0108.741] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0108.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0108.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0108.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0108.742] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", lpFilePart=0x0) returned 0x39 [0108.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", lpFilePart=0x0) returned 0x3a [0108.742] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf2d8 [0108.743] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.743] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.743] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.743] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.744] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.744] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0108.744] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0108.744] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0108.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0108.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0108.745] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", lpFilePart=0x0) returned 0x48 [0108.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.745] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.749] GetFileType (hFile=0x154) returned 0x1 [0108.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.749] GetFileType (hFile=0x154) returned 0x1 [0108.749] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7a5 [0108.749] ReadFile (in: hFile=0x154, lpBuffer=0x1aa30f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aa30f8*, lpNumberOfBytesRead=0x2ae478*=0x7a5, lpOverlapped=0x0) returned 1 [0108.783] CloseHandle (hObject=0x154) returned 1 [0108.796] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", lpFilePart=0x0) returned 0x48 [0108.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.796] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.798] GetFileType (hFile=0x154) returned 0x1 [0108.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.798] GetFileType (hFile=0x154) returned 0x1 [0108.798] WriteFile (in: hFile=0x154, lpBuffer=0x1af3690*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1af3690*, lpNumberOfBytesWritten=0x2ae440*=0x7b0, lpOverlapped=0x0) returned 1 [0108.799] CloseHandle (hObject=0x154) returned 1 [0108.799] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", lpFilePart=0x0) returned 0x48 [0108.799] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0108.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.799] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c90fe0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69c90fe0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xdfc8b410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7b0)) returned 1 [0108.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.799] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.anonymous")) returned 1 [0108.800] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", lpFilePart=0x0) returned 0x4f [0108.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.800] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.800] GetFileType (hFile=0x154) returned 0x1 [0108.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.801] GetFileType (hFile=0x154) returned 0x1 [0108.801] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7b7 [0108.801] ReadFile (in: hFile=0x154, lpBuffer=0x1af51bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1af51bc*, lpNumberOfBytesRead=0x2ae478*=0x7b7, lpOverlapped=0x0) returned 1 [0108.850] CloseHandle (hObject=0x154) returned 1 [0108.862] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", lpFilePart=0x0) returned 0x4f [0108.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.864] GetFileType (hFile=0x154) returned 0x1 [0108.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.864] GetFileType (hFile=0x154) returned 0x1 [0108.864] WriteFile (in: hFile=0x154, lpBuffer=0x1b457bc*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b457bc*, lpNumberOfBytesWritten=0x2ae440*=0x7c0, lpOverlapped=0x0) returned 1 [0108.865] CloseHandle (hObject=0x154) returned 1 [0108.865] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", lpFilePart=0x0) returned 0x4f [0108.865] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0108.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.865] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c90fe0, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69c90fe0, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xdfd49af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7c0)) returned 1 [0108.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.865] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.anonymous")) returned 1 [0108.866] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", lpFilePart=0x0) returned 0x4c [0108.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.866] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.867] GetFileType (hFile=0x154) returned 0x1 [0108.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.867] GetFileType (hFile=0x154) returned 0x1 [0108.867] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x78d [0108.867] ReadFile (in: hFile=0x154, lpBuffer=0x1b472dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b472dc*, lpNumberOfBytesRead=0x2ae478*=0x78d, lpOverlapped=0x0) returned 1 [0108.869] CloseHandle (hObject=0x154) returned 1 [0108.935] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", lpFilePart=0x0) returned 0x4c [0108.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0108.936] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.974] GetFileType (hFile=0x154) returned 0x1 [0108.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0108.974] GetFileType (hFile=0x154) returned 0x1 [0108.974] WriteFile (in: hFile=0x154, lpBuffer=0x199718c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x199718c*, lpNumberOfBytesWritten=0x2ae440*=0x790, lpOverlapped=0x0) returned 1 [0108.976] CloseHandle (hObject=0x154) returned 1 [0108.976] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", lpFilePart=0x0) returned 0x4c [0108.976] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0108.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0108.976] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c6ae80, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69c6ae80, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xdfe54490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x790)) returned 1 [0108.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0108.976] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.anonymous")) returned 1 [0108.979] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", lpFilePart=0x0) returned 0x46 [0108.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0108.979] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0108.980] GetFileType (hFile=0x154) returned 0x1 [0108.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0108.980] GetFileType (hFile=0x154) returned 0x1 [0108.980] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4aa [0108.980] ReadFile (in: hFile=0x154, lpBuffer=0x19989a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19989a4*, lpNumberOfBytesRead=0x2ae478*=0x4aa, lpOverlapped=0x0) returned 1 [0108.993] CloseHandle (hObject=0x154) returned 1 [0109.032] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", lpFilePart=0x0) returned 0x46 [0109.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.033] GetFileType (hFile=0x154) returned 0x1 [0109.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.034] GetFileType (hFile=0x154) returned 0x1 [0109.034] WriteFile (in: hFile=0x154, lpBuffer=0x19e818c*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19e818c*, lpNumberOfBytesWritten=0x2ae440*=0x4b0, lpOverlapped=0x0) returned 1 [0109.035] CloseHandle (hObject=0x154) returned 1 [0109.035] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", lpFilePart=0x0) returned 0x46 [0109.035] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0109.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.035] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c44d20, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69c44d20, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xdfeeca10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4b0)) returned 1 [0109.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.035] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.anonymous")) returned 1 [0109.070] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", lpFilePart=0x0) returned 0x4c [0109.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.070] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.070] GetFileType (hFile=0x154) returned 0x1 [0109.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.070] GetFileType (hFile=0x154) returned 0x1 [0109.070] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x44e [0109.070] ReadFile (in: hFile=0x154, lpBuffer=0x19e993c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e993c*, lpNumberOfBytesRead=0x2ae478*=0x44e, lpOverlapped=0x0) returned 1 [0109.074] CloseHandle (hObject=0x154) returned 1 [0109.093] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", lpFilePart=0x0) returned 0x4c [0109.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.095] GetFileType (hFile=0x154) returned 0x1 [0109.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.095] GetFileType (hFile=0x154) returned 0x1 [0109.095] WriteFile (in: hFile=0x154, lpBuffer=0x1a38dfc*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a38dfc*, lpNumberOfBytesWritten=0x2ae440*=0x450, lpOverlapped=0x0) returned 1 [0109.097] CloseHandle (hObject=0x154) returned 1 [0109.097] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", lpFilePart=0x0) returned 0x4c [0109.097] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0109.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.097] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69c44d20, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x69c44d20, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xdff84f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x450)) returned 1 [0109.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.097] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.anonymous")) returned 1 [0109.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.098] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x40 [0109.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x41 [0109.099] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0109.099] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.099] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.099] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.099] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.099] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.099] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.100] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.100] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x40 [0109.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x41 [0109.100] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0109.100] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.100] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.100] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.101] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.101] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.101] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.101] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.101] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", lpFilePart=0x0) returned 0x5e [0109.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.101] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.102] GetFileType (hFile=0x154) returned 0x1 [0109.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.102] GetFileType (hFile=0x154) returned 0x1 [0109.102] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x518 [0109.102] ReadFile (in: hFile=0x154, lpBuffer=0x1a3cbc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a3cbc4*, lpNumberOfBytesRead=0x2ae478*=0x518, lpOverlapped=0x0) returned 1 [0109.110] CloseHandle (hObject=0x154) returned 1 [0109.129] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", lpFilePart=0x0) returned 0x5e [0109.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.129] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.131] GetFileType (hFile=0x154) returned 0x1 [0109.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.131] GetFileType (hFile=0x154) returned 0x1 [0109.131] WriteFile (in: hFile=0x154, lpBuffer=0x1a8c4d0*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a8c4d0*, lpNumberOfBytesWritten=0x2ae440*=0x520, lpOverlapped=0x0) returned 1 [0109.133] CloseHandle (hObject=0x154) returned 1 [0109.133] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", lpFilePart=0x0) returned 0x5e [0109.133] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0109.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd17c1c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7dd17c1c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xdffd1250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0109.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.134] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.anonymous")) returned 1 [0109.135] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", lpFilePart=0x0) returned 0x59 [0109.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.135] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.136] GetFileType (hFile=0x154) returned 0x1 [0109.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.136] GetFileType (hFile=0x154) returned 0x1 [0109.136] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4e0 [0109.136] ReadFile (in: hFile=0x154, lpBuffer=0x1a8ddc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a8ddc4*, lpNumberOfBytesRead=0x2ae478*=0x4e0, lpOverlapped=0x0) returned 1 [0109.139] CloseHandle (hObject=0x154) returned 1 [0109.157] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", lpFilePart=0x0) returned 0x59 [0109.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.157] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.159] GetFileType (hFile=0x154) returned 0x1 [0109.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.159] GetFileType (hFile=0x154) returned 0x1 [0109.159] WriteFile (in: hFile=0x154, lpBuffer=0x1add5d4*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1add5d4*, lpNumberOfBytesWritten=0x2ae440*=0x4f0, lpOverlapped=0x0) returned 1 [0109.160] CloseHandle (hObject=0x154) returned 1 [0109.160] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", lpFilePart=0x0) returned 0x59 [0109.160] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.anonymous", lpFilePart=0x0) returned 0x63 [0109.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.161] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f211e22, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7f211e22, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xe001d510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0109.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.anonymous")) returned 1 [0109.162] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", lpFilePart=0x0) returned 0x56 [0109.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.162] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.163] GetFileType (hFile=0x154) returned 0x1 [0109.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.163] GetFileType (hFile=0x154) returned 0x1 [0109.163] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4bc [0109.163] ReadFile (in: hFile=0x154, lpBuffer=0x1adee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1adee8c*, lpNumberOfBytesRead=0x2ae478*=0x4bc, lpOverlapped=0x0) returned 1 [0109.170] CloseHandle (hObject=0x154) returned 1 [0109.188] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", lpFilePart=0x0) returned 0x56 [0109.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.190] GetFileType (hFile=0x154) returned 0x1 [0109.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.190] GetFileType (hFile=0x154) returned 0x1 [0109.190] WriteFile (in: hFile=0x154, lpBuffer=0x1b2e594*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b2e594*, lpNumberOfBytesWritten=0x2ae440*=0x4c0, lpOverlapped=0x0) returned 1 [0109.192] CloseHandle (hObject=0x154) returned 1 [0109.192] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", lpFilePart=0x0) returned 0x56 [0109.192] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.anonymous", lpFilePart=0x0) returned 0x60 [0109.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.192] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e70f84e, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7e70f84e, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xe00697d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4c0)) returned 1 [0109.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.193] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.anonymous")) returned 1 [0109.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.194] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", lpFilePart=0x0) returned 0x45 [0109.194] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", lpFilePart=0x0) returned 0x46 [0109.194] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0109.195] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.195] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.195] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.195] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.195] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.195] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.196] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.196] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.196] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.196] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.196] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.196] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.197] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.197] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.197] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.197] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0109.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.197] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", lpFilePart=0x0) returned 0x45 [0109.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", lpFilePart=0x0) returned 0x46 [0109.197] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0109.198] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.198] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.198] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.198] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.198] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.198] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.199] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.199] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.199] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.199] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.199] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.199] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.200] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.200] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.200] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.200] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0109.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.200] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", lpFilePart=0x0) returned 0x5f [0109.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.200] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.204] GetFileType (hFile=0x154) returned 0x1 [0109.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.204] GetFileType (hFile=0x154) returned 0x1 [0109.204] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xb67 [0109.204] ReadFile (in: hFile=0x154, lpBuffer=0x1b35698, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b35698*, lpNumberOfBytesRead=0x2ae478*=0xb67, lpOverlapped=0x0) returned 1 [0109.216] CloseHandle (hObject=0x154) returned 1 [0109.234] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", lpFilePart=0x0) returned 0x5f [0109.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.234] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.236] GetFileType (hFile=0x154) returned 0x1 [0109.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.236] GetFileType (hFile=0x154) returned 0x1 [0109.241] WriteFile (in: hFile=0x154, lpBuffer=0x1987138*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1987138*, lpNumberOfBytesWritten=0x2ae440*=0xb70, lpOverlapped=0x0) returned 1 [0109.242] CloseHandle (hObject=0x154) returned 1 [0109.242] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", lpFilePart=0x0) returned 0x5f [0109.242] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.anonymous", lpFilePart=0x0) returned 0x69 [0109.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.243] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2bb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8d78df0, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe00dbbf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb70)) returned 1 [0109.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.243] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.anonymous")) returned 1 [0109.244] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", lpFilePart=0x0) returned 0x5e [0109.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.244] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.244] GetFileType (hFile=0x154) returned 0x1 [0109.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.244] GetFileType (hFile=0x154) returned 0x1 [0109.244] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xb87 [0109.244] ReadFile (in: hFile=0x154, lpBuffer=0x19890e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19890e0*, lpNumberOfBytesRead=0x2ae478*=0xb87, lpOverlapped=0x0) returned 1 [0109.245] CloseHandle (hObject=0x154) returned 1 [0109.293] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", lpFilePart=0x0) returned 0x5e [0109.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.294] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.296] GetFileType (hFile=0x154) returned 0x1 [0109.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.296] GetFileType (hFile=0x154) returned 0x1 [0109.296] WriteFile (in: hFile=0x154, lpBuffer=0x19dab74*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19dab74*, lpNumberOfBytesWritten=0x2ae440*=0xb90, lpOverlapped=0x0) returned 1 [0109.297] CloseHandle (hObject=0x154) returned 1 [0109.298] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", lpFilePart=0x0) returned 0x5e [0109.298] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0109.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.298] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971c8d10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8d78df0, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe014e010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb90)) returned 1 [0109.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.298] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.anonymous")) returned 1 [0109.299] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", lpFilePart=0x0) returned 0x6a [0109.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.300] GetFileType (hFile=0x154) returned 0x1 [0109.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.300] GetFileType (hFile=0x154) returned 0x1 [0109.300] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbe2 [0109.300] ReadFile (in: hFile=0x154, lpBuffer=0x19dcba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19dcba8*, lpNumberOfBytesRead=0x2ae478*=0xbe2, lpOverlapped=0x0) returned 1 [0109.302] CloseHandle (hObject=0x154) returned 1 [0109.328] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", lpFilePart=0x0) returned 0x6a [0109.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.328] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.330] GetFileType (hFile=0x154) returned 0x1 [0109.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.330] GetFileType (hFile=0x154) returned 0x1 [0109.330] WriteFile (in: hFile=0x154, lpBuffer=0x1a2e6f4*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a2e6f4*, lpNumberOfBytesWritten=0x2ae440*=0xbf0, lpOverlapped=0x0) returned 1 [0109.331] CloseHandle (hObject=0x154) returned 1 [0109.332] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", lpFilePart=0x0) returned 0x6a [0109.332] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.anonymous", lpFilePart=0x0) returned 0x74 [0109.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.332] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97214fd0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8deb210, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe019a2d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0109.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.332] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.anonymous")) returned 1 [0109.333] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", lpFilePart=0x0) returned 0x68 [0109.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.333] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.333] GetFileType (hFile=0x154) returned 0x1 [0109.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.334] GetFileType (hFile=0x154) returned 0x1 [0109.334] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbd2 [0109.334] ReadFile (in: hFile=0x154, lpBuffer=0x1a30758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a30758*, lpNumberOfBytesRead=0x2ae478*=0xbd2, lpOverlapped=0x0) returned 1 [0109.348] CloseHandle (hObject=0x154) returned 1 [0109.366] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", lpFilePart=0x0) returned 0x68 [0109.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.366] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.367] GetFileType (hFile=0x154) returned 0x1 [0109.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.367] GetFileType (hFile=0x154) returned 0x1 [0109.368] WriteFile (in: hFile=0x154, lpBuffer=0x1a8224c*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a8224c*, lpNumberOfBytesWritten=0x2ae440*=0xbe0, lpOverlapped=0x0) returned 1 [0109.369] CloseHandle (hObject=0x154) returned 1 [0109.369] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", lpFilePart=0x0) returned 0x68 [0109.369] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.anonymous", lpFilePart=0x0) returned 0x72 [0109.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.369] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971eee70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8dc50b0, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe020c6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbe0)) returned 1 [0109.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.369] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.anonymous")) returned 1 [0109.370] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.370] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.371] GetFileType (hFile=0x154) returned 0x1 [0109.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.371] GetFileType (hFile=0x154) returned 0x1 [0109.371] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xb3f [0109.371] ReadFile (in: hFile=0x154, lpBuffer=0x1a841f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a841f0*, lpNumberOfBytesRead=0x2ae478*=0xb3f, lpOverlapped=0x0) returned 1 [0109.372] CloseHandle (hObject=0x154) returned 1 [0109.390] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.390] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.391] GetFileType (hFile=0x154) returned 0x1 [0109.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.391] GetFileType (hFile=0x154) returned 0x1 [0109.391] WriteFile (in: hFile=0x154, lpBuffer=0x1ad5998*, nNumberOfBytesToWrite=0xb40, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ad5998*, lpNumberOfBytesWritten=0x2ae440*=0xb40, lpOverlapped=0x0) returned 1 [0109.393] CloseHandle (hObject=0x154) returned 1 [0109.393] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.393] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.anonymous", lpFilePart=0x0) returned 0x6a [0109.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.393] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9723b130, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8deb210, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe0232850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb40)) returned 1 [0109.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.394] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.anonymous")) returned 1 [0109.398] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.398] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.398] GetFileType (hFile=0x154) returned 0x1 [0109.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.398] GetFileType (hFile=0x154) returned 0x1 [0109.398] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbd5 [0109.398] ReadFile (in: hFile=0x154, lpBuffer=0x1ad79a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ad79a4*, lpNumberOfBytesRead=0x2ae478*=0xbd5, lpOverlapped=0x0) returned 1 [0109.399] CloseHandle (hObject=0x154) returned 1 [0109.416] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.418] GetFileType (hFile=0x154) returned 0x1 [0109.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.418] GetFileType (hFile=0x154) returned 0x1 [0109.418] WriteFile (in: hFile=0x154, lpBuffer=0x1b29474*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b29474*, lpNumberOfBytesWritten=0x2ae440*=0xbe0, lpOverlapped=0x0) returned 1 [0109.420] CloseHandle (hObject=0x154) returned 1 [0109.420] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.420] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.anonymous", lpFilePart=0x0) returned 0x6a [0109.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.420] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9723b130, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8e11370, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe027eb10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbe0)) returned 1 [0109.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.420] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.anonymous")) returned 1 [0109.421] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", lpFilePart=0x0) returned 0x63 [0109.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.421] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.422] GetFileType (hFile=0x154) returned 0x1 [0109.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.422] GetFileType (hFile=0x154) returned 0x1 [0109.422] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xb79 [0109.422] ReadFile (in: hFile=0x154, lpBuffer=0x1b2b42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2b42c*, lpNumberOfBytesRead=0x2ae478*=0xb79, lpOverlapped=0x0) returned 1 [0109.424] CloseHandle (hObject=0x154) returned 1 [0109.441] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", lpFilePart=0x0) returned 0x63 [0109.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.443] GetFileType (hFile=0x154) returned 0x1 [0109.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.443] GetFileType (hFile=0x154) returned 0x1 [0109.443] WriteFile (in: hFile=0x154, lpBuffer=0x1b7cd20*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b7cd20*, lpNumberOfBytesWritten=0x2ae440*=0xb80, lpOverlapped=0x0) returned 1 [0109.444] CloseHandle (hObject=0x154) returned 1 [0109.444] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", lpFilePart=0x0) returned 0x63 [0109.444] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.anonymous", lpFilePart=0x0) returned 0x6d [0109.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.444] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9723b130, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8e11370, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe02cadd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb80)) returned 1 [0109.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.445] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.anonymous")) returned 1 [0109.445] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.446] GetFileType (hFile=0x154) returned 0x1 [0109.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.446] GetFileType (hFile=0x154) returned 0x1 [0109.446] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xb77 [0109.446] ReadFile (in: hFile=0x154, lpBuffer=0x1b7ecd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b7ecd8*, lpNumberOfBytesRead=0x2ae478*=0xb77, lpOverlapped=0x0) returned 1 [0109.455] CloseHandle (hObject=0x154) returned 1 [0109.508] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.508] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.510] GetFileType (hFile=0x154) returned 0x1 [0109.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.510] GetFileType (hFile=0x154) returned 0x1 [0109.510] WriteFile (in: hFile=0x154, lpBuffer=0x19cfc04*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19cfc04*, lpNumberOfBytesWritten=0x2ae440*=0xb80, lpOverlapped=0x0) returned 1 [0109.511] CloseHandle (hObject=0x154) returned 1 [0109.511] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", lpFilePart=0x0) returned 0x60 [0109.511] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.anonymous", lpFilePart=0x0) returned 0x6a [0109.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.511] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f7d570, ftCreationTime.dwHighDateTime=0x1d3022d, ftLastAccessTime.dwLowDateTime=0xb8fa36d0, ftLastAccessTime.dwHighDateTime=0x1d3022d, ftLastWriteTime.dwLowDateTime=0xe0363350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb80)) returned 1 [0109.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.512] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.anonymous")) returned 1 [0109.513] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", lpFilePart=0x0) returned 0x62 [0109.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.513] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.513] GetFileType (hFile=0x154) returned 0x1 [0109.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.513] GetFileType (hFile=0x154) returned 0x1 [0109.513] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbe1 [0109.513] ReadFile (in: hFile=0x154, lpBuffer=0x19d1c24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19d1c24*, lpNumberOfBytesRead=0x2ae478*=0xbe1, lpOverlapped=0x0) returned 1 [0109.515] CloseHandle (hObject=0x154) returned 1 [0109.527] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", lpFilePart=0x0) returned 0x62 [0109.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.528] GetFileType (hFile=0x154) returned 0x1 [0109.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.529] GetFileType (hFile=0x154) returned 0x1 [0109.529] WriteFile (in: hFile=0x154, lpBuffer=0x1a238ac*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a238ac*, lpNumberOfBytesWritten=0x2ae440*=0xbf0, lpOverlapped=0x0) returned 1 [0109.530] CloseHandle (hObject=0x154) returned 1 [0109.530] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", lpFilePart=0x0) returned 0x62 [0109.530] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.anonymous", lpFilePart=0x0) returned 0x6c [0109.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.530] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97261290, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8e11370, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe03894b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0109.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.530] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.anonymous")) returned 1 [0109.531] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", lpFilePart=0x0) returned 0x6d [0109.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.531] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.531] GetFileType (hFile=0x154) returned 0x1 [0109.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.531] GetFileType (hFile=0x154) returned 0x1 [0109.531] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbef [0109.531] ReadFile (in: hFile=0x154, lpBuffer=0x1a2590c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a2590c*, lpNumberOfBytesRead=0x2ae478*=0xbef, lpOverlapped=0x0) returned 1 [0109.538] CloseHandle (hObject=0x154) returned 1 [0109.550] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", lpFilePart=0x0) returned 0x6d [0109.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.550] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.551] GetFileType (hFile=0x154) returned 0x1 [0109.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.551] GetFileType (hFile=0x154) returned 0x1 [0109.552] WriteFile (in: hFile=0x154, lpBuffer=0x1a77454*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a77454*, lpNumberOfBytesWritten=0x2ae440*=0xbf0, lpOverlapped=0x0) returned 1 [0109.553] CloseHandle (hObject=0x154) returned 1 [0109.553] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", lpFilePart=0x0) returned 0x6d [0109.553] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.anonymous", lpFilePart=0x0) returned 0x77 [0109.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.553] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971c8d10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8d9ef50, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe03d5770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0109.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.553] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.anonymous")) returned 1 [0109.554] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", lpFilePart=0x0) returned 0x5e [0109.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.554] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.554] GetFileType (hFile=0x154) returned 0x1 [0109.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.554] GetFileType (hFile=0x154) returned 0x1 [0109.554] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xacf [0109.554] ReadFile (in: hFile=0x154, lpBuffer=0x1a79398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a79398*, lpNumberOfBytesRead=0x2ae478*=0xacf, lpOverlapped=0x0) returned 1 [0109.566] CloseHandle (hObject=0x154) returned 1 [0109.578] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", lpFilePart=0x0) returned 0x5e [0109.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.578] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.579] GetFileType (hFile=0x154) returned 0x1 [0109.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.579] GetFileType (hFile=0x154) returned 0x1 [0109.579] WriteFile (in: hFile=0x154, lpBuffer=0x1aca908*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1aca908*, lpNumberOfBytesWritten=0x2ae440*=0xad0, lpOverlapped=0x0) returned 1 [0109.580] CloseHandle (hObject=0x154) returned 1 [0109.580] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", lpFilePart=0x0) returned 0x5e [0109.581] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0109.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.581] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc22bb190, ftCreationTime.dwHighDateTime=0x1d30235, ftLastAccessTime.dwLowDateTime=0xc22bb190, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xe0421a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xad0)) returned 1 [0109.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.581] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.anonymous")) returned 1 [0109.581] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", lpFilePart=0x0) returned 0x5d [0109.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.582] GetFileType (hFile=0x154) returned 0x1 [0109.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.582] GetFileType (hFile=0x154) returned 0x1 [0109.582] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbcd [0109.582] ReadFile (in: hFile=0x154, lpBuffer=0x1acc8f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1acc8f0*, lpNumberOfBytesRead=0x2ae478*=0xbcd, lpOverlapped=0x0) returned 1 [0109.584] CloseHandle (hObject=0x154) returned 1 [0109.595] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", lpFilePart=0x0) returned 0x5d [0109.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.597] GetFileType (hFile=0x154) returned 0x1 [0109.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.597] GetFileType (hFile=0x154) returned 0x1 [0109.597] WriteFile (in: hFile=0x154, lpBuffer=0x1b1e358*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b1e358*, lpNumberOfBytesWritten=0x2ae440*=0xbd0, lpOverlapped=0x0) returned 1 [0109.598] CloseHandle (hObject=0x154) returned 1 [0109.598] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", lpFilePart=0x0) returned 0x5d [0109.598] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.anonymous", lpFilePart=0x0) returned 0x67 [0109.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.598] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97261290, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8e374d0, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe0447b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbd0)) returned 1 [0109.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.599] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.anonymous")) returned 1 [0109.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.599] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", lpFilePart=0x0) returned 0x61 [0109.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", lpFilePart=0x0) returned 0x62 [0109.599] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0109.600] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.601] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0109.601] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0109.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0109.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.602] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", lpFilePart=0x0) returned 0x61 [0109.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", lpFilePart=0x0) returned 0x62 [0109.602] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0109.603] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.604] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0109.605] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0109.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0109.606] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", lpFilePart=0x0) returned 0x8a [0109.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0109.606] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.607] GetFileType (hFile=0x154) returned 0x1 [0109.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0109.607] GetFileType (hFile=0x154) returned 0x1 [0109.607] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xba1 [0109.607] ReadFile (in: hFile=0x154, lpBuffer=0x1b24304, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b24304*, lpNumberOfBytesRead=0x2ae404*=0xba1, lpOverlapped=0x0) returned 1 [0109.608] CloseHandle (hObject=0x154) returned 1 [0109.620] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", lpFilePart=0x0) returned 0x8a [0109.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0109.620] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.622] GetFileType (hFile=0x154) returned 0x1 [0109.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0109.622] GetFileType (hFile=0x154) returned 0x1 [0109.622] WriteFile (in: hFile=0x154, lpBuffer=0x1b75d58*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b75d58*, lpNumberOfBytesWritten=0x2ae3cc*=0xbb0, lpOverlapped=0x0) returned 1 [0109.623] CloseHandle (hObject=0x154) returned 1 [0109.623] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", lpFilePart=0x0) returned 0x8a [0109.623] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.anonymous", lpFilePart=0x0) returned 0x94 [0109.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0109.623] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717ca50, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xc22bb190, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xe046dcf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbb0)) returned 1 [0109.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0109.623] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.anonymous")) returned 1 [0109.624] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", lpFilePart=0x0) returned 0x7e [0109.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0109.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.624] GetFileType (hFile=0x154) returned 0x1 [0109.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0109.624] GetFileType (hFile=0x154) returned 0x1 [0109.624] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb65 [0109.624] ReadFile (in: hFile=0x154, lpBuffer=0x1b77e30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b77e30*, lpNumberOfBytesRead=0x2ae404*=0xb65, lpOverlapped=0x0) returned 1 [0109.626] CloseHandle (hObject=0x154) returned 1 [0109.663] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", lpFilePart=0x0) returned 0x7e [0109.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0109.663] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.664] GetFileType (hFile=0x154) returned 0x1 [0109.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0109.664] GetFileType (hFile=0x154) returned 0x1 [0109.664] WriteFile (in: hFile=0x154, lpBuffer=0x19c9ea0*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c9ea0*, lpNumberOfBytesWritten=0x2ae3cc*=0xb70, lpOverlapped=0x0) returned 1 [0109.665] CloseHandle (hObject=0x154) returned 1 [0109.665] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", lpFilePart=0x0) returned 0x7e [0109.665] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.anonymous", lpFilePart=0x0) returned 0x88 [0109.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0109.665] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97130790, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xc226eed0, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xe04e0110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb70)) returned 1 [0109.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0109.666] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.anonymous")) returned 1 [0109.666] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", lpFilePart=0x0) returned 0x90 [0109.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0109.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.667] GetFileType (hFile=0x154) returned 0x1 [0109.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0109.667] GetFileType (hFile=0x154) returned 0x1 [0109.667] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xabf [0109.667] ReadFile (in: hFile=0x154, lpBuffer=0x19cbed0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cbed0*, lpNumberOfBytesRead=0x2ae404*=0xabf, lpOverlapped=0x0) returned 1 [0109.668] CloseHandle (hObject=0x154) returned 1 [0109.681] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", lpFilePart=0x0) returned 0x90 [0109.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0109.681] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.682] GetFileType (hFile=0x154) returned 0x1 [0109.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0109.682] GetFileType (hFile=0x154) returned 0x1 [0109.682] WriteFile (in: hFile=0x154, lpBuffer=0x1a1d5dc*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1d5dc*, lpNumberOfBytesWritten=0x2ae3cc*=0xac0, lpOverlapped=0x0) returned 1 [0109.683] CloseHandle (hObject=0x154) returned 1 [0109.684] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", lpFilePart=0x0) returned 0x90 [0109.684] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.anonymous", lpFilePart=0x0) returned 0x9a [0109.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0109.684] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2bb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xc22bb190, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xe0506270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xac0)) returned 1 [0109.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0109.684] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.anonymous")) returned 1 [0109.685] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", lpFilePart=0x0) returned 0x89 [0109.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0109.685] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.685] GetFileType (hFile=0x154) returned 0x1 [0109.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0109.685] GetFileType (hFile=0x154) returned 0x1 [0109.685] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb15 [0109.686] ReadFile (in: hFile=0x154, lpBuffer=0x1a1f6b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1f6b0*, lpNumberOfBytesRead=0x2ae404*=0xb15, lpOverlapped=0x0) returned 1 [0109.694] CloseHandle (hObject=0x154) returned 1 [0109.706] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", lpFilePart=0x0) returned 0x89 [0109.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0109.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.707] GetFileType (hFile=0x154) returned 0x1 [0109.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0109.707] GetFileType (hFile=0x154) returned 0x1 [0109.707] WriteFile (in: hFile=0x154, lpBuffer=0x1a70e28*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a70e28*, lpNumberOfBytesWritten=0x2ae3cc*=0xb20, lpOverlapped=0x0) returned 1 [0109.708] CloseHandle (hObject=0x154) returned 1 [0109.709] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", lpFilePart=0x0) returned 0x89 [0109.709] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.anonymous", lpFilePart=0x0) returned 0x93 [0109.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0109.709] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717ca50, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xc2295030, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xe0552530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb20)) returned 1 [0109.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0109.709] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.anonymous")) returned 1 [0109.710] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", lpFilePart=0x0) returned 0x86 [0109.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0109.710] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.710] GetFileType (hFile=0x154) returned 0x1 [0109.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0109.710] GetFileType (hFile=0x154) returned 0x1 [0109.710] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xb3b [0109.710] ReadFile (in: hFile=0x154, lpBuffer=0x1a72ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a72ee8*, lpNumberOfBytesRead=0x2ae404*=0xb3b, lpOverlapped=0x0) returned 1 [0109.726] CloseHandle (hObject=0x154) returned 1 [0109.739] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", lpFilePart=0x0) returned 0x86 [0109.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0109.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.741] GetFileType (hFile=0x154) returned 0x1 [0109.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0109.741] GetFileType (hFile=0x154) returned 0x1 [0109.741] WriteFile (in: hFile=0x154, lpBuffer=0x1ac46f4*, nNumberOfBytesToWrite=0xb40, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ac46f4*, lpNumberOfBytesWritten=0x2ae3cc*=0xb40, lpOverlapped=0x0) returned 1 [0109.742] CloseHandle (hObject=0x154) returned 1 [0109.742] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", lpFilePart=0x0) returned 0x86 [0109.742] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.anonymous", lpFilePart=0x0) returned 0x90 [0109.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0109.742] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971568f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xc2295030, ftLastAccessTime.dwHighDateTime=0x1d30235, ftLastWriteTime.dwLowDateTime=0xe059e7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb40)) returned 1 [0109.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0109.743] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.anonymous")) returned 1 [0109.743] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", lpFilePart=0x0) returned 0x8c [0109.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0109.744] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.744] GetFileType (hFile=0x154) returned 0x1 [0109.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0109.744] GetFileType (hFile=0x154) returned 0x1 [0109.744] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xbb7 [0109.744] ReadFile (in: hFile=0x154, lpBuffer=0x1ac683c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac683c*, lpNumberOfBytesRead=0x2ae404*=0xbb7, lpOverlapped=0x0) returned 1 [0109.765] CloseHandle (hObject=0x154) returned 1 [0109.777] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", lpFilePart=0x0) returned 0x8c [0109.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0109.777] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.778] GetFileType (hFile=0x154) returned 0x1 [0109.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0109.778] GetFileType (hFile=0x154) returned 0x1 [0109.778] WriteFile (in: hFile=0x154, lpBuffer=0x1b182e4*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b182e4*, lpNumberOfBytesWritten=0x2ae3cc*=0xbc0, lpOverlapped=0x0) returned 1 [0109.779] CloseHandle (hObject=0x154) returned 1 [0109.779] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", lpFilePart=0x0) returned 0x8c [0109.779] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.anonymous", lpFilePart=0x0) returned 0x96 [0109.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0109.780] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f7d570, ftCreationTime.dwHighDateTime=0x1d3022d, ftLastAccessTime.dwLowDateTime=0xb8f7d570, ftLastAccessTime.dwHighDateTime=0x1d3022d, ftLastWriteTime.dwLowDateTime=0xe05eaab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbc0)) returned 1 [0109.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0109.780] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.anonymous")) returned 1 [0109.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.781] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", lpFilePart=0x0) returned 0x3f [0109.781] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", lpFilePart=0x0) returned 0x40 [0109.781] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0109.782] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.782] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.782] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.782] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0109.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.783] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", lpFilePart=0x0) returned 0x3f [0109.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", lpFilePart=0x0) returned 0x40 [0109.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0109.784] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.785] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.785] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.785] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0109.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.786] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", lpFilePart=0x0) returned 0x67 [0109.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0109.786] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.787] GetFileType (hFile=0x154) returned 0x1 [0109.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0109.787] GetFileType (hFile=0x154) returned 0x1 [0109.787] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xbef [0109.787] ReadFile (in: hFile=0x154, lpBuffer=0x1b1bde4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b1bde4*, lpNumberOfBytesRead=0x2ae478*=0xbef, lpOverlapped=0x0) returned 1 [0109.807] CloseHandle (hObject=0x154) returned 1 [0109.820] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", lpFilePart=0x0) returned 0x67 [0109.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0109.820] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0109.822] GetFileType (hFile=0x154) returned 0x1 [0109.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0109.822] GetFileType (hFile=0x154) returned 0x1 [0109.822] WriteFile (in: hFile=0x154, lpBuffer=0x1b6d920*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b6d920*, lpNumberOfBytesWritten=0x2ae440*=0xbf0, lpOverlapped=0x0) returned 1 [0109.823] CloseHandle (hObject=0x154) returned 1 [0109.823] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", lpFilePart=0x0) returned 0x67 [0109.823] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.anonymous", lpFilePart=0x0) returned 0x71 [0109.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0109.823] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971eee70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0xb8d9ef50, ftLastAccessTime.dwHighDateTime=0x1d3008f, ftLastWriteTime.dwLowDateTime=0xe065ced0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0109.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.823] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.anonymous" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.anonymous")) returned 1 [0109.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.824] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x3c [0109.824] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x3d [0109.824] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0109.824] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.825] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.825] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.825] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.825] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x3c [0109.825] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x3d [0109.825] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0109.825] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.825] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.825] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.825] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.826] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", lpFilePart=0x0) returned 0x3e [0109.826] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", lpFilePart=0x0) returned 0x3f [0109.826] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0109.826] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.826] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.826] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.826] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", lpFilePart=0x0) returned 0x3e [0109.827] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", lpFilePart=0x0) returned 0x3f [0109.827] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0109.827] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.827] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.827] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.827] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2a [0109.827] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x2b [0109.827] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.828] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.828] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.828] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.828] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2a [0109.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x2b [0109.828] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.828] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.828] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.828] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.829] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x24 [0109.829] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x25 [0109.829] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.829] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.829] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.829] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.829] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.829] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.830] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x24 [0109.831] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x25 [0109.831] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.831] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.832] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.832] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.832] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.832] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.832] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x32 [0109.832] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x33 [0109.832] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.832] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.832] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.833] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.833] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x32 [0109.833] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x33 [0109.833] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.833] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.833] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.833] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.833] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", lpFilePart=0x0) returned 0x30 [0109.833] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", lpFilePart=0x0) returned 0x31 [0109.834] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.834] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.834] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.834] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.834] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", lpFilePart=0x0) returned 0x30 [0109.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", lpFilePart=0x0) returned 0x31 [0109.834] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.834] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.834] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.835] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0109.835] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0109.835] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\", lpFilePart=0x0) returned 0x2a [0109.835] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0109.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.835] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0109.836] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0109.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0109.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0109.836] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29 [0109.836] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\", lpFilePart=0x0) returned 0x2a [0109.836] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0109.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.836] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0109.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0109.837] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0109.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0109.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.837] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c [0109.837] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", lpFilePart=0x0) returned 0x3d [0109.837] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.837] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.838] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.838] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c [0109.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", lpFilePart=0x0) returned 0x3d [0109.838] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.838] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.839] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.839] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43 [0109.839] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", lpFilePart=0x0) returned 0x44 [0109.839] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.839] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.840] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.840] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43 [0109.840] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", lpFilePart=0x0) returned 0x44 [0109.840] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.840] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.841] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.841] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44 [0109.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", lpFilePart=0x0) returned 0x45 [0109.841] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.841] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.841] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.842] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44 [0109.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", lpFilePart=0x0) returned 0x45 [0109.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.842] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.842] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.842] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.842] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}", lpFilePart=0x0) returned 0x63 [0109.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\", lpFilePart=0x0) returned 0x64 [0109.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.842] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.843] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.843] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}", lpFilePart=0x0) returned 0x63 [0109.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\", lpFilePart=0x0) returned 0x64 [0109.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.843] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.844] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.844] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33 [0109.844] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", lpFilePart=0x0) returned 0x34 [0109.844] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.844] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.844] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.845] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33 [0109.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", lpFilePart=0x0) returned 0x34 [0109.845] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.845] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.845] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.845] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.845] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34 [0109.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", lpFilePart=0x0) returned 0x35 [0109.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.865] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.865] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34 [0109.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", lpFilePart=0x0) returned 0x35 [0109.865] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.865] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.865] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.866] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x2f [0109.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\", lpFilePart=0x0) returned 0x30 [0109.866] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.867] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.868] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.868] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.868] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0109.869] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x2f [0109.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\", lpFilePart=0x0) returned 0x30 [0109.869] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0109.870] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0109.870] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0109.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0109.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0109.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.871] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore", lpFilePart=0x0) returned 0x3a [0109.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\", lpFilePart=0x0) returned 0x3b [0109.874] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0109.893] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.893] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.893] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.893] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.894] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.894] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.894] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0109.895] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore", lpFilePart=0x0) returned 0x3a [0109.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\", lpFilePart=0x0) returned 0x3b [0109.895] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0109.896] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.896] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.896] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.896] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.896] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0109.897] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0109.897] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0109.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0109.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.898] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries", lpFilePart=0x0) returned 0x42 [0109.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\", lpFilePart=0x0) returned 0x43 [0109.898] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0109.929] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.929] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.929] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.929] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.929] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.929] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.930] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.931] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.932] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries", lpFilePart=0x0) returned 0x42 [0109.932] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\", lpFilePart=0x0) returned 0x43 [0109.932] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0109.933] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.934] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.935] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.936] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.937] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData", lpFilePart=0x0) returned 0x47 [0109.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\", lpFilePart=0x0) returned 0x48 [0109.937] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0109.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.957] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.957] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.957] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.957] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0109.958] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData", lpFilePart=0x0) returned 0x47 [0109.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\", lpFilePart=0x0) returned 0x48 [0109.958] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0109.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0109.960] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0109.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0109.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.961] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E", lpFilePart=0x0) returned 0x4a [0109.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\", lpFilePart=0x0) returned 0x4b [0109.961] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0109.963] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0109.964] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0109.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.964] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E", lpFilePart=0x0) returned 0x4a [0109.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\", lpFilePart=0x0) returned 0x4b [0109.964] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0109.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0109.964] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0109.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.964] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21", lpFilePart=0x0) returned 0x4a [0109.965] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\", lpFilePart=0x0) returned 0x4b [0109.965] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0109.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0109.968] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0109.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.968] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21", lpFilePart=0x0) returned 0x4a [0109.968] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\", lpFilePart=0x0) returned 0x4b [0109.968] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0109.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.969] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0109.969] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0109.969] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0109.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0109.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0109.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0109.969] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A", lpFilePart=0x0) returned 0x4a [0109.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\", lpFilePart=0x0) returned 0x4b [0109.969] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.123] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.123] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A", lpFilePart=0x0) returned 0x4a [0110.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\", lpFilePart=0x0) returned 0x4b [0110.123] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.124] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.124] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38", lpFilePart=0x0) returned 0x4a [0110.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\", lpFilePart=0x0) returned 0x4b [0110.124] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.125] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.125] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38", lpFilePart=0x0) returned 0x4a [0110.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\", lpFilePart=0x0) returned 0x4b [0110.125] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.125] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.125] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.125] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.125] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.125] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53", lpFilePart=0x0) returned 0x4a [0110.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\", lpFilePart=0x0) returned 0x4b [0110.125] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.126] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.126] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.126] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.126] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.126] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53", lpFilePart=0x0) returned 0x4a [0110.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\", lpFilePart=0x0) returned 0x4b [0110.126] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.126] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.126] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.126] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.127] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.127] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54", lpFilePart=0x0) returned 0x4a [0110.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\", lpFilePart=0x0) returned 0x4b [0110.127] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.169] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.169] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.169] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.169] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.170] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54", lpFilePart=0x0) returned 0x4a [0110.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\", lpFilePart=0x0) returned 0x4b [0110.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.170] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.170] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.170] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.170] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.170] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66", lpFilePart=0x0) returned 0x4a [0110.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\", lpFilePart=0x0) returned 0x4b [0110.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.290] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.290] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.290] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.290] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.290] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66", lpFilePart=0x0) returned 0x4a [0110.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\", lpFilePart=0x0) returned 0x4b [0110.290] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.291] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.291] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.291] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.291] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.291] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68", lpFilePart=0x0) returned 0x4a [0110.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\", lpFilePart=0x0) returned 0x4b [0110.291] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.300] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.300] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.300] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.300] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.301] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68", lpFilePart=0x0) returned 0x4a [0110.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\", lpFilePart=0x0) returned 0x4b [0110.301] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.301] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.301] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.301] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.301] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.301] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8", lpFilePart=0x0) returned 0x4a [0110.301] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\", lpFilePart=0x0) returned 0x4b [0110.301] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.306] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.306] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8", lpFilePart=0x0) returned 0x4a [0110.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\", lpFilePart=0x0) returned 0x4b [0110.306] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.306] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.306] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.306] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8", lpFilePart=0x0) returned 0x4a [0110.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\", lpFilePart=0x0) returned 0x4b [0110.306] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.315] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.315] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.315] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.315] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.315] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8", lpFilePart=0x0) returned 0x4a [0110.315] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\", lpFilePart=0x0) returned 0x4b [0110.315] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.316] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.316] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9", lpFilePart=0x0) returned 0x4a [0110.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\", lpFilePart=0x0) returned 0x4b [0110.316] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.316] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.317] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9", lpFilePart=0x0) returned 0x4a [0110.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\", lpFilePart=0x0) returned 0x4b [0110.317] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.317] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.317] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4", lpFilePart=0x0) returned 0x4a [0110.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\", lpFilePart=0x0) returned 0x4b [0110.317] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.322] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.322] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4", lpFilePart=0x0) returned 0x4a [0110.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\", lpFilePart=0x0) returned 0x4b [0110.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.322] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.322] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA", lpFilePart=0x0) returned 0x4a [0110.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\", lpFilePart=0x0) returned 0x4b [0110.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.325] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.325] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA", lpFilePart=0x0) returned 0x4a [0110.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\", lpFilePart=0x0) returned 0x4b [0110.325] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.326] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.326] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources", lpFilePart=0x0) returned 0x44 [0110.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\", lpFilePart=0x0) returned 0x45 [0110.326] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.363] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.365] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources", lpFilePart=0x0) returned 0x44 [0110.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\", lpFilePart=0x0) returned 0x45 [0110.365] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.366] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.367] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E", lpFilePart=0x0) returned 0x47 [0110.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\", lpFilePart=0x0) returned 0x48 [0110.367] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.368] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.368] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E", lpFilePart=0x0) returned 0x47 [0110.368] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\", lpFilePart=0x0) returned 0x48 [0110.368] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.368] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.369] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21", lpFilePart=0x0) returned 0x47 [0110.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\", lpFilePart=0x0) returned 0x48 [0110.369] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.369] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.369] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21", lpFilePart=0x0) returned 0x47 [0110.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\", lpFilePart=0x0) returned 0x48 [0110.369] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.369] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.369] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A", lpFilePart=0x0) returned 0x47 [0110.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\", lpFilePart=0x0) returned 0x48 [0110.369] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.377] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.377] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A", lpFilePart=0x0) returned 0x47 [0110.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\", lpFilePart=0x0) returned 0x48 [0110.377] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.377] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.377] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38", lpFilePart=0x0) returned 0x47 [0110.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\", lpFilePart=0x0) returned 0x48 [0110.377] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.378] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.378] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38", lpFilePart=0x0) returned 0x47 [0110.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\", lpFilePart=0x0) returned 0x48 [0110.378] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.378] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.378] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53", lpFilePart=0x0) returned 0x47 [0110.378] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\", lpFilePart=0x0) returned 0x48 [0110.378] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.379] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.379] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53", lpFilePart=0x0) returned 0x47 [0110.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\", lpFilePart=0x0) returned 0x48 [0110.379] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.379] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.379] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54", lpFilePart=0x0) returned 0x47 [0110.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\", lpFilePart=0x0) returned 0x48 [0110.379] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.380] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.380] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54", lpFilePart=0x0) returned 0x47 [0110.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\", lpFilePart=0x0) returned 0x48 [0110.380] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.380] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.380] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66", lpFilePart=0x0) returned 0x47 [0110.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\", lpFilePart=0x0) returned 0x48 [0110.380] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.389] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.390] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66", lpFilePart=0x0) returned 0x47 [0110.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\", lpFilePart=0x0) returned 0x48 [0110.390] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.390] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.390] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68", lpFilePart=0x0) returned 0x47 [0110.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\", lpFilePart=0x0) returned 0x48 [0110.390] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.391] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.391] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68", lpFilePart=0x0) returned 0x47 [0110.391] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\", lpFilePart=0x0) returned 0x48 [0110.391] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.391] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.391] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8", lpFilePart=0x0) returned 0x47 [0110.391] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\", lpFilePart=0x0) returned 0x48 [0110.391] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.391] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.391] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8", lpFilePart=0x0) returned 0x47 [0110.391] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\", lpFilePart=0x0) returned 0x48 [0110.392] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.392] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.392] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8", lpFilePart=0x0) returned 0x47 [0110.392] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\", lpFilePart=0x0) returned 0x48 [0110.392] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.392] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.393] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8", lpFilePart=0x0) returned 0x47 [0110.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\", lpFilePart=0x0) returned 0x48 [0110.393] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.393] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.393] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9", lpFilePart=0x0) returned 0x47 [0110.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\", lpFilePart=0x0) returned 0x48 [0110.393] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.394] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.394] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9", lpFilePart=0x0) returned 0x47 [0110.394] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\", lpFilePart=0x0) returned 0x48 [0110.394] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.394] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.394] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4", lpFilePart=0x0) returned 0x47 [0110.394] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\", lpFilePart=0x0) returned 0x48 [0110.394] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.395] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.395] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4", lpFilePart=0x0) returned 0x47 [0110.395] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\", lpFilePart=0x0) returned 0x48 [0110.395] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.395] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.395] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA", lpFilePart=0x0) returned 0x47 [0110.395] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\", lpFilePart=0x0) returned 0x48 [0110.395] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.396] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.396] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA", lpFilePart=0x0) returned 0x47 [0110.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\", lpFilePart=0x0) returned 0x48 [0110.396] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.396] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.396] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x37 [0110.396] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\", lpFilePart=0x0) returned 0x38 [0110.396] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.396] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.396] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x37 [0110.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\", lpFilePart=0x0) returned 0x38 [0110.397] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.397] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.397] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44 [0110.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", lpFilePart=0x0) returned 0x45 [0110.397] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.397] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.397] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44 [0110.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", lpFilePart=0x0) returned 0x45 [0110.397] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.397] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.397] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f [0110.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", lpFilePart=0x0) returned 0x40 [0110.398] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.398] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.398] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f [0110.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", lpFilePart=0x0) returned 0x40 [0110.398] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.399] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.399] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick", lpFilePart=0x0) returned 0x45 [0110.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\", lpFilePart=0x0) returned 0x46 [0110.399] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.399] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.400] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick", lpFilePart=0x0) returned 0x45 [0110.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\", lpFilePart=0x0) returned 0x46 [0110.400] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.400] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.400] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", lpFilePart=0x0) returned 0x48 [0110.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", lpFilePart=0x0) returned 0x49 [0110.400] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.412] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.413] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", lpFilePart=0x0) returned 0x48 [0110.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", lpFilePart=0x0) returned 0x49 [0110.413] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0110.414] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.414] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x3f [0110.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", lpFilePart=0x0) returned 0x40 [0110.415] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.415] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.415] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x3f [0110.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", lpFilePart=0x0) returned 0x40 [0110.415] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.415] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.415] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x31 [0110.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\", lpFilePart=0x0) returned 0x32 [0110.415] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0110.415] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.415] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows Defender\\Support", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x31 [0110.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\", lpFilePart=0x0) returned 0x32 [0110.416] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0110.416] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.416] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x23 [0110.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\", lpFilePart=0x0) returned 0x24 [0110.416] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0110.416] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.416] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x23 [0110.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\", lpFilePart=0x0) returned 0x24 [0110.416] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0110.416] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.416] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax", lpFilePart=0x0) returned 0x29 [0110.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", lpFilePart=0x0) returned 0x2a [0110.417] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0110.418] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.419] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax", lpFilePart=0x0) returned 0x29 [0110.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", lpFilePart=0x0) returned 0x2a [0110.419] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0110.420] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.421] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", lpFilePart=0x0) returned 0x35 [0110.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", lpFilePart=0x0) returned 0x36 [0110.421] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.422] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.422] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", lpFilePart=0x0) returned 0x35 [0110.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", lpFilePart=0x0) returned 0x36 [0110.422] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.422] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.422] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", lpFilePart=0x0) returned 0x3b [0110.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", lpFilePart=0x0) returned 0x3c [0110.422] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.423] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.423] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", lpFilePart=0x0) returned 0x3b [0110.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", lpFilePart=0x0) returned 0x3c [0110.423] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.423] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.423] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", lpFilePart=0x0) returned 0x41 [0110.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", lpFilePart=0x0) returned 0x42 [0110.423] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.424] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.424] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.424] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.424] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.425] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.425] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.425] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.425] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.425] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.426] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.426] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.426] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.426] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.426] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.427] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.427] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.427] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.427] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.427] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.427] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0110.427] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.427] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0110.428] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.428] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.428] GetFileType (hFile=0x154) returned 0x1 [0110.428] GetFileType (hFile=0x154) returned 0x1 [0110.428] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7e148 [0110.430] ReadFile (in: hFile=0x154, lpBuffer=0xbe54348, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0xbe54348*, lpNumberOfBytesRead=0x2ae560*=0x7e148, lpOverlapped=0x0) returned 1 [0110.447] CloseHandle (hObject=0x154) returned 1 [0110.511] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad328) returned 1 [0110.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.513] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20 [0110.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21 [0110.513] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.513] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.513] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.513] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.514] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.514] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20 [0110.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21 [0110.514] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.514] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.514] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.514] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.514] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.514] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29 [0110.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a [0110.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.515] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.515] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.515] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.515] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29 [0110.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a [0110.515] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.516] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.516] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.516] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.516] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d [0110.516] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e [0110.516] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.530] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.532] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.532] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.532] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.532] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.532] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.532] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.533] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.534] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.535] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.536] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.536] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.536] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.536] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.536] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.537] GetFullPathNameW (in: lpFileName="\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d [0110.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e [0110.537] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.538] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.539] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.539] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.539] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.539] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.539] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.539] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.540] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.541] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.542] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.543] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.543] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.543] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.543] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.543] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.543] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.544] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.544] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.544] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.544] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.545] GetFullPathNameW (in: lpFileName="\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16 [0110.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17 [0110.545] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.545] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.546] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.546] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.546] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.546] GetFullPathNameW (in: lpFileName="\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16 [0110.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17 [0110.546] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.546] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.546] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.547] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.547] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.547] GetFullPathNameW (in: lpFileName="\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b [0110.547] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c [0110.547] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.547] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.548] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.548] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.548] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.548] GetFullPathNameW (in: lpFileName="\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b [0110.548] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c [0110.548] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.548] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.548] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.548] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.549] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.549] GetFullPathNameW (in: lpFileName="\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15 [0110.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\", lpFilePart=0x0) returned 0x16 [0110.549] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.549] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.550] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.550] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.550] GetFullPathNameW (in: lpFileName="\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15 [0110.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\", lpFilePart=0x0) returned 0x16 [0110.550] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.550] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.550] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.550] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.551] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c [0110.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\", lpFilePart=0x0) returned 0x1d [0110.551] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.552] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.553] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.553] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.553] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.553] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.553] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.553] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.553] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.554] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c [0110.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\", lpFilePart=0x0) returned 0x1d [0110.555] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.556] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.557] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.557] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.557] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.557] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.558] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", lpFilePart=0x0) returned 0x45 [0110.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", lpFilePart=0x0) returned 0x46 [0110.558] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.559] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.560] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.560] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.560] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.560] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", lpFilePart=0x0) returned 0x45 [0110.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", lpFilePart=0x0) returned 0x46 [0110.560] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.560] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.560] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.561] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.561] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.561] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", lpFilePart=0x0) returned 0x4e [0110.561] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", lpFilePart=0x0) returned 0x4f [0110.561] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.562] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.562] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.562] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.562] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.562] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", lpFilePart=0x0) returned 0x4e [0110.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", lpFilePart=0x0) returned 0x4f [0110.562] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.562] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.563] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.563] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.563] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.563] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0110.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0110.563] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.564] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.564] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.564] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.564] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.564] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0110.564] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0110.564] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.565] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.565] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.565] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.565] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.565] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x58 [0110.565] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x59 [0110.565] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.565] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.565] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.565] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.565] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.566] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x58 [0110.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x59 [0110.566] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.566] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.566] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.566] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.566] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.566] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", lpFilePart=0x0) returned 0x45 [0110.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", lpFilePart=0x0) returned 0x46 [0110.566] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.577] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.577] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.577] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.577] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.577] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", lpFilePart=0x0) returned 0x45 [0110.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", lpFilePart=0x0) returned 0x46 [0110.577] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.577] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.578] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.578] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.578] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.578] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", lpFilePart=0x0) returned 0x4e [0110.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", lpFilePart=0x0) returned 0x4f [0110.578] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.579] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.579] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.579] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.579] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.579] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", lpFilePart=0x0) returned 0x4e [0110.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", lpFilePart=0x0) returned 0x4f [0110.579] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.579] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.579] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.579] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.580] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.580] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0110.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0110.580] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.580] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.580] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.580] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.580] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.580] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0110.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0110.580] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.581] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.581] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.581] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.581] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.581] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x58 [0110.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x59 [0110.581] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.581] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.581] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.581] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.581] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.582] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x58 [0110.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x59 [0110.582] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.582] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.582] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.582] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.582] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.582] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e [0110.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0110.582] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.584] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.584] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.584] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.584] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.585] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e [0110.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0110.585] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.585] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.585] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.585] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.585] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.585] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0110.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58 [0110.585] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.586] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.586] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.586] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.586] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.586] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0110.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58 [0110.586] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.586] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.586] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.586] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.586] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.587] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c [0110.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d [0110.587] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.587] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.588] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.588] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c [0110.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d [0110.588] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.588] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.588] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.589] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43 [0110.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x44 [0110.589] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.589] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.589] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43 [0110.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x44 [0110.589] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.589] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.590] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.590] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f [0110.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0110.590] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.590] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.590] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.590] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.591] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.591] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f [0110.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0110.591] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.591] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.591] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.591] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.591] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.591] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0110.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0110.591] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.592] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.592] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.592] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.592] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.592] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0110.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0110.592] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.592] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.592] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.593] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.593] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.593] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d [0110.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6e [0110.593] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.593] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.593] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.594] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.594] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.594] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.594] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d [0110.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6e [0110.594] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.594] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.594] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.594] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.594] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.594] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.594] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f [0110.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0110.595] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.595] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.595] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.595] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.595] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.595] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f [0110.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0110.596] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.596] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.596] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.596] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.596] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.596] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0110.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0110.596] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.597] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.597] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.597] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.597] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.597] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0110.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0110.597] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.597] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.597] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.597] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.597] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.598] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70 [0110.598] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x71 [0110.598] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.598] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.598] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.598] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.598] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.598] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.599] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70 [0110.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x71 [0110.599] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.599] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.599] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.599] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.599] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.599] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.599] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x4e [0110.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x4f [0110.599] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.599] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.600] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.600] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.600] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.600] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x4e [0110.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x4f [0110.600] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.600] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.600] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.600] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.600] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.600] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57 [0110.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58 [0110.600] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.601] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.601] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.601] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57 [0110.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58 [0110.601] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.601] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.601] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f [0110.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70 [0110.601] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.602] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.602] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f [0110.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70 [0110.602] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.602] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.602] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x4e [0110.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x4f [0110.602] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.602] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.603] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x4e [0110.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x4f [0110.603] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.603] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.603] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57 [0110.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58 [0110.603] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.603] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.603] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57 [0110.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58 [0110.603] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.604] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.604] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c [0110.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d [0110.604] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.604] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.604] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c [0110.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d [0110.604] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.604] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.605] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x43 [0110.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x44 [0110.605] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.605] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.605] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x43 [0110.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x44 [0110.605] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.605] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.605] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x43 [0110.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x44 [0110.606] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.606] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.606] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x43 [0110.606] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x44 [0110.606] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.606] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.606] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x4e [0110.606] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0110.606] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.607] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.607] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x4e [0110.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0110.607] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.608] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.608] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0110.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58 [0110.608] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.608] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.608] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0110.608] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58 [0110.608] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.608] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.608] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f [0110.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70 [0110.609] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.609] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.609] GetFullPathNameW (in: lpFileName="\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f [0110.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70 [0110.609] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.609] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.609] GetFullPathNameW (in: lpFileName="\\ProgramData\\Start Menu", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu", lpFilePart=0x0) returned 0x19 [0110.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\", lpFilePart=0x0) returned 0x1a [0110.609] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0110.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0110.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.610] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0110.610] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13 [0110.611] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.611] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.611] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0110.611] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13 [0110.611] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0110.611] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.611] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17 [0110.611] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18 [0110.611] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.612] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.612] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17 [0110.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18 [0110.612] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0110.612] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.613] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23 [0110.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24 [0110.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.613] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.613] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23 [0110.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24 [0110.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.614] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.614] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0110.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0110.614] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.614] GetFileType (hFile=0x154) returned 0x1 [0110.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0110.614] GetFileType (hFile=0x154) returned 0x1 [0110.614] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x77 [0110.615] CloseHandle (hObject=0x154) returned 1 [0110.649] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0110.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0110.649] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.650] GetFileType (hFile=0x154) returned 0x1 [0110.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0110.650] GetFileType (hFile=0x154) returned 0x1 [0110.650] WriteFile (in: hFile=0x154, lpBuffer=0x1ac3db8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1ac3db8*, lpNumberOfBytesWritten=0x2ae528*=0x80, lpOverlapped=0x0) returned 1 [0110.651] CloseHandle (hObject=0x154) returned 1 [0110.651] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0110.651] GetFullPathNameW (in: lpFileName="\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.anonymous", lpFilePart=0x0) returned 0x3c [0110.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0110.651] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70634730, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x70634730, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xe0e3f7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0110.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.652] MoveFileW (lpExistingFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), lpNewFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.anonymous" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml.anonymous")) returned 1 [0110.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.652] GetFullPathNameW (in: lpFileName="\\ProgramData\\Templates", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates", lpFilePart=0x0) returned 0x18 [0110.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\", lpFilePart=0x0) returned 0x19 [0110.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0110.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0110.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0110.653] GetFullPathNameW (in: lpFileName="\\Recovery", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0110.653] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0110.654] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbed58 [0110.654] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.654] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.655] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0110.655] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0110.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0110.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0110.655] GetFullPathNameW (in: lpFileName="\\Recovery", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0110.655] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0110.655] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbed58 [0110.655] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.655] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.655] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0110.655] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.656] GetFullPathNameW (in: lpFileName="\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae", lpFilePart=0x0) returned 0x30 [0110.656] GetFullPathNameW (in: lpFileName="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae\\", lpFilePart=0x0) returned 0x31 [0110.656] FindFirstFileW (in: lpFileName="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0110.656] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.657] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.657] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.657] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.657] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.657] GetFullPathNameW (in: lpFileName="\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae", lpFilePart=0x0) returned 0x30 [0110.657] GetFullPathNameW (in: lpFileName="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae\\", lpFilePart=0x0) returned 0x31 [0110.657] FindFirstFileW (in: lpFileName="C:\\Recovery\\94048722-4631-11e7-a593-a98775ceb0ae\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0110.658] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.658] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.658] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.658] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.658] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.658] GetFullPathNameW (in: lpFileName="\\System Volume Information", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c [0110.658] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\", lpFilePart=0x0) returned 0x1d [0110.658] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xffffffff [0110.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0110.660] GetFullPathNameW (in: lpFileName="\\Users", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0110.660] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0110.660] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbed58 [0110.660] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.660] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.660] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.660] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.660] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.661] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.661] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.661] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0110.661] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0110.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0110.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0110.661] GetFullPathNameW (in: lpFileName="\\Users", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0110.661] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0110.661] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbed58 [0110.661] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0110.662] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0110.662] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0110.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0110.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.662] GetFullPathNameW (in: lpFileName="\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0110.662] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13 [0110.662] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0110.663] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.663] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.663] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.663] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.663] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.663] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.664] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.665] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.665] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0110.665] GetFullPathNameW (in: lpFileName="\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0110.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13 [0110.665] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed58 [0110.665] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.665] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.665] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.665] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.666] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0110.667] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0110.667] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0110.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0110.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.667] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0110.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19 [0110.667] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0110.667] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.667] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.667] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.667] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.668] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0110.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19 [0110.668] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0110.668] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.668] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.668] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.668] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.668] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20 [0110.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21 [0110.668] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.669] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.669] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.669] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.669] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.669] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20 [0110.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21 [0110.669] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.669] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.670] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.670] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.670] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.670] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25 [0110.670] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26 [0110.670] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.670] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.670] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.670] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.671] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.671] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25 [0110.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26 [0110.671] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.671] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.671] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.671] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.671] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.671] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f [0110.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30 [0110.672] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.672] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.672] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.672] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.672] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.673] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f [0110.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30 [0110.673] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.673] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.673] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.674] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.674] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.674] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38 [0110.674] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39 [0110.674] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0110.674] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.674] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.674] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.674] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.675] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38 [0110.675] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39 [0110.675] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0110.675] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.675] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.675] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.675] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.675] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0110.675] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\", lpFilePart=0x0) returned 0x24 [0110.675] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0110.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0110.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.677] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0110.677] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\", lpFilePart=0x0) returned 0x1b [0110.677] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0110.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0110.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.678] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0110.678] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\", lpFilePart=0x0) returned 0x1d [0110.678] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0110.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0110.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.679] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites", lpFilePart=0x0) returned 0x1c [0110.679] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\", lpFilePart=0x0) returned 0x1d [0110.679] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0110.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0110.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.680] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0110.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d [0110.681] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0110.681] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.681] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.681] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.681] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.681] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.682] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.683] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.684] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.684] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.684] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.684] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.684] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0110.684] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0110.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d [0110.684] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed58 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.685] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.686] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.687] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0110.687] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0110.687] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0110.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0110.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.687] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27 [0110.687] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28 [0110.687] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.687] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.687] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.687] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.687] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.687] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27 [0110.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28 [0110.688] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.688] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.688] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.688] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.688] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.688] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e [0110.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f [0110.688] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.689] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.689] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.689] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.689] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.689] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e [0110.689] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f [0110.689] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.689] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.689] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.689] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.689] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.690] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32 [0110.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33 [0110.690] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.690] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.690] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.690] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.690] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.690] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32 [0110.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33 [0110.690] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.691] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.691] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.691] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.691] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.691] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38 [0110.691] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39 [0110.691] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0110.692] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.692] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.692] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.692] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.692] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.692] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.693] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.693] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.693] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.693] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.694] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38 [0110.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39 [0110.694] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0110.695] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0110.695] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.696] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0110.696] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24 [0110.696] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.697] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.697] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0110.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24 [0110.697] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.697] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.697] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.697] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0110.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28 [0110.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.698] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.698] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.698] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.698] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.698] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0110.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28 [0110.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.698] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.698] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.698] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.698] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.698] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0110.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0110.699] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.699] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.699] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.699] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.699] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0110.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0110.699] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.699] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.699] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.699] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.700] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0110.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29 [0110.700] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.700] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.700] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.700] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.700] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0110.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29 [0110.700] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.700] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.700] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.700] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.701] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0110.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28 [0110.701] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.701] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.701] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.701] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.701] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.701] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.701] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0110.701] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.702] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.702] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.702] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.702] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.702] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.702] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.703] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.703] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.703] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.703] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.703] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.703] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.703] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.703] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.703] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.703] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.704] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.704] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.704] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.704] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.704] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.704] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.705] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.705] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.705] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.706] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.706] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.706] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.706] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0110.706] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.706] GetFileType (hFile=0x154) returned 0x1 [0110.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0110.707] GetFileType (hFile=0x154) returned 0x1 [0110.707] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1fad1 [0110.707] ReadFile (in: hFile=0x154, lpBuffer=0x1b9789e8, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b9789e8*, lpNumberOfBytesRead=0x2ae478*=0x1fad1, lpOverlapped=0x0) returned 1 [0110.709] CloseHandle (hObject=0x154) returned 1 [0110.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0110.743] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0110.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.744] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0110.744] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58 [0110.744] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0110.744] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.744] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.744] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.745] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.745] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.745] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0110.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.745] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0110.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58 [0110.745] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0110.745] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.745] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.745] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.746] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.746] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.746] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0110.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.746] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0110.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0110.746] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.746] GetFileType (hFile=0x154) returned 0x1 [0110.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0110.746] GetFileType (hFile=0x154) returned 0x1 [0110.746] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1fad1 [0110.747] ReadFile (in: hFile=0x154, lpBuffer=0x1ba36b78, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ba36b78*, lpNumberOfBytesRead=0x2ae478*=0x1fad1, lpOverlapped=0x0) returned 1 [0110.749] CloseHandle (hObject=0x154) returned 1 [0110.794] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0110.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0110.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0110.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.795] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0110.795] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f [0110.795] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.796] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.796] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.796] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.796] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.796] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.796] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0110.796] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f [0110.796] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0110.797] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.797] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.797] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.797] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.797] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.797] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0110.797] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56 [0110.798] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.798] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.799] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.799] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.799] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.799] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.799] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0110.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56 [0110.799] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0110.799] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.799] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.799] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.800] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.801] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.801] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0110.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.801] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0110.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0110.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.801] GetFileType (hFile=0x154) returned 0x1 [0110.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0110.801] GetFileType (hFile=0x154) returned 0x1 [0110.801] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x536 [0110.801] ReadFile (in: hFile=0x154, lpBuffer=0x19912e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19912e4*, lpNumberOfBytesRead=0x2ae478*=0x536, lpOverlapped=0x0) returned 1 [0110.802] CloseHandle (hObject=0x154) returned 1 [0110.836] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0110.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0110.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0110.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.838] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0110.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56 [0110.838] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.838] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.839] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.840] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.840] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0110.840] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56 [0110.840] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0110.840] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.840] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.840] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.840] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.840] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.841] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.841] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.841] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.841] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.841] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.841] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.841] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0110.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.841] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0110.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0110.842] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0110.842] GetFileType (hFile=0x154) returned 0x1 [0110.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0110.842] GetFileType (hFile=0x154) returned 0x1 [0110.842] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2c64 [0110.842] ReadFile (in: hFile=0x154, lpBuffer=0x19e524c, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19e524c*, lpNumberOfBytesRead=0x2ae478*=0x2c64, lpOverlapped=0x0) returned 1 [0110.843] CloseHandle (hObject=0x154) returned 1 [0110.875] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0110.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0110.875] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0110.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.888] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0110.888] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28 [0110.888] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.888] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.888] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.888] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.889] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0110.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28 [0110.889] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.889] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.889] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.889] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.889] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20 [0110.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21 [0110.889] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.889] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.890] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.890] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20 [0110.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21 [0110.890] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.891] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.891] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.891] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27 [0110.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28 [0110.891] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.891] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.891] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.891] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.891] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27 [0110.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28 [0110.892] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.892] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.892] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.892] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.892] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22 [0110.892] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23 [0110.892] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.892] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.893] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.893] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.893] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.893] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22 [0110.893] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23 [0110.893] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.893] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.893] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.893] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.894] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.894] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27 [0110.894] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28 [0110.894] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.894] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.895] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27 [0110.895] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28 [0110.895] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.895] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.895] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.895] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.895] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29 [0110.896] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a [0110.896] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.896] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.896] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.896] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.896] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.896] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29 [0110.896] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a [0110.897] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.897] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.897] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.897] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.897] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.897] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f [0110.897] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30 [0110.897] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.897] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.898] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.898] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.898] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.898] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f [0110.898] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30 [0110.898] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.898] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.898] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.898] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.899] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.899] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48 [0110.899] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49 [0110.899] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.899] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.899] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.899] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.899] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48 [0110.899] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49 [0110.899] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.900] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.900] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.900] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.900] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\HTML Help", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\HTML Help", lpFilePart=0x0) returned 0x26 [0110.900] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\HTML Help\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\HTML Help\\", lpFilePart=0x0) returned 0x27 [0110.900] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\HTML Help\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.900] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.900] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.901] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.901] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\HTML Help", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\HTML Help", lpFilePart=0x0) returned 0x26 [0110.901] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\HTML Help\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\HTML Help\\", lpFilePart=0x0) returned 0x27 [0110.901] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\HTML Help\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.901] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.901] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.901] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.901] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28 [0110.901] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29 [0110.901] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.902] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.902] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.902] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.902] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.902] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.902] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28 [0110.902] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29 [0110.902] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.902] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.902] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.903] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.903] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.903] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.903] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29 [0110.903] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a [0110.903] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.903] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.903] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.903] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.904] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29 [0110.904] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a [0110.904] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.904] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.904] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.904] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.904] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f [0110.904] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20 [0110.904] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.904] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.905] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.905] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.905] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.905] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.905] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f [0110.905] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20 [0110.905] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.905] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.905] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.905] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.906] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.906] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.906] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21 [0110.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22 [0110.906] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.912] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.914] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.915] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.915] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.915] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21 [0110.915] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22 [0110.915] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.915] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.915] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.915] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.919] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.919] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25 [0110.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26 [0110.919] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.919] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.919] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.919] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.920] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25 [0110.920] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26 [0110.920] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.920] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.920] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.920] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.920] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29 [0110.920] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a [0110.920] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.921] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.921] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.921] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.921] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.921] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29 [0110.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a [0110.921] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.921] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.921] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.922] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.922] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.922] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39 [0110.922] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a [0110.922] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.922] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.922] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.922] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.922] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39 [0110.922] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a [0110.923] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.923] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.923] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.923] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.923] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24 [0110.923] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25 [0110.923] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.923] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.923] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.924] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.924] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.924] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.924] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24 [0110.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25 [0110.924] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.924] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.924] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.924] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.925] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.925] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.925] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30 [0110.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31 [0110.925] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.925] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.925] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.925] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.925] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30 [0110.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31 [0110.925] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.925] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.926] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.926] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.926] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f [0110.926] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30 [0110.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.926] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.926] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.926] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.926] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.926] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.926] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f [0110.926] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30 [0110.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.927] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.927] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.927] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.927] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.927] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.927] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23 [0110.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24 [0110.927] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.927] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.927] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.928] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.928] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23 [0110.928] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24 [0110.928] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.928] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.929] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.931] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0110.933] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.933] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e [0110.933] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f [0110.933] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.933] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.933] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.934] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.934] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.934] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.934] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e [0110.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f [0110.934] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.934] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.934] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.934] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0110.934] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0110.934] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.935] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33 [0110.935] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34 [0110.935] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.937] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.938] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.939] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.939] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.946] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33 [0110.946] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34 [0110.946] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.947] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.948] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.948] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.949] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33 [0110.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34 [0110.949] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.950] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.950] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.951] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.951] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.952] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33 [0110.953] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34 [0110.953] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.954] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.955] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.955] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.955] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.955] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.955] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0110.955] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0110.955] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.956] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d [0110.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e [0110.956] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.956] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.956] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.956] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0110.956] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.956] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d [0110.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e [0110.956] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.957] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.957] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43 [0110.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44 [0110.957] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.957] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.957] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43 [0110.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44 [0110.957] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.957] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.957] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20 [0110.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21 [0110.958] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.958] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.958] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20 [0110.958] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21 [0110.958] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.970] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.970] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29 [0110.970] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a [0110.970] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.970] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.970] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29 [0110.970] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a [0110.970] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.970] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.971] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e [0110.971] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f [0110.971] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.971] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.971] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e [0110.971] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f [0110.971] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.972] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.973] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a [0110.973] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b [0110.973] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.987] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.987] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a [0110.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b [0110.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.988] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.988] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25 [0110.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26 [0110.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.988] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.988] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25 [0110.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26 [0110.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.988] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.989] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23 [0110.989] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24 [0110.989] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.989] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0110.989] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23 [0110.989] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24 [0110.989] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0110.989] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0110.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.989] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28 [0110.989] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29 [0110.989] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.989] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0110.990] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28 [0110.990] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29 [0110.990] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0110.990] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.990] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35 [0110.990] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36 [0110.990] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.990] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0110.990] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35 [0110.990] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36 [0110.990] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0110.991] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.991] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", lpFilePart=0x0) returned 0x3d [0110.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", lpFilePart=0x0) returned 0x3e [0110.991] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0110.991] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0110.991] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", lpFilePart=0x0) returned 0x3d [0110.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", lpFilePart=0x0) returned 0x3e [0110.991] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0110.991] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0110.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0110.991] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", lpFilePart=0x0) returned 0x44 [0110.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", lpFilePart=0x0) returned 0x45 [0110.992] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0110.992] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0110.992] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", lpFilePart=0x0) returned 0x44 [0110.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", lpFilePart=0x0) returned 0x45 [0110.992] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0110.992] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0110.992] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", lpFilePart=0x0) returned 0x48 [0110.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", lpFilePart=0x0) returned 0x49 [0110.992] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0110.992] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0110.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0110.992] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", lpFilePart=0x0) returned 0x48 [0110.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", lpFilePart=0x0) returned 0x49 [0110.993] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0110.993] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0110.993] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", lpFilePart=0x0) returned 0x54 [0110.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", lpFilePart=0x0) returned 0x55 [0110.993] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0110.993] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0110.993] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", lpFilePart=0x0) returned 0x54 [0110.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", lpFilePart=0x0) returned 0x55 [0110.993] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0110.993] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0110.994] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", lpFilePart=0x0) returned 0x46 [0110.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", lpFilePart=0x0) returned 0x47 [0110.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0110.994] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.994] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", lpFilePart=0x0) returned 0x46 [0110.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", lpFilePart=0x0) returned 0x47 [0110.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0110.994] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.994] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", lpFilePart=0x0) returned 0x52 [0110.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", lpFilePart=0x0) returned 0x53 [0110.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0110.994] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.994] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", lpFilePart=0x0) returned 0x52 [0110.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", lpFilePart=0x0) returned 0x53 [0110.994] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0110.995] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.995] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", lpFilePart=0x0) returned 0x5a [0110.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", lpFilePart=0x0) returned 0x5b [0110.995] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0110.995] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.995] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", lpFilePart=0x0) returned 0x5a [0110.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", lpFilePart=0x0) returned 0x5b [0110.995] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0110.995] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.995] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", lpFilePart=0x0) returned 0x62 [0110.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", lpFilePart=0x0) returned 0x63 [0110.995] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf118 [0110.996] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.997] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", lpFilePart=0x0) returned 0x62 [0110.997] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", lpFilePart=0x0) returned 0x63 [0110.997] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf118 [0110.998] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0110.999] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", lpFilePart=0x0) returned 0x5a [0110.999] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", lpFilePart=0x0) returned 0x5b [0110.999] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0111.000] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.000] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", lpFilePart=0x0) returned 0x5a [0111.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", lpFilePart=0x0) returned 0x5b [0111.000] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0111.000] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.000] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", lpFilePart=0x0) returned 0x5b [0111.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", lpFilePart=0x0) returned 0x5c [0111.000] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0111.001] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.001] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", lpFilePart=0x0) returned 0x5b [0111.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", lpFilePart=0x0) returned 0x5c [0111.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0111.001] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.001] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d [0111.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e [0111.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0111.001] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.001] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d [0111.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e [0111.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0111.001] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.001] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32 [0111.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33 [0111.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0111.002] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.002] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32 [0111.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33 [0111.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0111.002] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.002] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43 [0111.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44 [0111.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0111.002] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.002] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43 [0111.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44 [0111.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0111.003] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0111.003] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFilePart=0x0) returned 0x52 [0111.003] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.003] GetFileType (hFile=0x154) returned 0x1 [0111.003] GetFileType (hFile=0x154) returned 0x1 [0111.003] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xc038 [0111.004] CloseHandle (hObject=0x154) returned 1 [0111.031] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFilePart=0x0) returned 0x52 [0111.032] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0111.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0111.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.033] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22 [0111.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23 [0111.033] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.033] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.033] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.033] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.034] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22 [0111.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23 [0111.034] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.034] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.034] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.034] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.034] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22 [0111.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23 [0111.034] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.035] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.035] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.035] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.035] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22 [0111.035] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23 [0111.035] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.035] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.035] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.035] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.036] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows", lpFilePart=0x0) returned 0x24 [0111.036] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x25 [0111.036] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.036] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.036] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.036] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.036] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.036] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.036] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.037] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.037] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.038] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows", lpFilePart=0x0) returned 0x24 [0111.038] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x25 [0111.038] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.038] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.039] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.039] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.039] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.039] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.039] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.039] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.039] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.039] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x28 [0111.039] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x29 [0111.039] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.040] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.040] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.040] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.040] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x28 [0111.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x29 [0111.040] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.040] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.040] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.040] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.041] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x2b [0111.041] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x2c [0111.041] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.041] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.041] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.041] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.041] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.041] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.041] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.042] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.042] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.042] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.042] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.042] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.042] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x2b [0111.042] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x2c [0111.042] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.042] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.042] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.043] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.044] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.044] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.044] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x38 [0111.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x39 [0111.044] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.044] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.044] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.044] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.044] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.045] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x38 [0111.045] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x39 [0111.045] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.045] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.045] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.045] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.045] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.045] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3e [0111.045] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3f [0111.045] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.046] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.046] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.046] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.046] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.046] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.046] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3e [0111.046] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3f [0111.046] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.046] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.047] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.047] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.047] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.047] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.047] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x28 [0111.047] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x29 [0111.047] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.047] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.047] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.048] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.048] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.048] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.048] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.048] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.048] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.048] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x28 [0111.048] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x29 [0111.048] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.048] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.049] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.049] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.049] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.049] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.049] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.049] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.049] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.049] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2e [0111.049] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2f [0111.050] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.050] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.050] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.050] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.050] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2e [0111.050] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2f [0111.050] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.050] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.051] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.051] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.051] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x31 [0111.051] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x32 [0111.051] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.051] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.051] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.051] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.051] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x31 [0111.052] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x32 [0111.052] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.052] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.052] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.052] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.052] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x41 [0111.052] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x42 [0111.052] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.052] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.053] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.053] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.053] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x41 [0111.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x42 [0111.054] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.054] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.055] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.055] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.055] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2e [0111.055] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2f [0111.055] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.056] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.056] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.056] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.056] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.056] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.056] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.057] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.057] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.058] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.059] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.059] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.059] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.060] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.061] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.061] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.062] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.062] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.062] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.062] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.062] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.062] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.062] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.063] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.063] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.063] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.063] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.063] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.063] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.063] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.063] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.064] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.064] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.064] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.064] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.064] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.064] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.064] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.064] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.065] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.065] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.065] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.065] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.065] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.065] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.065] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.065] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.066] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.066] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.066] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.066] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.066] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.066] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.066] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.066] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.067] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.067] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.067] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.068] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.068] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.068] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.069] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.069] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.070] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.070] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.071] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.071] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.071] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.072] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.072] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.072] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.073] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.073] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.073] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.073] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.073] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.073] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.074] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.074] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.074] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.074] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.074] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.074] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.074] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.075] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.075] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.075] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.075] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.075] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.075] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.075] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.076] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.076] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.076] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.076] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.076] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.076] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.076] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.077] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.077] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.077] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.077] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.077] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.077] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.078] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.078] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.078] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.078] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.078] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.078] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbefd8 [0111.079] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.079] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.079] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.079] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.080] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.080] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.080] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.080] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.080] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.080] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.080] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.081] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.081] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.081] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.081] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.081] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.081] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.081] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.081] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.082] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.082] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.082] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.082] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.082] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.082] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.082] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.083] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.083] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.083] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbefd8 [0111.083] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.083] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.083] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.083] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.084] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.084] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.084] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.084] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.084] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.084] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.084] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.085] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.085] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D7241BE9-110C-4602-9224-BB77675A721C}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.085] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.086] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.086] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.086] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.086] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.086] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbefd8 [0111.087] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.087] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.087] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.087] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbefd8 [0111.087] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.087] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbefd8 [0111.088] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0111.093] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.094] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.095] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.095] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.095] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.096] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\0E\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.096] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.096] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.096] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.096] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\21\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.096] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.096] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.096] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.096] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\2A\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.096] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.097] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.097] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.097] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\38\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.097] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.097] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.097] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.097] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\53\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.097] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.097] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.097] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\54\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.098] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.098] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\66\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.098] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.098] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\68\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.098] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.099] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.099] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.099] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\A8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.099] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.099] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.099] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.099] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\B8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.099] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.099] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.099] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\E9\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.100] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.100] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\F4\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.100] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.100] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\FA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.100] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.101] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.101] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.101] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.101] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.101] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.101] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.101] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\0E\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.101] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.101] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.102] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.102] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\21\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.102] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.102] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.102] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.102] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\2A\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.102] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.102] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.102] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.102] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\38\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.103] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.103] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\53\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.103] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.103] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\54\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.103] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.104] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\66\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.104] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.104] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\68\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.104] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.104] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\A8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.105] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.105] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.105] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.105] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\B8\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.105] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.105] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.105] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.105] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\E9\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.105] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.105] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.106] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.106] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\F4\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.106] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.106] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.106] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.106] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\FA\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.106] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.106] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.106] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.106] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.107] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.107] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.107] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.107] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.107] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.108] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.108] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Quick\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.108] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.108] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.109] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.110] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0111.111] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.112] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.112] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.112] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.112] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.112] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0111.112] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.112] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0111.112] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.112] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0111.113] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed58 [0111.113] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0111.113] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0111.113] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.113] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.114] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.114] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.114] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.114] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.114] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.114] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.114] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.114] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.114] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.114] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.115] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.115] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.115] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.115] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.115] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.116] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.116] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.116] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.116] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0111.116] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.116] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.116] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.116] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0111.116] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.116] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0111.117] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.117] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0111.117] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0111.117] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.117] GetFileType (hFile=0x154) returned 0x1 [0111.117] GetFileType (hFile=0x154) returned 0x1 [0111.117] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x7e148 [0111.119] ReadFile (in: hFile=0x154, lpBuffer=0x1bb0cd88, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1bb0cd88*, lpNumberOfBytesRead=0x2ae4ec*=0x7e148, lpOverlapped=0x0) returned 1 [0111.126] CloseHandle (hObject=0x154) returned 1 [0111.185] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFilePart=0x0) returned 0x3e [0111.185] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0111.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0111.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.187] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24 [0111.187] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25 [0111.187] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.187] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.188] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.188] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.188] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.188] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24 [0111.188] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25 [0111.188] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.188] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.188] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.188] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.189] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.189] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d [0111.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e [0111.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.189] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.189] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.189] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.189] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d [0111.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e [0111.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.190] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.190] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.190] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.190] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21 [0111.190] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22 [0111.190] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.191] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.191] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.192] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.193] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.194] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.195] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.196] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.197] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21 [0111.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22 [0111.197] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.198] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.198] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.198] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.198] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.199] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.200] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.201] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.202] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.202] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.202] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.202] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.202] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.202] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.203] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.203] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.203] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.203] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.203] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.204] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a [0111.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b [0111.204] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.204] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.205] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.205] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.205] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.205] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a [0111.205] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b [0111.205] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.205] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.205] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.205] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.205] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.206] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f [0111.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20 [0111.206] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.206] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.206] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.206] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.206] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.206] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f [0111.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20 [0111.206] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.207] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.207] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.207] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.207] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.207] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19 [0111.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a [0111.207] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.208] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.208] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.208] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.208] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19 [0111.208] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a [0111.208] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.208] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.208] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.208] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.209] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0111.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21 [0111.209] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.209] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.209] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.209] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.209] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.209] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.209] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.210] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.210] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.211] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0111.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21 [0111.211] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.211] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.211] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.211] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.211] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.211] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.211] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0111.212] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0111.212] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.212] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", lpFilePart=0x0) returned 0x49 [0111.212] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", lpFilePart=0x0) returned 0x4a [0111.212] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.213] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.213] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.213] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.213] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.213] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88", lpFilePart=0x0) returned 0x49 [0111.213] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\", lpFilePart=0x0) returned 0x4a [0111.213] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.213] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.213] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.214] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.214] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.214] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", lpFilePart=0x0) returned 0x52 [0111.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", lpFilePart=0x0) returned 0x53 [0111.214] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.214] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.214] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.214] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.214] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.215] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages", lpFilePart=0x0) returned 0x52 [0111.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\", lpFilePart=0x0) returned 0x53 [0111.215] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.215] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.215] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.215] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.215] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.215] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0111.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0111.215] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.216] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.216] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.216] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.216] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.216] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0111.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0111.216] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.216] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.216] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.216] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.216] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.217] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x5c [0111.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x5d [0111.217] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.217] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.217] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.217] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.217] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.217] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x5c [0111.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x5d [0111.217] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\564F02E6419B9858949B0CD5A65E2C8C0944DD88\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.217] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.218] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.218] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.218] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.218] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", lpFilePart=0x0) returned 0x49 [0111.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", lpFilePart=0x0) returned 0x4a [0111.218] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.218] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.218] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.218] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.218] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.219] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B", lpFilePart=0x0) returned 0x49 [0111.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\", lpFilePart=0x0) returned 0x4a [0111.219] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.219] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.219] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.219] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.219] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.219] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", lpFilePart=0x0) returned 0x52 [0111.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", lpFilePart=0x0) returned 0x53 [0111.219] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.220] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.220] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.220] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.220] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.220] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages", lpFilePart=0x0) returned 0x52 [0111.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\", lpFilePart=0x0) returned 0x53 [0111.220] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.220] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.220] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.221] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.221] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.221] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0111.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0111.221] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.221] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.221] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.221] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.221] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.222] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0111.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0111.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.222] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.222] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.222] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.222] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.222] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x5c [0111.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x5d [0111.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.222] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.222] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.222] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.223] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.223] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86", lpFilePart=0x0) returned 0x5c [0111.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\", lpFilePart=0x0) returned 0x5d [0111.223] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\D4036846864773E3D647F421DFE7F6CA536E307B\\packages\\Patch\\x86\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.223] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.223] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.223] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.223] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.223] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52 [0111.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0111.223] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.223] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.224] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.224] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.224] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.224] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52 [0111.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0111.224] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.224] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.224] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.224] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.224] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.224] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0111.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0111.225] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.225] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.225] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.225] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.225] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.225] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0111.225] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0111.225] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.225] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.225] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.225] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.225] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.226] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0111.226] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0111.226] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.226] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.226] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.226] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.226] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.226] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.226] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0111.226] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0111.226] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.226] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.227] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.227] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47 [0111.227] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x48 [0111.227] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.227] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.227] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.227] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47 [0111.227] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x48 [0111.227] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.228] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.228] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53 [0111.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0111.228] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.228] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.228] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.228] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53 [0111.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0111.228] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.229] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.229] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0111.229] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0111.229] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.229] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.229] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0111.229] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0111.229] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.229] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.230] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.230] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71 [0111.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x72 [0111.230] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.230] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.230] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71 [0111.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x72 [0111.230] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.230] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.231] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.231] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53 [0111.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0111.231] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.231] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.231] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53 [0111.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0111.231] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.231] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.232] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.232] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0111.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0111.232] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.232] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.232] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0111.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0111.232] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.232] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0111.233] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.233] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74 [0111.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x75 [0111.233] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.233] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.233] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74 [0111.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x75 [0111.233] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.233] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.234] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.234] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.234] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.234] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52 [0111.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0111.234] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.234] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.234] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.234] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.234] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.235] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52 [0111.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0111.235] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.235] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.235] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0111.235] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0111.235] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.235] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0111.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0111.235] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.235] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0111.236] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.236] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0111.236] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0111.236] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.236] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.236] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0111.236] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74 [0111.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.237] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.237] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0111.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74 [0111.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.237] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.237] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52 [0111.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0111.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.237] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.238] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52 [0111.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0111.238] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.238] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.238] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0111.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0111.238] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.238] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.238] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0111.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0111.238] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.238] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.239] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0111.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0111.239] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.239] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.239] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0111.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0111.239] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.239] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.239] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0111.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x48 [0111.239] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.240] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.240] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0111.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x48 [0111.240] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.240] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.240] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0111.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x48 [0111.240] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.240] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.241] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0111.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x48 [0111.241] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.241] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.241] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0111.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0111.241] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.241] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.241] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0111.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0111.242] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.242] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.242] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0111.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0111.242] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.242] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.242] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0111.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0111.242] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.242] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.243] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0111.243] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74 [0111.243] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.243] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.243] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0111.243] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74 [0111.243] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.243] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.243] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d [0111.243] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu\\", lpFilePart=0x0) returned 0x1e [0111.243] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0111.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0111.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.244] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16 [0111.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\", lpFilePart=0x0) returned 0x17 [0111.244] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.245] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.245] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16 [0111.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\", lpFilePart=0x0) returned 0x17 [0111.245] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.245] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.245] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0111.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\", lpFilePart=0x0) returned 0x1c [0111.245] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.245] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0111.245] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0111.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\", lpFilePart=0x0) returned 0x1c [0111.245] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.246] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.246] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0111.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x28 [0111.246] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.246] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.246] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0111.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x28 [0111.246] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.246] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0111.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.246] GetFullPathNameW (in: lpFileName="\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c [0111.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates\\", lpFilePart=0x0) returned 0x1d [0111.247] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0111.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0111.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0111.247] GetFullPathNameW (in: lpFileName="\\Users\\Default", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0111.247] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\", lpFilePart=0x0) returned 0x11 [0111.248] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf1d8 [0111.248] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0111.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0111.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0111.248] GetFullPathNameW (in: lpFileName="\\Users\\Default", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0111.248] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\", lpFilePart=0x0) returned 0x11 [0111.248] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf1d8 [0111.248] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0111.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0111.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.248] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18 [0111.248] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\", lpFilePart=0x0) returned 0x19 [0111.248] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.249] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0111.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0111.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0111.249] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18 [0111.249] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\", lpFilePart=0x0) returned 0x19 [0111.249] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf1d8 [0111.249] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.249] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0111.249] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f [0111.249] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.250] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.251] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0111.251] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f [0111.251] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf1d8 [0111.252] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.253] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f [0111.253] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x30 [0111.253] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xffffffff [0111.258] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26 [0111.258] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x27 [0111.258] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xffffffff [0111.262] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0111.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29 [0111.262] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.279] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.280] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0111.280] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29 [0111.280] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf1d8 [0111.281] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.282] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34 [0111.282] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35 [0111.282] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.283] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.283] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34 [0111.283] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35 [0111.284] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.284] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.284] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e [0111.284] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f [0111.284] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.297] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.298] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e [0111.298] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f [0111.298] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.299] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.300] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3d [0111.301] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f [0111.301] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0111.302] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0111.302] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0111.303] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40 [0111.303] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0111.304] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.306] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.306] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.306] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.306] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.306] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.306] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.307] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3d [0111.308] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f [0111.308] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0111.308] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0111.309] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0111.309] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40 [0111.309] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0111.311] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.312] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.312] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.312] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.313] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.313] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.313] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.314] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x54 [0111.314] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56 [0111.314] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0111.315] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.315] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.316] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57 [0111.316] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.317] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.318] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.318] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.318] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.318] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.318] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x54 [0111.319] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56 [0111.319] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0111.319] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.320] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.320] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57 [0111.320] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.322] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.322] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.322] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.322] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.322] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.322] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x55 [0111.323] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x5f [0111.323] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61 [0111.323] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0111.324] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.324] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0111.325] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.325] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0111.326] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62 [0111.326] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0111.327] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf1d8 [0111.328] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.328] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.328] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.328] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.328] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x55 [0111.329] GetLongPathNameW (in: lpszShortPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x5f [0111.329] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61 [0111.329] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0111.330] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.330] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0111.331] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0111.331] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0111.332] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62 [0111.332] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0111.333] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf1d8 [0111.333] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.333] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.334] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.334] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.334] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34 [0111.334] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35 [0111.334] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.336] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.336] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.338] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34 [0111.338] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35 [0111.338] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.339] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.339] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.340] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", lpFilePart=0x0) returned 0x3d [0111.341] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", lpFilePart=0x0) returned 0x3e [0111.341] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.342] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.342] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.342] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.342] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.342] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.342] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", lpFilePart=0x0) returned 0x3d [0111.342] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", lpFilePart=0x0) returned 0x3e [0111.342] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.343] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.343] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.343] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.343] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.343] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.343] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", lpFilePart=0x0) returned 0x3d [0111.343] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", lpFilePart=0x0) returned 0x3e [0111.344] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.352] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.352] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.352] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.352] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.352] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.352] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", lpFilePart=0x0) returned 0x3d [0111.352] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", lpFilePart=0x0) returned 0x3e [0111.352] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.352] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.353] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.353] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.353] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.353] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.353] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", lpFilePart=0x0) returned 0x3d [0111.353] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", lpFilePart=0x0) returned 0x3e [0111.353] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.353] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.354] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.354] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.354] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.354] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.354] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", lpFilePart=0x0) returned 0x3d [0111.354] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", lpFilePart=0x0) returned 0x3e [0111.354] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.354] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.354] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.355] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.355] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.355] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.355] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", lpFilePart=0x0) returned 0x3d [0111.355] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", lpFilePart=0x0) returned 0x3e [0111.355] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.355] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.355] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.356] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.356] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.356] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.356] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", lpFilePart=0x0) returned 0x3d [0111.356] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", lpFilePart=0x0) returned 0x3e [0111.356] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf1d8 [0111.356] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.356] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.356] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.357] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.357] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.357] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a [0111.357] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b [0111.357] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.358] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.358] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.358] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.358] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.358] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a [0111.358] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b [0111.358] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf1d8 [0111.358] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.359] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.359] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.359] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0111.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.359] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0111.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0111.359] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.360] GetFileType (hFile=0x154) returned 0x1 [0111.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0111.360] GetFileType (hFile=0x154) returned 0x1 [0111.360] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2f9d [0111.360] ReadFile (in: hFile=0x154, lpBuffer=0x1a99690, nNumberOfBytesToRead=0x2f9d, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a99690*, lpNumberOfBytesRead=0x2ae478*=0x2f9d, lpOverlapped=0x0) returned 1 [0111.374] CloseHandle (hObject=0x154) returned 1 [0111.408] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0111.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0111.408] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.409] GetFileType (hFile=0x154) returned 0x1 [0111.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0111.409] GetFileType (hFile=0x154) returned 0x1 [0111.409] WriteFile (in: hFile=0x154, lpBuffer=0x1af529c*, nNumberOfBytesToWrite=0x2fa0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1af529c*, lpNumberOfBytesWritten=0x2ae46c*=0x2fa0, lpOverlapped=0x0) returned 1 [0111.411] CloseHandle (hObject=0x154) returned 1 [0111.411] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0111.411] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.anonymous", lpFilePart=0x0) returned 0x50 [0111.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0111.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7933e70, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x7933e70, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1589b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0)) returned 1 [0111.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.411] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.anonymous")) returned 1 [0111.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.411] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35 [0111.411] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36 [0111.412] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0111.419] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.420] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.420] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.420] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.420] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.420] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.421] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35 [0111.421] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36 [0111.421] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0111.422] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.422] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.422] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.423] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.423] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.423] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.424] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44 [0111.424] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45 [0111.424] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.425] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.425] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.426] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.426] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.426] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44 [0111.426] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45 [0111.426] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.426] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.426] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.426] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.426] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.427] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a [0111.427] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b [0111.427] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.427] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.427] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.427] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.427] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.427] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a [0111.427] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b [0111.427] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.428] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.428] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.428] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.428] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.428] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", lpFilePart=0x0) returned 0x53 [0111.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", lpFilePart=0x0) returned 0x54 [0111.428] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0111.431] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.432] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", lpFilePart=0x0) returned 0x53 [0111.432] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", lpFilePart=0x0) returned 0x54 [0111.432] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0111.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0111.433] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.434] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30 [0111.434] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x31 [0111.434] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.436] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.437] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30 [0111.438] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x31 [0111.438] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0111.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.439] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.440] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.442] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.442] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.442] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.442] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.443] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.445] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.445] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.445] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.445] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.446] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.446] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.446] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.448] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.449] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.450] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.451] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.451] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.452] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.452] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.452] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.452] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.452] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.452] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.452] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.453] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.453] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.453] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.453] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.454] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.454] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.454] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.454] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.454] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.455] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.455] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.455] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.455] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.455] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.455] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.455] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.455] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.455] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.456] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.456] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.456] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.456] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.467] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.469] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.470] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.470] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.470] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.470] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.470] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.470] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.470] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.471] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.482] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0111.482] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.483] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.484] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0111.485] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.486] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.487] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.487] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.487] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.487] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.501] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.501] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.501] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.502] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.502] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.502] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.502] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.502] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.503] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0111.503] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0111.503] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.503] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.503] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.503] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.503] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.504] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.504] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.504] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.504] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.504] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.524] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.524] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0111.524] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.524] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.524] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.524] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.524] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.525] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.525] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.525] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0111.525] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.525] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0111.527] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.528] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0111.530] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0111.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0111.531] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.532] GetFileType (hFile=0x154) returned 0x1 [0111.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0111.532] GetFileType (hFile=0x154) returned 0x1 [0111.532] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x104 [0111.533] CloseHandle (hObject=0x154) returned 1 [0111.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0111.546] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.547] GetFileType (hFile=0x154) returned 0x1 [0111.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0111.547] GetFileType (hFile=0x154) returned 0x1 [0111.548] WriteFile (in: hFile=0x154, lpBuffer=0x1b7c2b8*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b7c2b8*, lpNumberOfBytesWritten=0x2ae440*=0x110, lpOverlapped=0x0) returned 1 [0111.549] CloseHandle (hObject=0x154) returned 1 [0111.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0111.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776adf0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x776adf0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe16e0770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0111.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.549] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml.anonymous")) returned 1 [0111.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.550] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.550] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.550] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.550] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.550] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec58 [0111.552] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0111.553] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbec58 [0111.554] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0111.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.555] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.557] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.558] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.559] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0111.560] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.562] GetFileType (hFile=0x154) returned 0x1 [0111.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0111.562] GetFileType (hFile=0x154) returned 0x1 [0111.562] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x432 [0111.573] CloseHandle (hObject=0x154) returned 1 [0111.613] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a [0111.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.613] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.614] GetFileType (hFile=0x154) returned 0x1 [0111.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.615] GetFileType (hFile=0x154) returned 0x1 [0111.615] WriteFile (in: hFile=0x154, lpBuffer=0x19d65f4*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19d65f4*, lpNumberOfBytesWritten=0x2ae3cc*=0x440, lpOverlapped=0x0) returned 1 [0111.616] CloseHandle (hObject=0x154) returned 1 [0111.616] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a [0111.616] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.anonymous", lpFilePart=0x0) returned 0x54 [0111.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0111.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776adf0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x776adf0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1778cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x440)) returned 1 [0111.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.616] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.anonymous")) returned 1 [0111.616] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b [0111.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0111.617] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.617] GetFileType (hFile=0x154) returned 0x1 [0111.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0111.617] GetFileType (hFile=0x154) returned 0x1 [0111.617] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5d3f [0111.617] ReadFile (in: hFile=0x154, lpBuffer=0x19d797c, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19d797c*, lpNumberOfBytesRead=0x2ae404*=0x5d3f, lpOverlapped=0x0) returned 1 [0111.633] CloseHandle (hObject=0x154) returned 1 [0111.646] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b [0111.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.646] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.648] GetFileType (hFile=0x154) returned 0x1 [0111.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.648] GetFileType (hFile=0x154) returned 0x1 [0111.648] WriteFile (in: hFile=0x154, lpBuffer=0x1a41b04*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a41b04*, lpNumberOfBytesWritten=0x2ae3f8*=0x5d40, lpOverlapped=0x0) returned 1 [0111.649] CloseHandle (hObject=0x154) returned 1 [0111.649] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b [0111.650] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.anonymous", lpFilePart=0x0) returned 0x55 [0111.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776adf0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x776adf0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe17c4fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5d40)) returned 1 [0111.650] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.anonymous")) returned 1 [0111.650] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51 [0111.650] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.651] GetFileType (hFile=0x154) returned 0x1 [0111.651] GetFileType (hFile=0x154) returned 0x1 [0111.651] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1906 [0111.651] ReadFile (in: hFile=0x154, lpBuffer=0x1a47cf0, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a47cf0*, lpNumberOfBytesRead=0x2ae404*=0x1906, lpOverlapped=0x0) returned 1 [0111.683] CloseHandle (hObject=0x154) returned 1 [0111.696] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51 [0111.696] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.697] GetFileType (hFile=0x154) returned 0x1 [0111.697] GetFileType (hFile=0x154) returned 0x1 [0111.697] WriteFile (in: hFile=0x154, lpBuffer=0x1a9c82c*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a9c82c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1910, lpOverlapped=0x0) returned 1 [0111.699] CloseHandle (hObject=0x154) returned 1 [0111.699] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51 [0111.699] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0111.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776adf0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x776adf0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe18373d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1910)) returned 1 [0111.699] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.anonymous")) returned 1 [0111.699] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f [0111.699] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.700] GetFileType (hFile=0x154) returned 0x1 [0111.700] GetFileType (hFile=0x154) returned 0x1 [0111.700] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x107e [0111.700] ReadFile (in: hFile=0x154, lpBuffer=0x1a9e61c, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a9e61c*, lpNumberOfBytesRead=0x2ae404*=0x107e, lpOverlapped=0x0) returned 1 [0111.705] CloseHandle (hObject=0x154) returned 1 [0111.717] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f [0111.718] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.719] GetFileType (hFile=0x154) returned 0x1 [0111.719] GetFileType (hFile=0x154) returned 0x1 [0111.719] WriteFile (in: hFile=0x154, lpBuffer=0x1af0688*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1af0688*, lpNumberOfBytesWritten=0x2ae3f8*=0x1080, lpOverlapped=0x0) returned 1 [0111.720] CloseHandle (hObject=0x154) returned 1 [0111.720] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f [0111.720] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.anonymous", lpFilePart=0x0) returned 0x59 [0111.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776adf0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x776adf0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1883690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1080)) returned 1 [0111.721] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.anonymous")) returned 1 [0111.721] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52 [0111.721] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.722] GetFileType (hFile=0x154) returned 0x1 [0111.722] GetFileType (hFile=0x154) returned 0x1 [0111.722] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x18ed [0111.722] ReadFile (in: hFile=0x154, lpBuffer=0x1af1be0, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af1be0*, lpNumberOfBytesRead=0x2ae404*=0x18ed, lpOverlapped=0x0) returned 1 [0111.742] CloseHandle (hObject=0x154) returned 1 [0111.755] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52 [0111.755] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.756] GetFileType (hFile=0x154) returned 0x1 [0111.756] GetFileType (hFile=0x154) returned 0x1 [0111.756] WriteFile (in: hFile=0x154, lpBuffer=0x1b4667c*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b4667c*, lpNumberOfBytesWritten=0x2ae3f8*=0x18f0, lpOverlapped=0x0) returned 1 [0111.757] CloseHandle (hObject=0x154) returned 1 [0111.757] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52 [0111.758] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.anonymous", lpFilePart=0x0) returned 0x5c [0111.758] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7744c90, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x7744c90, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe18cf950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18f0)) returned 1 [0111.758] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.anonymous")) returned 1 [0111.758] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c [0111.758] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.758] GetFileType (hFile=0x154) returned 0x1 [0111.758] GetFileType (hFile=0x154) returned 0x1 [0111.758] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13fb [0111.759] ReadFile (in: hFile=0x154, lpBuffer=0x1b48450, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b48450*, lpNumberOfBytesRead=0x2ae404*=0x13fb, lpOverlapped=0x0) returned 1 [0111.773] CloseHandle (hObject=0x154) returned 1 [0111.808] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c [0111.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.808] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.809] GetFileType (hFile=0x154) returned 0x1 [0111.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.810] GetFileType (hFile=0x154) returned 0x1 [0111.810] WriteFile (in: hFile=0x154, lpBuffer=0x199c888*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x199c888*, lpNumberOfBytesWritten=0x2ae3f8*=0x1400, lpOverlapped=0x0) returned 1 [0111.811] CloseHandle (hObject=0x154) returned 1 [0111.811] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c [0111.812] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.anonymous", lpFilePart=0x0) returned 0x56 [0111.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0111.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7744c90, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x7744c90, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1941d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1 [0111.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.812] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.anonymous")) returned 1 [0111.813] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a [0111.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0111.813] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.813] GetFileType (hFile=0x154) returned 0x1 [0111.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0111.813] GetFileType (hFile=0x154) returned 0x1 [0111.813] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x780 [0111.813] ReadFile (in: hFile=0x154, lpBuffer=0x199e8b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x199e8b4*, lpNumberOfBytesRead=0x2ae404*=0x780, lpOverlapped=0x0) returned 1 [0111.823] CloseHandle (hObject=0x154) returned 1 [0111.835] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a [0111.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.835] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.837] GetFileType (hFile=0x154) returned 0x1 [0111.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.837] GetFileType (hFile=0x154) returned 0x1 [0111.837] WriteFile (in: hFile=0x154, lpBuffer=0x19eef04*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19eef04*, lpNumberOfBytesWritten=0x2ae3cc*=0x790, lpOverlapped=0x0) returned 1 [0111.838] CloseHandle (hObject=0x154) returned 1 [0111.838] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a [0111.838] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.anonymous", lpFilePart=0x0) returned 0x54 [0111.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0111.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7744c90, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x7744c90, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe198e030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x790)) returned 1 [0111.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.838] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.anonymous")) returned 1 [0111.839] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51 [0111.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0111.839] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.839] GetFileType (hFile=0x154) returned 0x1 [0111.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0111.839] GetFileType (hFile=0x154) returned 0x1 [0111.839] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x127e [0111.839] ReadFile (in: hFile=0x154, lpBuffer=0x19f028c, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f028c*, lpNumberOfBytesRead=0x2ae404*=0x127e, lpOverlapped=0x0) returned 1 [0111.861] CloseHandle (hObject=0x154) returned 1 [0111.872] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51 [0111.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.872] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.885] GetFileType (hFile=0x154) returned 0x1 [0111.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.885] GetFileType (hFile=0x154) returned 0x1 [0111.885] WriteFile (in: hFile=0x154, lpBuffer=0x1a42cf8*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a42cf8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1280, lpOverlapped=0x0) returned 1 [0111.887] CloseHandle (hObject=0x154) returned 1 [0111.887] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51 [0111.887] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0111.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0111.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7744c90, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x7744c90, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1a00450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1280)) returned 1 [0111.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.887] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.anonymous")) returned 1 [0111.887] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d [0111.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0111.887] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.888] GetFileType (hFile=0x154) returned 0x1 [0111.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0111.888] GetFileType (hFile=0x154) returned 0x1 [0111.888] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2949 [0111.888] ReadFile (in: hFile=0x154, lpBuffer=0x1a44450, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a44450*, lpNumberOfBytesRead=0x2ae404*=0x2949, lpOverlapped=0x0) returned 1 [0111.911] CloseHandle (hObject=0x154) returned 1 [0111.923] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d [0111.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.923] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.924] GetFileType (hFile=0x154) returned 0x1 [0111.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.924] GetFileType (hFile=0x154) returned 0x1 [0111.925] WriteFile (in: hFile=0x154, lpBuffer=0x1a9e0cc*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a9e0cc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2950, lpOverlapped=0x0) returned 1 [0111.926] CloseHandle (hObject=0x154) returned 1 [0111.926] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d [0111.926] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.anonymous", lpFilePart=0x0) returned 0x57 [0111.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0111.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7744c90, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x7744c90, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1a72870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2950)) returned 1 [0111.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.926] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.anonymous")) returned 1 [0111.942] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a [0111.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0111.942] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.942] GetFileType (hFile=0x154) returned 0x1 [0111.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0111.943] GetFileType (hFile=0x154) returned 0x1 [0111.943] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1d51 [0111.943] ReadFile (in: hFile=0x154, lpBuffer=0x1aa0ec0, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa0ec0*, lpNumberOfBytesRead=0x2ae404*=0x1d51, lpOverlapped=0x0) returned 1 [0111.944] CloseHandle (hObject=0x154) returned 1 [0111.956] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a [0111.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0111.956] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0111.957] GetFileType (hFile=0x154) returned 0x1 [0111.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0111.958] GetFileType (hFile=0x154) returned 0x1 [0111.958] WriteFile (in: hFile=0x154, lpBuffer=0x1af6f8c*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1af6f8c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1d60, lpOverlapped=0x0) returned 1 [0111.959] CloseHandle (hObject=0x154) returned 1 [0111.959] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a [0111.959] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.anonymous", lpFilePart=0x0) returned 0x54 [0111.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0111.959] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x771eb30, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x771eb30, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1abeb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d60)) returned 1 [0111.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0111.959] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.anonymous")) returned 1 [0111.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.960] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x36 [0111.960] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x37 [0111.960] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0111.960] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.960] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.960] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.960] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.960] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x36 [0111.960] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x37 [0111.961] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0111.961] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.961] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.961] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.961] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.961] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x3b [0111.961] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x3c [0111.961] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.961] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.962] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.962] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.962] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.962] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.962] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x3b [0111.962] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x3c [0111.962] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.962] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.962] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.963] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.963] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.963] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.963] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38 [0111.963] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x39 [0111.963] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0111.964] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.964] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.964] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.964] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.964] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0111.964] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38 [0111.964] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x39 [0111.964] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbec58 [0111.965] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.965] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.965] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0111.965] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0111.965] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0111.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0111.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.965] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40 [0111.965] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x41 [0111.965] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.966] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.966] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.966] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0111.966] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40 [0111.966] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x41 [0111.966] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbec58 [0111.966] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0111.966] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0111.966] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0111.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0111.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0111.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0111.967] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0111.967] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24 [0111.967] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec58 [0112.021] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.021] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.021] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.021] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0112.021] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0112.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0112.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0112.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0112.022] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0112.022] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24 [0112.022] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbec58 [0112.023] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.023] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.023] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.023] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0112.024] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0112.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0112.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0112.025] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0112.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0112.025] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.026] GetFileType (hFile=0x154) returned 0x1 [0112.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0112.026] GetFileType (hFile=0x154) returned 0x1 [0112.026] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x0 [0112.026] CloseHandle (hObject=0x154) returned 1 [0112.038] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0112.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0112.038] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.038] GetFileType (hFile=0x154) returned 0x1 [0112.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0112.038] GetFileType (hFile=0x154) returned 0x1 [0112.040] CloseHandle (hObject=0x154) returned 1 [0112.040] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0112.040] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.anonymous", lpFilePart=0x0) returned 0x44 [0112.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0112.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x771eb30, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x771eb30, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1b7d210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0112.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.040] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.anonymous" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.anonymous")) returned 1 [0112.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0112.043] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37 [0112.043] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x38 [0112.043] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xffffffff [0112.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae538) returned 1 [0112.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0112.044] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21 [0112.044] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22 [0112.044] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0112.045] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.045] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0112.045] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0112.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0112.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0112.046] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21 [0112.046] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22 [0112.046] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0112.046] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.046] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0112.046] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0112.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0112.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0112.046] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0112.046] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x21 [0112.046] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0112.046] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.047] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.047] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.047] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0112.047] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0112.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0112.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0112.047] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0112.047] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x21 [0112.047] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0112.047] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.048] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.048] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0112.048] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0112.048] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0112.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0112.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0112.048] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b [0112.048] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c [0112.048] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0112.048] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.049] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.049] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0112.049] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0112.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0112.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0112.049] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b [0112.049] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c [0112.049] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0112.049] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.049] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.049] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0112.049] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0112.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0112.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.050] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpFilePart=0x0) returned 0x52 [0112.050] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", lpFilePart=0x0) returned 0x53 [0112.050] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0112.050] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.050] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.050] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.050] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpFilePart=0x0) returned 0x52 [0112.050] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", lpFilePart=0x0) returned 0x53 [0112.050] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0112.051] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.051] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.051] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0112.051] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0112.051] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b [0112.051] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0112.053] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.053] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.053] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.054] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.054] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.054] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0112.054] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0112.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0112.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0112.055] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0112.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b [0112.055] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf258 [0112.056] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.056] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.056] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.056] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.056] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0112.057] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0112.057] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0112.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0112.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.058] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36 [0112.058] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37 [0112.058] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0112.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.059] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.060] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.060] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36 [0112.060] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37 [0112.060] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0112.060] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.060] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.060] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.061] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0112.061] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d [0112.061] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0112.061] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.061] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.061] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.061] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.062] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0112.062] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d [0112.062] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf258 [0112.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.062] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.062] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.062] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0112.062] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a [0112.062] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf258 [0112.067] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.067] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.067] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.067] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.067] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.068] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.068] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.069] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0112.069] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a [0112.069] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf258 [0112.070] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.070] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.070] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.070] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.070] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.070] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.071] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0112.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.072] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x5b [0112.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0112.072] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.073] GetFileType (hFile=0x154) returned 0x1 [0112.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0112.073] GetFileType (hFile=0x154) returned 0x1 [0112.073] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x122 [0112.073] ReadFile (in: hFile=0x154, lpBuffer=0x1b5ae40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b5ae40*, lpNumberOfBytesRead=0x2ae404*=0x122, lpOverlapped=0x0) returned 1 [0112.074] CloseHandle (hObject=0x154) returned 1 [0112.111] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x5b [0112.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0112.112] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.113] GetFileType (hFile=0x154) returned 0x1 [0112.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0112.113] GetFileType (hFile=0x154) returned 0x1 [0112.113] WriteFile (in: hFile=0x154, lpBuffer=0x19a6790*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a6790*, lpNumberOfBytesWritten=0x2ae3cc*=0x130, lpOverlapped=0x0) returned 1 [0112.114] CloseHandle (hObject=0x154) returned 1 [0112.114] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x5b [0112.114] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.anonymous", lpFilePart=0x0) returned 0x65 [0112.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0112.114] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36d1b2c, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x76f89d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1c3b8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1 [0112.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.114] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.anonymous")) returned 1 [0112.115] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x5d [0112.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0112.115] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.116] GetFileType (hFile=0x154) returned 0x1 [0112.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0112.116] GetFileType (hFile=0x154) returned 0x1 [0112.116] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x110 [0112.116] ReadFile (in: hFile=0x154, lpBuffer=0x19a7c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a7c98*, lpNumberOfBytesRead=0x2ae404*=0x110, lpOverlapped=0x0) returned 1 [0112.117] CloseHandle (hObject=0x154) returned 1 [0112.149] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x5d [0112.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0112.149] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.150] GetFileType (hFile=0x154) returned 0x1 [0112.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0112.150] GetFileType (hFile=0x154) returned 0x1 [0112.150] WriteFile (in: hFile=0x154, lpBuffer=0x19f62f0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19f62f0*, lpNumberOfBytesWritten=0x2ae3cc*=0x120, lpOverlapped=0x0) returned 1 [0112.151] CloseHandle (hObject=0x154) returned 1 [0112.151] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x5d [0112.151] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.anonymous", lpFilePart=0x0) returned 0x67 [0112.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0112.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd371ddec, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x76f89d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1c87bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0112.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.152] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.anonymous")) returned 1 [0112.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.152] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55 [0112.152] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56 [0112.152] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0112.156] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.156] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.156] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.157] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0112.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.157] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55 [0112.157] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56 [0112.157] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0112.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.157] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.158] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0112.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0112.158] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a [0112.158] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b [0112.158] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0112.158] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.159] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0112.159] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0112.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0112.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0112.159] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a [0112.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b [0112.159] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0112.159] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.159] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0112.159] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0112.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0112.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0112.159] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d [0112.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e [0112.159] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0112.176] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.176] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.176] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.176] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.176] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.177] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0112.177] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0112.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0112.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0112.178] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d [0112.178] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e [0112.178] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0112.180] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.180] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.180] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.180] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.181] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.181] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0112.181] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0112.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0112.182] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x73 [0112.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.183] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.184] GetFileType (hFile=0x154) returned 0x1 [0112.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.184] GetFileType (hFile=0x154) returned 0x1 [0112.184] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x58b [0112.184] ReadFile (in: hFile=0x154, lpBuffer=0x19fe934, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19fe934*, lpNumberOfBytesRead=0x2ae31c*=0x58b, lpOverlapped=0x0) returned 1 [0112.186] CloseHandle (hObject=0x154) returned 1 [0112.205] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x73 [0112.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.205] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.207] GetFileType (hFile=0x154) returned 0x1 [0112.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.207] GetFileType (hFile=0x154) returned 0x1 [0112.207] WriteFile (in: hFile=0x154, lpBuffer=0x1a4e488*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a4e488*, lpNumberOfBytesWritten=0x2ae2e4*=0x590, lpOverlapped=0x0) returned 1 [0112.208] CloseHandle (hObject=0x154) returned 1 [0112.209] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x73 [0112.209] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x7d [0112.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.209] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76f89d0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x76f89d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1d20130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0112.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.209] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.anonymous")) returned 1 [0112.210] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x72 [0112.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.210] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.210] GetFileType (hFile=0x154) returned 0x1 [0112.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.210] GetFileType (hFile=0x154) returned 0x1 [0112.211] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x4cc [0112.211] ReadFile (in: hFile=0x154, lpBuffer=0x1a4fe0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a4fe0c*, lpNumberOfBytesRead=0x2ae31c*=0x4cc, lpOverlapped=0x0) returned 1 [0112.213] CloseHandle (hObject=0x154) returned 1 [0112.229] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x72 [0112.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.229] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.230] GetFileType (hFile=0x154) returned 0x1 [0112.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.230] GetFileType (hFile=0x154) returned 0x1 [0112.231] WriteFile (in: hFile=0x154, lpBuffer=0x1a9f59c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a9f59c*, lpNumberOfBytesWritten=0x2ae2e4*=0x4d0, lpOverlapped=0x0) returned 1 [0112.232] CloseHandle (hObject=0x154) returned 1 [0112.232] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x72 [0112.232] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x7c [0112.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76f89d0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x76f89d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1d46290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0112.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.232] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.anonymous")) returned 1 [0112.232] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x76 [0112.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.233] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.233] GetFileType (hFile=0x154) returned 0x1 [0112.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.233] GetFileType (hFile=0x154) returned 0x1 [0112.233] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x5eb [0112.233] ReadFile (in: hFile=0x154, lpBuffer=0x1aa1050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1aa1050*, lpNumberOfBytesRead=0x2ae31c*=0x5eb, lpOverlapped=0x0) returned 1 [0112.235] CloseHandle (hObject=0x154) returned 1 [0112.246] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x76 [0112.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.246] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.248] GetFileType (hFile=0x154) returned 0x1 [0112.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.248] GetFileType (hFile=0x154) returned 0x1 [0112.248] WriteFile (in: hFile=0x154, lpBuffer=0x1af0d94*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1af0d94*, lpNumberOfBytesWritten=0x2ae2e4*=0x5f0, lpOverlapped=0x0) returned 1 [0112.249] CloseHandle (hObject=0x154) returned 1 [0112.249] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x76 [0112.249] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.anonymous", lpFilePart=0x0) returned 0x80 [0112.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d2870, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x76d2870, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1d92550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f0)) returned 1 [0112.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.249] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.anonymous")) returned 1 [0112.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.250] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x32 [0112.250] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x33 [0112.250] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0112.250] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.251] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.251] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x32 [0112.251] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x33 [0112.251] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0112.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.251] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.252] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.252] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.252] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.252] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500", lpFilePart=0x0) returned 0x60 [0112.252] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\", lpFilePart=0x0) returned 0x61 [0112.252] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.254] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.254] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.254] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.254] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.254] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.256] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500", lpFilePart=0x0) returned 0x60 [0112.256] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\", lpFilePart=0x0) returned 0x61 [0112.256] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.257] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.257] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.258] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32 [0112.258] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x33 [0112.258] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0112.263] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.263] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.263] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.263] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.264] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.265] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.265] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.265] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0112.266] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32 [0112.266] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x33 [0112.266] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe9d8 [0112.267] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.267] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.267] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.267] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.267] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0112.268] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0112.268] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0112.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0112.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.270] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3a [0112.270] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x3b [0112.270] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.271] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.272] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.272] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.272] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.272] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3a [0112.272] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x3b [0112.272] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.272] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.272] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.272] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.273] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.273] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x40 [0112.273] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x41 [0112.273] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.282] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.282] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.282] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.282] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.282] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x40 [0112.282] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x41 [0112.282] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.282] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.282] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.283] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.283] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.283] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x44 [0112.283] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x45 [0112.283] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.283] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.283] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.283] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.283] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x44 [0112.283] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x45 [0112.284] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.284] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.284] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.284] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.284] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3d [0112.284] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x3e [0112.284] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.284] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.284] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.285] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.285] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.285] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.285] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3d [0112.285] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x3e [0112.285] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.285] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.285] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.285] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.286] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.286] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.286] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x41 [0112.286] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x42 [0112.286] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.286] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.286] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.286] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.286] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x41 [0112.286] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x42 [0112.286] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.287] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.287] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.287] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.287] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3c [0112.287] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x3d [0112.287] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.290] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.291] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.291] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.291] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.291] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.291] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.291] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.291] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.292] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3c [0112.292] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x3d [0112.292] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.293] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.293] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.294] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44 [0112.294] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x45 [0112.295] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.295] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.295] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.295] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.295] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44 [0112.295] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x45 [0112.295] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.295] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.295] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.295] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.295] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44 [0112.295] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x45 [0112.295] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.296] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.296] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.296] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.296] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44 [0112.296] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x45 [0112.296] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.296] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.296] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.296] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.296] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3b [0112.296] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x3c [0112.296] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.297] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.297] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.297] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.297] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.297] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3b [0112.297] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x3c [0112.297] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.297] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.297] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.297] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.297] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.297] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x3f [0112.297] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x40 [0112.297] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.298] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.298] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.298] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.298] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x3f [0112.298] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x40 [0112.298] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.298] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.298] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.298] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.298] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39 [0112.298] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x3a [0112.298] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.299] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.299] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39 [0112.299] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x3a [0112.299] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.299] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.299] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.300] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x4f [0112.300] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x50 [0112.300] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.323] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.323] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.323] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.323] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.323] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x4f [0112.323] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x50 [0112.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.323] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.323] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.323] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.323] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.323] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4c [0112.323] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x4d [0112.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.332] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.333] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.333] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.333] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.333] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.333] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.334] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4c [0112.334] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x4d [0112.334] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe9d8 [0112.335] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.335] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.335] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.335] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.335] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.335] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.336] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39 [0112.336] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x3a [0112.336] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.338] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.338] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.339] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39 [0112.339] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x3a [0112.339] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe9d8 [0112.340] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.340] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.340] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.341] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.341] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.341] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.341] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.341] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.341] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0112.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.342] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFilePart=0x0) returned 0x4b [0112.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0112.342] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.343] GetFileType (hFile=0x154) returned 0x1 [0112.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0112.343] GetFileType (hFile=0x154) returned 0x1 [0112.343] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4d6 [0112.344] ReadFile (in: hFile=0x154, lpBuffer=0x1b11a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b11a30*, lpNumberOfBytesRead=0x2ae404*=0x4d6, lpOverlapped=0x0) returned 1 [0112.371] CloseHandle (hObject=0x154) returned 1 [0112.383] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFilePart=0x0) returned 0x4b [0112.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0112.383] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.384] GetFileType (hFile=0x154) returned 0x1 [0112.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0112.384] GetFileType (hFile=0x154) returned 0x1 [0112.384] WriteFile (in: hFile=0x154, lpBuffer=0x1b611c0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b611c0*, lpNumberOfBytesWritten=0x2ae3cc*=0x4e0, lpOverlapped=0x0) returned 1 [0112.385] CloseHandle (hObject=0x154) returned 1 [0112.385] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFilePart=0x0) returned 0x4b [0112.385] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0112.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0112.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b79a156, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x763a2f0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1ec3050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0112.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.386] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.anonymous")) returned 1 [0112.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.386] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d [0112.386] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x3e [0112.386] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0112.386] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.386] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.386] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.386] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.387] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0112.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0112.387] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d [0112.387] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x3e [0112.387] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0112.387] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.387] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.387] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0112.387] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0112.387] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0112.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0112.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0112.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.387] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46 [0112.387] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x47 [0112.387] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0112.389] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.389] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.389] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.389] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.389] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.390] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.390] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.390] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.390] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0112.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0112.391] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46 [0112.391] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x47 [0112.391] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.392] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0112.393] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0112.393] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0112.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0112.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0112.394] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x5c [0112.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0112.394] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.396] GetFileType (hFile=0x154) returned 0x1 [0112.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0112.396] GetFileType (hFile=0x154) returned 0x1 [0112.396] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x58b [0112.396] ReadFile (in: hFile=0x154, lpBuffer=0x1b67234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b67234*, lpNumberOfBytesRead=0x2ae390*=0x58b, lpOverlapped=0x0) returned 1 [0112.410] CloseHandle (hObject=0x154) returned 1 [0112.459] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x5c [0112.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0112.459] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.461] GetFileType (hFile=0x154) returned 0x1 [0112.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0112.461] GetFileType (hFile=0x154) returned 0x1 [0112.461] WriteFile (in: hFile=0x154, lpBuffer=0x19b7b14*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19b7b14*, lpNumberOfBytesWritten=0x2ae358*=0x590, lpOverlapped=0x0) returned 1 [0112.462] CloseHandle (hObject=0x154) returned 1 [0112.463] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x5c [0112.463] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x66 [0112.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0112.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cb4af0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x6cb4af0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe1f81730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0112.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.463] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.anonymous")) returned 1 [0112.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0112.464] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52 [0112.464] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x53 [0112.464] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbefd8 [0112.466] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.466] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.467] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0112.467] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0112.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0112.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0112.469] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52 [0112.469] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x53 [0112.469] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbefd8 [0112.470] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.470] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0112.471] FindNextFileW (in: hFindFile=0xbefd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0112.472] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0112.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0112.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0112.473] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFilePart=0x0) returned 0x65 [0112.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.473] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.475] GetFileType (hFile=0x154) returned 0x1 [0112.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.475] GetFileType (hFile=0x154) returned 0x1 [0112.475] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x500 [0112.475] ReadFile (in: hFile=0x154, lpBuffer=0x19bc9c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19bc9c4*, lpNumberOfBytesRead=0x2ae31c*=0x500, lpOverlapped=0x0) returned 1 [0112.606] CloseHandle (hObject=0x154) returned 1 [0112.618] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFilePart=0x0) returned 0x65 [0112.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.618] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.620] GetFileType (hFile=0x154) returned 0x1 [0112.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.620] GetFileType (hFile=0x154) returned 0x1 [0112.620] WriteFile (in: hFile=0x154, lpBuffer=0x1a0c3dc*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a0c3dc*, lpNumberOfBytesWritten=0x2ae2e4*=0x510, lpOverlapped=0x0) returned 1 [0112.621] CloseHandle (hObject=0x154) returned 1 [0112.621] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFilePart=0x0) returned 0x65 [0112.621] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.anonymous", lpFilePart=0x0) returned 0x6f [0112.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd228a7, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7614190, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe20fe4f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0112.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.621] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.anonymous")) returned 1 [0112.621] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFilePart=0x0) returned 0x5e [0112.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.622] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.622] GetFileType (hFile=0x154) returned 0x1 [0112.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.622] GetFileType (hFile=0x154) returned 0x1 [0112.622] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x518 [0112.623] ReadFile (in: hFile=0x154, lpBuffer=0x1a0dd34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a0dd34*, lpNumberOfBytesRead=0x2ae31c*=0x518, lpOverlapped=0x0) returned 1 [0112.638] CloseHandle (hObject=0x154) returned 1 [0112.651] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFilePart=0x0) returned 0x5e [0112.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.651] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.652] GetFileType (hFile=0x154) returned 0x1 [0112.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.653] GetFileType (hFile=0x154) returned 0x1 [0112.653] WriteFile (in: hFile=0x154, lpBuffer=0x1a5d61c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a5d61c*, lpNumberOfBytesWritten=0x2ae2e4*=0x520, lpOverlapped=0x0) returned 1 [0112.654] CloseHandle (hObject=0x154) returned 1 [0112.654] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFilePart=0x0) returned 0x5e [0112.654] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0112.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f73ce14, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7151590, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe214a7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0112.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.654] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.anonymous")) returned 1 [0112.656] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFilePart=0x0) returned 0x5a [0112.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.656] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.657] GetFileType (hFile=0x154) returned 0x1 [0112.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.657] GetFileType (hFile=0x154) returned 0x1 [0112.657] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x106 [0112.657] ReadFile (in: hFile=0x154, lpBuffer=0x1a5eb18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a5eb18*, lpNumberOfBytesRead=0x2ae31c*=0x106, lpOverlapped=0x0) returned 1 [0112.658] CloseHandle (hObject=0x154) returned 1 [0112.671] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFilePart=0x0) returned 0x5a [0112.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.671] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.673] GetFileType (hFile=0x154) returned 0x1 [0112.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.673] GetFileType (hFile=0x154) returned 0x1 [0112.673] WriteFile (in: hFile=0x154, lpBuffer=0x1aacfa4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1aacfa4*, lpNumberOfBytesWritten=0x2ae2e4*=0x110, lpOverlapped=0x0) returned 1 [0112.674] CloseHandle (hObject=0x154) returned 1 [0112.674] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFilePart=0x0) returned 0x5a [0112.674] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.anonymous", lpFilePart=0x0) returned 0x64 [0112.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.674] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3554d69, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x763a2f0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe2196a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0112.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.675] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.anonymous")) returned 1 [0112.675] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x67 [0112.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0112.675] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.676] GetFileType (hFile=0x154) returned 0x1 [0112.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0112.676] GetFileType (hFile=0x154) returned 0x1 [0112.676] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x4cc [0112.676] ReadFile (in: hFile=0x154, lpBuffer=0x1aae880, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1aae880*, lpNumberOfBytesRead=0x2ae31c*=0x4cc, lpOverlapped=0x0) returned 1 [0112.695] CloseHandle (hObject=0x154) returned 1 [0112.708] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x67 [0112.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0112.708] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.709] GetFileType (hFile=0x154) returned 0x1 [0112.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0112.709] GetFileType (hFile=0x154) returned 0x1 [0112.709] WriteFile (in: hFile=0x154, lpBuffer=0x1afdff8*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1afdff8*, lpNumberOfBytesWritten=0x2ae2e4*=0x4d0, lpOverlapped=0x0) returned 1 [0112.710] CloseHandle (hObject=0x154) returned 1 [0112.710] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x67 [0112.711] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x71 [0112.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0112.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34bc7e8, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x6cdac50, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe21e2d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0112.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.711] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.anonymous")) returned 1 [0112.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0112.711] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x60 [0112.711] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x61 [0112.711] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee18 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.714] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0112.714] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0112.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0112.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0112.715] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x60 [0112.715] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x61 [0112.715] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee18 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.717] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0112.718] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0112.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0112.719] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFilePart=0x0) returned 0x73 [0112.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.719] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.720] GetFileType (hFile=0x154) returned 0x1 [0112.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.720] GetFileType (hFile=0x154) returned 0x1 [0112.720] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x54e [0112.720] ReadFile (in: hFile=0x154, lpBuffer=0x1b02c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b02c58*, lpNumberOfBytesRead=0x2ae2a8*=0x54e, lpOverlapped=0x0) returned 1 [0112.731] CloseHandle (hObject=0x154) returned 1 [0112.743] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFilePart=0x0) returned 0x73 [0112.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.743] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.745] GetFileType (hFile=0x154) returned 0x1 [0112.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.745] GetFileType (hFile=0x154) returned 0x1 [0112.745] WriteFile (in: hFile=0x154, lpBuffer=0x1b52664*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b52664*, lpNumberOfBytesWritten=0x2ae270*=0x550, lpOverlapped=0x0) returned 1 [0112.746] CloseHandle (hObject=0x154) returned 1 [0112.746] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFilePart=0x0) returned 0x73 [0112.746] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.anonymous", lpFilePart=0x0) returned 0x7d [0112.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625779d2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x763a2f0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe222eff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0112.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.746] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.anonymous")) returned 1 [0112.747] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFilePart=0x0) returned 0x6c [0112.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.748] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.748] GetFileType (hFile=0x154) returned 0x1 [0112.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.748] GetFileType (hFile=0x154) returned 0x1 [0112.748] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4ea [0112.748] ReadFile (in: hFile=0x154, lpBuffer=0x1b53fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b53fe8*, lpNumberOfBytesRead=0x2ae2a8*=0x4ea, lpOverlapped=0x0) returned 1 [0112.761] CloseHandle (hObject=0x154) returned 1 [0112.797] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFilePart=0x0) returned 0x6c [0112.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.797] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.798] GetFileType (hFile=0x154) returned 0x1 [0112.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.798] GetFileType (hFile=0x154) returned 0x1 [0112.798] WriteFile (in: hFile=0x154, lpBuffer=0x19a4398*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a4398*, lpNumberOfBytesWritten=0x2ae270*=0x4f0, lpOverlapped=0x0) returned 1 [0112.800] CloseHandle (hObject=0x154) returned 1 [0112.800] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFilePart=0x0) returned 0x6c [0112.800] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.anonymous", lpFilePart=0x0) returned 0x76 [0112.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623d4aaf, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x76ac710, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe22c7570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0112.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.800] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.anonymous")) returned 1 [0112.801] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFilePart=0x0) returned 0x6d [0112.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.801] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.801] GetFileType (hFile=0x154) returned 0x1 [0112.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.801] GetFileType (hFile=0x154) returned 0x1 [0112.801] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4ee [0112.801] ReadFile (in: hFile=0x154, lpBuffer=0x19a5d00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a5d00*, lpNumberOfBytesRead=0x2ae2a8*=0x4ee, lpOverlapped=0x0) returned 1 [0112.816] CloseHandle (hObject=0x154) returned 1 [0112.828] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFilePart=0x0) returned 0x6d [0112.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.828] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.829] GetFileType (hFile=0x154) returned 0x1 [0112.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.829] GetFileType (hFile=0x154) returned 0x1 [0112.830] WriteFile (in: hFile=0x154, lpBuffer=0x19f5670*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19f5670*, lpNumberOfBytesWritten=0x2ae270*=0x4f0, lpOverlapped=0x0) returned 1 [0112.831] CloseHandle (hObject=0x154) returned 1 [0112.831] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFilePart=0x0) returned 0x6d [0112.831] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.anonymous", lpFilePart=0x0) returned 0x77 [0112.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.831] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6302dce6, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7660450, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe2313830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0112.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.831] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.anonymous")) returned 1 [0112.832] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFilePart=0x0) returned 0x77 [0112.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.832] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.832] GetFileType (hFile=0x154) returned 0x1 [0112.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.832] GetFileType (hFile=0x154) returned 0x1 [0112.832] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4e2 [0112.832] ReadFile (in: hFile=0x154, lpBuffer=0x19f6ff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f6ff4*, lpNumberOfBytesRead=0x2ae2a8*=0x4e2, lpOverlapped=0x0) returned 1 [0112.841] CloseHandle (hObject=0x154) returned 1 [0112.854] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFilePart=0x0) returned 0x77 [0112.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.854] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.855] GetFileType (hFile=0x154) returned 0x1 [0112.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.855] GetFileType (hFile=0x154) returned 0x1 [0112.855] WriteFile (in: hFile=0x154, lpBuffer=0x1a4683c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a4683c*, lpNumberOfBytesWritten=0x2ae270*=0x4f0, lpOverlapped=0x0) returned 1 [0112.856] CloseHandle (hObject=0x154) returned 1 [0112.856] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFilePart=0x0) returned 0x77 [0112.856] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.anonymous", lpFilePart=0x0) returned 0x81 [0112.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6246d030, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x71776f0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe235faf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0112.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.857] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.anonymous")) returned 1 [0112.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0112.857] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x5f [0112.857] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x60 [0112.857] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf2d8 [0112.859] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.859] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.859] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.859] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.859] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.860] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.860] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0112.860] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0112.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0112.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0112.861] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x5f [0112.861] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x60 [0112.861] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf2d8 [0112.862] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.862] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.862] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0112.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0112.863] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0112.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0112.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0112.864] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFilePart=0x0) returned 0x6c [0112.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.864] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.865] GetFileType (hFile=0x154) returned 0x1 [0112.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.865] GetFileType (hFile=0x154) returned 0x1 [0112.865] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x106 [0112.865] ReadFile (in: hFile=0x154, lpBuffer=0x1a4b1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4b1c8*, lpNumberOfBytesRead=0x2ae2a8*=0x106, lpOverlapped=0x0) returned 1 [0112.867] CloseHandle (hObject=0x154) returned 1 [0112.891] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFilePart=0x0) returned 0x6c [0112.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.891] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.893] GetFileType (hFile=0x154) returned 0x1 [0112.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.893] GetFileType (hFile=0x154) returned 0x1 [0112.893] WriteFile (in: hFile=0x154, lpBuffer=0x1a99684*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a99684*, lpNumberOfBytesWritten=0x2ae270*=0x110, lpOverlapped=0x0) returned 1 [0112.894] CloseHandle (hObject=0x154) returned 1 [0112.894] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFilePart=0x0) returned 0x6c [0112.894] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.anonymous", lpFilePart=0x0) returned 0x76 [0112.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd365f70b, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x7614190, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe23abdb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0112.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.894] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.anonymous")) returned 1 [0112.897] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFilePart=0x0) returned 0x71 [0112.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.897] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.898] GetFileType (hFile=0x154) returned 0x1 [0112.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.898] GetFileType (hFile=0x154) returned 0x1 [0112.898] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x106 [0112.898] ReadFile (in: hFile=0x154, lpBuffer=0x1a9ac14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a9ac14*, lpNumberOfBytesRead=0x2ae2a8*=0x106, lpOverlapped=0x0) returned 1 [0112.899] CloseHandle (hObject=0x154) returned 1 [0112.912] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFilePart=0x0) returned 0x71 [0112.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.912] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.913] GetFileType (hFile=0x154) returned 0x1 [0112.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.913] GetFileType (hFile=0x154) returned 0x1 [0112.913] WriteFile (in: hFile=0x154, lpBuffer=0x1ae90e0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ae90e0*, lpNumberOfBytesWritten=0x2ae270*=0x110, lpOverlapped=0x0) returned 1 [0112.914] CloseHandle (hObject=0x154) returned 1 [0112.914] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFilePart=0x0) returned 0x71 [0112.914] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.anonymous", lpFilePart=0x0) returned 0x7b [0112.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd361344b, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x7151590, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe23d1f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0112.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.915] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.anonymous")) returned 1 [0112.915] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFilePart=0x0) returned 0x82 [0112.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.915] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.919] GetFileType (hFile=0x154) returned 0x1 [0112.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.919] GetFileType (hFile=0x154) returned 0x1 [0112.919] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x5bd [0112.919] ReadFile (in: hFile=0x154, lpBuffer=0x1aeaba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aeaba0*, lpNumberOfBytesRead=0x2ae2a8*=0x5bd, lpOverlapped=0x0) returned 1 [0112.935] CloseHandle (hObject=0x154) returned 1 [0112.973] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFilePart=0x0) returned 0x82 [0112.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0112.974] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.975] GetFileType (hFile=0x154) returned 0x1 [0112.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0112.975] GetFileType (hFile=0x154) returned 0x1 [0112.975] WriteFile (in: hFile=0x154, lpBuffer=0x1b3a81c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b3a81c*, lpNumberOfBytesWritten=0x2ae270*=0x5c0, lpOverlapped=0x0) returned 1 [0112.976] CloseHandle (hObject=0x154) returned 1 [0112.976] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFilePart=0x0) returned 0x82 [0112.976] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.anonymous", lpFilePart=0x0) returned 0x8c [0112.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0112.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cdac50, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x6cdac50, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe246a490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0112.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0112.976] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.anonymous")) returned 1 [0112.977] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFilePart=0x0) returned 0x7c [0112.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0112.977] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0112.977] GetFileType (hFile=0x154) returned 0x1 [0112.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0112.977] GetFileType (hFile=0x154) returned 0x1 [0112.977] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x51a [0112.977] ReadFile (in: hFile=0x154, lpBuffer=0x1b3c274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b3c274*, lpNumberOfBytesRead=0x2ae2a8*=0x51a, lpOverlapped=0x0) returned 1 [0112.991] CloseHandle (hObject=0x154) returned 1 [0113.024] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFilePart=0x0) returned 0x7c [0113.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0113.024] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.025] GetFileType (hFile=0x154) returned 0x1 [0113.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0113.025] GetFileType (hFile=0x154) returned 0x1 [0113.025] WriteFile (in: hFile=0x154, lpBuffer=0x198bc3c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x198bc3c*, lpNumberOfBytesWritten=0x2ae270*=0x520, lpOverlapped=0x0) returned 1 [0113.026] CloseHandle (hObject=0x154) returned 1 [0113.026] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFilePart=0x0) returned 0x7c [0113.026] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.anonymous", lpFilePart=0x0) returned 0x86 [0113.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0113.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b47a471, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x6cdac50, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe24dc8b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0113.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0113.027] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.anonymous")) returned 1 [0113.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0113.027] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5b [0113.027] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x5c [0113.027] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0113.028] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.029] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.029] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.029] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0113.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0113.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0113.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0113.029] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5b [0113.029] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x5c [0113.029] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0113.029] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.029] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.030] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.030] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0113.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0113.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0113.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0113.030] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52 [0113.030] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x53 [0113.030] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0113.030] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.030] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.030] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.030] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.031] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0113.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0113.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0113.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0113.031] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52 [0113.031] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x53 [0113.031] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0113.031] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.031] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.031] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.031] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.031] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0113.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0113.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0113.032] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFilePart=0x0) returned 0x5b [0113.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0113.032] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.032] GetFileType (hFile=0x154) returned 0x1 [0113.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0113.032] GetFileType (hFile=0x154) returned 0x1 [0113.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x106 [0113.032] ReadFile (in: hFile=0x154, lpBuffer=0x199104c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x199104c*, lpNumberOfBytesRead=0x2ae31c*=0x106, lpOverlapped=0x0) returned 1 [0113.033] CloseHandle (hObject=0x154) returned 1 [0113.050] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFilePart=0x0) returned 0x5b [0113.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0113.050] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.051] GetFileType (hFile=0x154) returned 0x1 [0113.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0113.051] GetFileType (hFile=0x154) returned 0x1 [0113.052] WriteFile (in: hFile=0x154, lpBuffer=0x19df638*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19df638*, lpNumberOfBytesWritten=0x2ae2e4*=0x110, lpOverlapped=0x0) returned 1 [0113.053] CloseHandle (hObject=0x154) returned 1 [0113.053] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFilePart=0x0) returned 0x5b [0113.053] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.anonymous", lpFilePart=0x0) returned 0x65 [0113.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0113.053] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35c718a, ftCreationTime.dwHighDateTime=0x1ca043c, ftLastAccessTime.dwLowDateTime=0x6cb4af0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe2528b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0113.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0113.053] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.anonymous")) returned 1 [0113.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0113.054] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4e [0113.054] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x4f [0113.054] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0113.054] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.054] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.054] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.054] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0113.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0113.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0113.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0113.055] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4e [0113.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x4f [0113.055] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0113.055] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.055] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.055] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.055] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0113.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0113.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0113.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.055] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3c [0113.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x3d [0113.055] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0113.056] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.056] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.056] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0113.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.056] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3c [0113.056] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x3d [0113.056] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0113.056] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.056] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.057] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0113.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.057] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x39 [0113.057] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x3a [0113.057] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0113.057] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.057] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.057] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.057] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0113.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.058] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x39 [0113.058] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x3a [0113.058] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0113.058] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.058] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.058] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.058] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0113.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.058] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51 [0113.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0113.058] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.059] GetFileType (hFile=0x154) returned 0x1 [0113.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0113.059] GetFileType (hFile=0x154) returned 0x1 [0113.059] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9b944 [0113.061] ReadFile (in: hFile=0x154, lpBuffer=0x1be015c0, nNumberOfBytesToRead=0x9b944, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1be015c0*, lpNumberOfBytesRead=0x2ae404*=0x9b944, lpOverlapped=0x0) returned 1 [0113.086] CloseHandle (hObject=0x154) returned 1 [0113.142] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51 [0113.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0113.142] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.149] GetFileType (hFile=0x154) returned 0x1 [0113.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0113.150] GetFileType (hFile=0x154) returned 0x1 [0113.150] WriteFile (in: hFile=0x154, lpBuffer=0x1c10b480*, nNumberOfBytesToWrite=0x9b950, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1c10b480*, lpNumberOfBytesWritten=0x2ae3f8*=0x9b950, lpOverlapped=0x0) returned 1 [0113.161] CloseHandle (hObject=0x154) returned 1 [0113.162] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51 [0113.162] GetFullPathNameW (in: lpFileName="\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0113.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0113.162] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c8e990, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x6c8e990, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe2633510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9b950)) returned 1 [0113.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0113.162] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.anonymous" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.anonymous")) returned 1 [0113.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.162] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Application Data", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data", lpFilePart=0x0) returned 0x21 [0113.162] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data\\", lpFilePart=0x0) returned 0x22 [0113.163] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.164] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Contacts", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts", lpFilePart=0x0) returned 0x19 [0113.164] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts\\", lpFilePart=0x0) returned 0x1a [0113.164] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.164] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.164] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.164] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.165] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.165] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.165] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Contacts", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts", lpFilePart=0x0) returned 0x19 [0113.165] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts\\", lpFilePart=0x0) returned 0x1a [0113.165] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.165] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.165] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.165] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.165] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.166] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.166] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies", lpFilePart=0x0) returned 0x18 [0113.166] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies\\", lpFilePart=0x0) returned 0x19 [0113.166] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.167] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18 [0113.167] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop\\", lpFilePart=0x0) returned 0x19 [0113.167] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.167] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.168] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.168] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.168] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.168] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18 [0113.168] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop\\", lpFilePart=0x0) returned 0x19 [0113.168] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.168] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.168] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.169] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.169] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.169] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a [0113.169] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\", lpFilePart=0x0) returned 0x1b [0113.169] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.170] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.170] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.170] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.170] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.170] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.171] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.171] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.172] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a [0113.172] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\", lpFilePart=0x0) returned 0x1b [0113.172] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.173] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.173] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.173] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.173] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.173] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.173] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.173] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.174] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music", lpFilePart=0x0) returned 0x23 [0113.174] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music\\", lpFilePart=0x0) returned 0x24 [0113.175] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0113.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0113.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.180] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26 [0113.180] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x27 [0113.180] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0113.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0113.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.185] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos", lpFilePart=0x0) returned 0x24 [0113.185] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x25 [0113.185] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0113.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0113.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.189] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a [0113.189] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads\\", lpFilePart=0x0) returned 0x1b [0113.189] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.190] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.190] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.190] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.190] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.190] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a [0113.190] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads\\", lpFilePart=0x0) returned 0x1b [0113.190] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.191] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.191] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.191] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.191] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.191] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a [0113.191] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\", lpFilePart=0x0) returned 0x1b [0113.191] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.193] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.193] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.193] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.193] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.194] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.194] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.194] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.194] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.195] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a [0113.195] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\", lpFilePart=0x0) returned 0x1b [0113.195] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.196] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.196] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.196] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.196] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.196] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.197] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.197] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.197] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.198] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links", lpFilePart=0x0) returned 0x20 [0113.198] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links\\", lpFilePart=0x0) returned 0x21 [0113.198] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.199] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.199] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.199] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.199] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.199] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.200] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links", lpFilePart=0x0) returned 0x20 [0113.200] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links\\", lpFilePart=0x0) returned 0x21 [0113.200] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.200] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.200] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.200] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.200] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.200] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.200] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2d [0113.201] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x2e [0113.201] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.216] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.217] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.218] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2d [0113.218] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x2e [0113.218] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.219] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.220] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.220] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.221] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x27 [0113.221] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x28 [0113.221] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.257] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.257] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.257] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.257] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.257] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.258] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.258] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.258] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.258] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.259] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x27 [0113.259] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x28 [0113.259] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.261] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.262] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.262] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.263] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x27 [0113.263] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x28 [0113.263] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.275] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.275] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.276] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.276] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.276] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.276] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.276] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.277] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x27 [0113.277] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x28 [0113.277] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf258 [0113.278] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.278] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.278] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.279] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.279] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.279] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.279] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.280] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16 [0113.280] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\", lpFilePart=0x0) returned 0x17 [0113.280] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.303] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.303] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.304] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.304] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.304] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.304] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.304] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.305] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16 [0113.305] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\", lpFilePart=0x0) returned 0x17 [0113.305] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf258 [0113.306] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.306] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.306] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.306] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.307] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.307] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.307] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0113.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.308] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x22 [0113.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0113.308] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.310] GetFileType (hFile=0x154) returned 0x1 [0113.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0113.310] GetFileType (hFile=0x154) returned 0x1 [0113.310] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1d3 [0113.310] ReadFile (in: hFile=0x154, lpBuffer=0x1a43df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a43df8*, lpNumberOfBytesRead=0x2ae5d4*=0x1d3, lpOverlapped=0x0) returned 1 [0113.311] CloseHandle (hObject=0x154) returned 1 [0113.346] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x22 [0113.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0113.346] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.348] GetFileType (hFile=0x154) returned 0x1 [0113.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0113.348] GetFileType (hFile=0x154) returned 0x1 [0113.348] WriteFile (in: hFile=0x154, lpBuffer=0x1a92630*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a92630*, lpNumberOfBytesWritten=0x2ae59c*=0x1e0, lpOverlapped=0x0) returned 1 [0113.349] CloseHandle (hObject=0x154) returned 1 [0113.349] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x22 [0113.349] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Desktop.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Desktop.lnk.anonymous", lpFilePart=0x0) returned 0x2c [0113.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0113.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c426d0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x6c426d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe27fc590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1 [0113.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.349] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk.anonymous" (normalized: "c:\\users\\default\\links\\desktop.lnk.anonymous")) returned 1 [0113.355] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x24 [0113.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0113.355] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.355] GetFileType (hFile=0x154) returned 0x1 [0113.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0113.355] GetFileType (hFile=0x154) returned 0x1 [0113.355] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x36e [0113.355] ReadFile (in: hFile=0x154, lpBuffer=0x1a93bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a93bcc*, lpNumberOfBytesRead=0x2ae5d4*=0x36e, lpOverlapped=0x0) returned 1 [0113.357] CloseHandle (hObject=0x154) returned 1 [0113.369] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x24 [0113.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0113.369] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.370] GetFileType (hFile=0x154) returned 0x1 [0113.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0113.370] GetFileType (hFile=0x154) returned 0x1 [0113.370] WriteFile (in: hFile=0x154, lpBuffer=0x1ae2bd0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ae2bd0*, lpNumberOfBytesWritten=0x2ae59c*=0x370, lpOverlapped=0x0) returned 1 [0113.374] CloseHandle (hObject=0x154) returned 1 [0113.375] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x24 [0113.375] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\Downloads.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Downloads.lnk.anonymous", lpFilePart=0x0) returned 0x2e [0113.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0113.375] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c426d0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x6c426d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe2848850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0113.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.375] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk.anonymous" (normalized: "c:\\users\\default\\links\\downloads.lnk.anonymous")) returned 1 [0113.375] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x27 [0113.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0113.375] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.376] GetFileType (hFile=0x154) returned 0x1 [0113.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0113.376] GetFileType (hFile=0x154) returned 0x1 [0113.376] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x16b [0113.376] ReadFile (in: hFile=0x154, lpBuffer=0x1ae3f80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ae3f80*, lpNumberOfBytesRead=0x2ae5d4*=0x16b, lpOverlapped=0x0) returned 1 [0113.377] CloseHandle (hObject=0x154) returned 1 [0113.388] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x27 [0113.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0113.388] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.389] GetFileType (hFile=0x154) returned 0x1 [0113.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0113.389] GetFileType (hFile=0x154) returned 0x1 [0113.389] WriteFile (in: hFile=0x154, lpBuffer=0x1b32594*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1b32594*, lpNumberOfBytesWritten=0x2ae59c*=0x170, lpOverlapped=0x0) returned 1 [0113.390] CloseHandle (hObject=0x154) returned 1 [0113.390] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x27 [0113.390] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Links\\RecentPlaces.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\RecentPlaces.lnk.anonymous", lpFilePart=0x0) returned 0x31 [0113.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0113.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c426d0, ftCreationTime.dwHighDateTime=0x1d2da0d, ftLastAccessTime.dwLowDateTime=0x6c426d0, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0xe286e9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1 [0113.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.391] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.anonymous" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.anonymous")) returned 1 [0113.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.391] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Local Settings", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings", lpFilePart=0x0) returned 0x1f [0113.391] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings\\", lpFilePart=0x0) returned 0x20 [0113.391] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.392] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16 [0113.393] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\", lpFilePart=0x0) returned 0x17 [0113.393] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.393] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.393] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.393] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.393] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.393] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16 [0113.393] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\", lpFilePart=0x0) returned 0x17 [0113.393] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.394] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.394] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.394] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.394] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.394] GetFullPathNameW (in: lpFileName="\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d [0113.394] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents\\", lpFilePart=0x0) returned 0x1e [0113.394] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.395] GetFullPathNameW (in: lpFileName="\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18 [0113.395] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood\\", lpFilePart=0x0) returned 0x19 [0113.395] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.397] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19 [0113.397] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\", lpFilePart=0x0) returned 0x1a [0113.397] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.397] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.397] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.397] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.397] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.398] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19 [0113.398] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\", lpFilePart=0x0) returned 0x1a [0113.398] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.398] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.398] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.398] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.398] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.398] GetFullPathNameW (in: lpFileName="\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a [0113.399] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood\\", lpFilePart=0x0) returned 0x1b [0113.399] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.400] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17 [0113.400] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\", lpFilePart=0x0) returned 0x18 [0113.400] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.401] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c [0113.401] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\", lpFilePart=0x0) returned 0x1d [0113.401] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.401] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.402] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.402] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.402] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.402] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c [0113.402] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\", lpFilePart=0x0) returned 0x1d [0113.402] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.403] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.403] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.403] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.403] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.403] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Searches", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches", lpFilePart=0x0) returned 0x19 [0113.403] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\", lpFilePart=0x0) returned 0x1a [0113.403] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.413] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.414] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.414] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.414] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.414] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.414] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.415] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Searches", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches", lpFilePart=0x0) returned 0x19 [0113.415] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\", lpFilePart=0x0) returned 0x1a [0113.415] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.416] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.416] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.416] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.417] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.417] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.417] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.424] GetFullPathNameW (in: lpFileName="\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17 [0113.424] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo\\", lpFilePart=0x0) returned 0x18 [0113.424] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.425] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b [0113.425] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu\\", lpFilePart=0x0) returned 0x1c [0113.425] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.427] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a [0113.427] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates\\", lpFilePart=0x0) returned 0x1b [0113.427] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0113.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0113.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.428] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17 [0113.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\", lpFilePart=0x0) returned 0x18 [0113.428] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.428] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.429] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.429] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.429] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.429] GetFullPathNameW (in: lpFileName="\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17 [0113.429] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\", lpFilePart=0x0) returned 0x18 [0113.429] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.429] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.429] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.430] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.430] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0113.430] GetFullPathNameW (in: lpFileName="\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15 [0113.430] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\", lpFilePart=0x0) returned 0x16 [0113.430] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xffffffff [0113.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae694) returned 1 [0113.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0113.431] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5", lpFilePart=0x0) returned 0x10 [0113.431] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\", lpFilePart=0x0) returned 0x11 [0113.431] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe918 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.432] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.433] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.434] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.435] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0113.435] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0113.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0113.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0113.436] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5", lpFilePart=0x0) returned 0x10 [0113.436] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\", lpFilePart=0x0) returned 0x11 [0113.436] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbe918 [0113.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.436] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.437] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.438] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0113.439] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0113.439] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0113.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0113.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.439] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData", lpFilePart=0x0) returned 0x18 [0113.439] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\", lpFilePart=0x0) returned 0x19 [0113.439] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.440] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.440] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.440] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.440] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.440] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.440] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0113.440] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData", lpFilePart=0x0) returned 0x18 [0113.440] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\", lpFilePart=0x0) returned 0x19 [0113.441] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0113.441] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.441] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.441] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.441] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0113.441] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0113.441] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0113.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0113.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.441] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0113.441] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f [0113.441] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe918 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.442] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.443] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.443] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0113.443] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0113.444] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f [0113.444] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe918 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.444] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0113.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0113.445] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0113.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0113.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0113.445] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x24 [0113.445] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x25 [0113.445] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0113.445] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0113.446] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0113.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0113.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0113.446] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x24 [0113.446] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x25 [0113.446] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0113.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.446] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.447] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.447] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0113.447] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0113.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0113.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0113.447] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2c [0113.447] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x2d [0113.447] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0113.447] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.447] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.447] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0113.447] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0113.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0113.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0113.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2c [0113.448] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x2d [0113.448] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0113.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.448] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0113.448] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0113.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0113.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x31 [0113.448] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x32 [0113.448] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.450] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.450] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.451] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x31 [0113.451] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x32 [0113.452] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.453] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.453] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0113.454] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x37 [0113.455] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x38 [0113.455] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0113.456] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0113.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0113.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0113.456] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x37 [0113.456] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x38 [0113.456] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.456] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.457] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0113.457] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0113.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0113.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0113.457] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x2a [0113.457] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x2b [0113.457] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0113.457] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.457] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.457] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.457] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0113.458] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0113.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0113.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0113.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x2a [0113.458] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x2b [0113.458] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0113.458] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.458] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.458] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.458] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0113.458] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0113.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0113.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x33 [0113.458] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x34 [0113.458] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0113.462] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.462] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.462] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.462] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.462] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0113.462] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x33 [0113.462] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x34 [0113.463] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0113.463] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.463] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.463] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.463] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.463] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0113.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0113.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0113.463] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f [0113.463] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x30 [0113.463] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Application Data\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xffffffff [0113.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae538) returned 1 [0113.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0113.464] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x25 [0113.464] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x26 [0113.464] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0113.465] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0113.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0113.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0113.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x25 [0113.465] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x26 [0113.465] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0113.465] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0113.465] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0113.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0113.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0113.466] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x2c [0113.466] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x2d [0113.466] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0113.466] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.466] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.466] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0113.466] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0113.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0113.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0113.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x2c [0113.467] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x2d [0113.467] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe918 [0113.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0113.467] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0113.467] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0113.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x36 [0113.467] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x37 [0113.467] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0113.478] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.478] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.478] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.478] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.478] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.479] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.479] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.480] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x36 [0113.480] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x37 [0113.480] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0113.481] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0113.481] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.482] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x4e [0113.482] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x4f [0113.482] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0113.485] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.485] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x4e [0113.485] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x4f [0113.485] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.485] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0113.486] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.486] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x3f [0113.486] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x40 [0113.486] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.486] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.486] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.486] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.486] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.486] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0113.486] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x3f [0113.487] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x40 [0113.487] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.487] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.487] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.487] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.487] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.487] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0113.487] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x47 [0113.487] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x48 [0113.487] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.488] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.488] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.488] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.488] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x47 [0113.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x48 [0113.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.488] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.488] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0113.488] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0113.488] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x3e [0113.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x3f [0113.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.490] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.498] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.499] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.500] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0113.500] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.501] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x3e [0113.501] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x3f [0113.501] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe918 [0113.502] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.503] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x44 [0113.503] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x45 [0113.503] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.505] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.505] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x44 [0113.505] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x45 [0113.505] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.505] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.505] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x5b [0113.505] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x5c [0113.505] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.511] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.512] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x5b [0113.512] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x5c [0113.513] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.514] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.515] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x4e [0113.515] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x4f [0113.515] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.521] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x4e [0113.522] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x4f [0113.522] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.523] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.524] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x4e [0113.524] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x4f [0113.524] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.538] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.539] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x4e [0113.539] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x4f [0113.539] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.540] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.541] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x49 [0113.541] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x4a [0113.541] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.562] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x49 [0113.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x4a [0113.563] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe918 [0113.565] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x6a [0113.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x6b [0113.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbe918 [0113.572] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x6a [0113.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x6b [0113.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbe918 [0113.573] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x70 [0113.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x71 [0113.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbe918 [0113.584] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x70 [0113.585] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x71 [0113.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbe918 [0113.586] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0113.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x7d [0113.587] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.589] GetFileType (hFile=0x154) returned 0x1 [0113.589] GetFileType (hFile=0x154) returned 0x1 [0113.589] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0xd2c [0113.596] CloseHandle (hObject=0x154) returned 1 [0113.633] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x7d [0113.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0113.633] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.634] GetFileType (hFile=0x154) returned 0x1 [0113.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0113.634] GetFileType (hFile=0x154) returned 0x1 [0113.634] WriteFile (in: hFile=0x154, lpBuffer=0x19cf090*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x19cf090*, lpNumberOfBytesWritten=0x2ae1fc*=0xd30, lpOverlapped=0x0) returned 1 [0113.635] CloseHandle (hObject=0x154) returned 1 [0113.635] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x7d [0113.635] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.anonymous", lpFilePart=0x0) returned 0x87 [0113.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0113.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5fca670, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe61648f0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2aa9e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd30)) returned 1 [0113.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.636] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.anonymous")) returned 1 [0113.636] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x7c [0113.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae180) returned 1 [0113.636] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.637] GetFileType (hFile=0x154) returned 0x1 [0113.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae17c) returned 1 [0113.637] GetFileType (hFile=0x154) returned 0x1 [0113.637] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0xa0 [0113.637] ReadFile (in: hFile=0x154, lpBuffer=0x19d0624, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x19d0624*, lpNumberOfBytesRead=0x2ae234*=0xa0, lpOverlapped=0x0) returned 1 [0113.638] CloseHandle (hObject=0x154) returned 1 [0113.673] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x7c [0113.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0113.673] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.675] GetFileType (hFile=0x154) returned 0x1 [0113.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0113.675] GetFileType (hFile=0x154) returned 0x1 [0113.675] WriteFile (in: hFile=0x154, lpBuffer=0x1a1e990*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1a1e990*, lpNumberOfBytesWritten=0x2ae1fc*=0xb0, lpOverlapped=0x0) returned 1 [0113.676] CloseHandle (hObject=0x154) returned 1 [0113.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x7c [0113.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.anonymous", lpFilePart=0x0) returned 0x86 [0113.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0113.676] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5fcf490, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe61648f0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2b1c270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0113.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.676] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.anonymous")) returned 1 [0113.677] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x7a [0113.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae180) returned 1 [0113.677] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.683] GetFileType (hFile=0x154) returned 0x1 [0113.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae17c) returned 1 [0113.683] GetFileType (hFile=0x154) returned 0x1 [0113.683] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x5c [0113.683] ReadFile (in: hFile=0x154, lpBuffer=0x1a1fed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x1a1fed8*, lpNumberOfBytesRead=0x2ae234*=0x5c, lpOverlapped=0x0) returned 1 [0113.684] CloseHandle (hObject=0x154) returned 1 [0113.696] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x7a [0113.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0113.697] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.698] GetFileType (hFile=0x154) returned 0x1 [0113.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0113.698] GetFileType (hFile=0x154) returned 0x1 [0113.698] WriteFile (in: hFile=0x154, lpBuffer=0x1a6e034*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1a6e034*, lpNumberOfBytesWritten=0x2ae1fc*=0x60, lpOverlapped=0x0) returned 1 [0113.699] CloseHandle (hObject=0x154) returned 1 [0113.700] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x7a [0113.700] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.anonymous", lpFilePart=0x0) returned 0x84 [0113.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0113.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5fd42b0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe5fd90d0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2b68530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0113.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.700] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.anonymous")) returned 1 [0113.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0113.701] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x79 [0113.701] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x7a [0113.701] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbe9d8 [0113.703] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.703] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.703] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.703] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.703] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.703] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.704] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.705] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.706] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.707] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.708] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0113.708] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0113.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0113.709] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x79 [0113.709] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x7a [0113.710] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbe9d8 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.711] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.712] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.713] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.714] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.715] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0113.715] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0113.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.716] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x7c [0113.716] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7d [0113.716] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.717] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.718] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.718] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.718] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.718] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x7c [0113.718] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7d [0113.718] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.718] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.718] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.719] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.719] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.719] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x7c [0113.719] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7d [0113.719] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.720] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.720] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x7c [0113.720] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7d [0113.720] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.720] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.721] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.721] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.721] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.722] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.722] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.722] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.722] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.722] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.722] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.723] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.723] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.724] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.724] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.724] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.724] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.724] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.724] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.724] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.725] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.725] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.725] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.725] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.725] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.725] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.726] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.726] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.726] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.726] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.726] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.726] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.727] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.727] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.727] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.727] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.728] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.728] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.728] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.728] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.729] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.729] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.729] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.730] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.730] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.730] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.730] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.730] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.730] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.730] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.730] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.730] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.730] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.731] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.731] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.731] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.731] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.731] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.731] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.731] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.731] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.732] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.732] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.732] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.732] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.732] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.732] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.732] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.732] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.732] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.732] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.733] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.733] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.733] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.733] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.733] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.733] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.733] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.733] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.733] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.733] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.734] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.734] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.734] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.734] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.734] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.734] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.734] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.734] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.734] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.735] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.735] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.735] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.735] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.735] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.735] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.735] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.735] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.735] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.735] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.735] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.736] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.736] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.736] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.736] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.736] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.736] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.736] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.736] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.736] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.737] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.737] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.737] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.737] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.737] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.737] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.737] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.737] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.737] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.737] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.738] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.740] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.740] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.740] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.740] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.740] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.740] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.740] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.740] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.740] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.741] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.741] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.741] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.741] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.741] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.741] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.741] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.741] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.741] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.741] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.742] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.742] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.742] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.742] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.742] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.742] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.743] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.743] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.743] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.743] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.743] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.743] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.743] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.743] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.744] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.744] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.744] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.744] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.744] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.744] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.745] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.745] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.745] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.745] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.745] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.745] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.745] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.745] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.745] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.745] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.746] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.746] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.746] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.746] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.746] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.746] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.746] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.746] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.746] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.747] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.747] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.747] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.747] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.747] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.747] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.747] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.747] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.747] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.748] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.748] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.748] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.748] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.748] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.748] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.748] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.748] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.749] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.749] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.749] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.749] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.750] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.750] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.750] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.750] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.751] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.751] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.751] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.751] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.751] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.752] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.752] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.752] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.753] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.753] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.753] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0113.753] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.754] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.754] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.754] FindNextFileW (in: hFindFile=0xbe9d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0113.754] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.754] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.755] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.755] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.756] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.756] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.756] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.757] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.758] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.758] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.758] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.758] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.758] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.758] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.759] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.759] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.759] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.759] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.760] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.760] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.760] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.760] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.760] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.760] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.761] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.761] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.761] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.761] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.762] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.762] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.762] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.762] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.763] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.763] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.763] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.763] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.763] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.763] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.763] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.764] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.764] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0113.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0113.764] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.764] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0113.765] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.765] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.765] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.765] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.765] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.766] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.766] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.766] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.766] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.766] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbe9d8 [0113.767] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbe9d8 [0113.767] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbe9d8 [0113.767] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbe9d8 [0113.767] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbe9d8 [0113.768] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.768] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbe9d8 [0113.805] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.806] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbe9d8 [0113.807] FindClose (in: hFindFile=0xbe9d8 | out: hFindFile=0xbe9d8) returned 1 [0113.808] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.810] GetFileType (hFile=0x154) returned 0x1 [0113.810] GetFileType (hFile=0x154) returned 0x1 [0113.810] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0xbb8 [0113.830] CloseHandle (hObject=0x154) returned 1 [0113.841] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.843] GetFileType (hFile=0x154) returned 0x1 [0113.843] GetFileType (hFile=0x154) returned 0x1 [0113.843] WriteFile (in: hFile=0x154, lpBuffer=0x1b3f300*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1b3f300*, lpNumberOfBytesWritten=0x2ae1fc*=0xbc0, lpOverlapped=0x0) returned 1 [0113.844] CloseHandle (hObject=0x154) returned 1 [0113.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3cc9f40, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe3f053e0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2cbf190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbc0)) returned 1 [0113.844] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_128.png.anonymous")) returned 1 [0113.845] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.845] GetFileType (hFile=0x154) returned 0x1 [0113.845] GetFileType (hFile=0x154) returned 0x1 [0113.845] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x8f [0113.846] CloseHandle (hObject=0x154) returned 1 [0113.898] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png", lpFilePart=0x0) returned 0x80 [0113.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0113.898] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.900] GetFileType (hFile=0x154) returned 0x1 [0113.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0113.900] GetFileType (hFile=0x154) returned 0x1 [0113.900] WriteFile (in: hFile=0x154, lpBuffer=0x198ddd4*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x198ddd4*, lpNumberOfBytesWritten=0x2ae1fc*=0x90, lpOverlapped=0x0) returned 1 [0113.901] CloseHandle (hObject=0x154) returned 1 [0113.901] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png", lpFilePart=0x0) returned 0x80 [0113.901] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png.anonymous", lpFilePart=0x0) returned 0x8a [0113.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0113.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3cf00a0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe3f053e0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2d315b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1 [0113.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.901] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\icon_16.png.anonymous")) returned 1 [0113.902] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html", lpFilePart=0x0) returned 0x7e [0113.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae180) returned 1 [0113.902] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.903] GetFileType (hFile=0x154) returned 0x1 [0113.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae17c) returned 1 [0113.903] GetFileType (hFile=0x154) returned 0x1 [0113.903] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x5c [0113.903] ReadFile (in: hFile=0x154, lpBuffer=0x198f33c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x198f33c*, lpNumberOfBytesRead=0x2ae234*=0x5c, lpOverlapped=0x0) returned 1 [0113.904] CloseHandle (hObject=0x154) returned 1 [0113.915] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html", lpFilePart=0x0) returned 0x7e [0113.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0113.915] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.916] GetFileType (hFile=0x154) returned 0x1 [0113.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0113.917] GetFileType (hFile=0x154) returned 0x1 [0113.917] WriteFile (in: hFile=0x154, lpBuffer=0x19dd5fc*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x19dd5fc*, lpNumberOfBytesWritten=0x2ae1fc*=0x60, lpOverlapped=0x0) returned 1 [0113.918] CloseHandle (hObject=0x154) returned 1 [0113.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html", lpFilePart=0x0) returned 0x7e [0113.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html.anonymous", lpFilePart=0x0) returned 0x88 [0113.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0113.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3d3c360, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe3d895c0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2d7d870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0113.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.918] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\main.html.anonymous")) returned 1 [0113.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0113.921] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX", lpFilePart=0x0) returned 0x7d [0113.921] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\", lpFilePart=0x0) returned 0x7e [0113.921] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf1d8 [0113.922] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.923] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0113.923] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0113.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0113.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0113.923] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX", lpFilePart=0x0) returned 0x7d [0113.923] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\", lpFilePart=0x0) returned 0x7e [0113.923] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.0.0.6_0\\__MACOSX\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf1d8 [0113.923] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0113.923] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0113.924] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0113.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0113.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0113.924] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", lpFilePart=0x0) returned 0x70 [0113.924] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", lpFilePart=0x0) returned 0x71 [0113.924] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf1d8 [0113.942] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.942] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.943] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.943] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.943] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.943] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.943] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.943] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.944] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0113.944] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0113.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0113.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0113.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0113.945] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", lpFilePart=0x0) returned 0x70 [0113.945] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", lpFilePart=0x0) returned 0x71 [0113.945] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf1d8 [0113.947] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.947] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.947] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.948] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.948] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.948] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.948] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.948] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0113.949] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0113.949] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0113.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0113.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0113.950] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x7d [0113.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae180) returned 1 [0113.950] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.952] GetFileType (hFile=0x154) returned 0x1 [0113.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae17c) returned 1 [0113.953] GetFileType (hFile=0x154) returned 0x1 [0113.953] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0xc8d [0113.953] ReadFile (in: hFile=0x154, lpBuffer=0x19e5980, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x19e5980*, lpNumberOfBytesRead=0x2ae234*=0xc8d, lpOverlapped=0x0) returned 1 [0113.980] CloseHandle (hObject=0x154) returned 1 [0113.992] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x7d [0113.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0113.992] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.993] GetFileType (hFile=0x154) returned 0x1 [0113.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0113.993] GetFileType (hFile=0x154) returned 0x1 [0113.993] WriteFile (in: hFile=0x154, lpBuffer=0x1a377d4*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1a377d4*, lpNumberOfBytesWritten=0x2ae1fc*=0xc90, lpOverlapped=0x0) returned 1 [0113.994] CloseHandle (hObject=0x154) returned 1 [0113.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x7d [0113.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.anonymous", lpFilePart=0x0) returned 0x87 [0113.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0113.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe644d300, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe65e7580, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2e15df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc90)) returned 1 [0113.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0113.995] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.anonymous")) returned 1 [0113.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x7c [0113.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae180) returned 1 [0113.996] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0113.996] GetFileType (hFile=0x154) returned 0x1 [0113.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae17c) returned 1 [0113.996] GetFileType (hFile=0x154) returned 0x1 [0113.996] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x8f [0113.996] ReadFile (in: hFile=0x154, lpBuffer=0x1a38d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x1a38d58*, lpNumberOfBytesRead=0x2ae234*=0x8f, lpOverlapped=0x0) returned 1 [0113.998] CloseHandle (hObject=0x154) returned 1 [0114.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x7c [0114.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0114.010] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.011] GetFileType (hFile=0x154) returned 0x1 [0114.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0114.011] GetFileType (hFile=0x154) returned 0x1 [0114.011] WriteFile (in: hFile=0x154, lpBuffer=0x1a86f1c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1a86f1c*, lpNumberOfBytesWritten=0x2ae1fc*=0x90, lpOverlapped=0x0) returned 1 [0114.012] CloseHandle (hObject=0x154) returned 1 [0114.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x7c [0114.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.anonymous", lpFilePart=0x0) returned 0x86 [0114.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0114.012] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe6454830, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe65e7580, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2e620b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1 [0114.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.013] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.anonymous")) returned 1 [0114.013] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFilePart=0x0) returned 0x7a [0114.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae180) returned 1 [0114.013] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.013] GetFileType (hFile=0x154) returned 0x1 [0114.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae17c) returned 1 [0114.013] GetFileType (hFile=0x154) returned 0x1 [0114.013] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x5c [0114.013] ReadFile (in: hFile=0x154, lpBuffer=0x1a88464, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x1a88464*, lpNumberOfBytesRead=0x2ae234*=0x5c, lpOverlapped=0x0) returned 1 [0114.014] CloseHandle (hObject=0x154) returned 1 [0114.026] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFilePart=0x0) returned 0x7a [0114.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0114.026] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.028] GetFileType (hFile=0x154) returned 0x1 [0114.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0114.028] GetFileType (hFile=0x154) returned 0x1 [0114.028] WriteFile (in: hFile=0x154, lpBuffer=0x1ad65c0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1ad65c0*, lpNumberOfBytesWritten=0x2ae1fc*=0x60, lpOverlapped=0x0) returned 1 [0114.029] CloseHandle (hObject=0x154) returned 1 [0114.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFilePart=0x0) returned 0x7a [0114.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.anonymous", lpFilePart=0x0) returned 0x84 [0114.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0114.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe6459650, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe645bd60, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2e88210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0114.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.029] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.anonymous")) returned 1 [0114.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpFilePart=0x0) returned 0x79 [0114.030] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x7a [0114.030] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf2d8 [0114.031] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.032] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.033] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.034] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.035] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.036] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.036] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.036] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.036] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.036] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.037] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpFilePart=0x0) returned 0x79 [0114.037] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x7a [0114.037] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf2d8 [0114.038] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.038] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.038] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.038] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.039] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.040] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.041] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.042] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.042] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.042] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.042] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.042] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.042] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.043] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x7c [0114.043] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7d [0114.043] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.045] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.045] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.045] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.045] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.045] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x7c [0114.045] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7d [0114.045] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.046] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.046] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.046] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.046] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.046] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x7c [0114.046] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7d [0114.046] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.046] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.046] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.046] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.046] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.047] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x7c [0114.047] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7d [0114.047] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.047] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.047] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.047] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.047] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.047] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x7c [0114.047] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7d [0114.047] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.048] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.048] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.048] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.048] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x7c [0114.048] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7d [0114.048] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.048] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.048] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.048] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.048] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.049] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x7c [0114.049] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7d [0114.049] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.049] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.049] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.049] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.049] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.049] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x7c [0114.049] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7d [0114.049] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.049] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.049] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.049] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.050] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.050] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x7c [0114.050] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7d [0114.050] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.050] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.050] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.050] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.051] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.051] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x7c [0114.051] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7d [0114.051] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.051] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.051] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.051] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.051] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.051] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x7c [0114.051] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7d [0114.051] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.051] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.051] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.051] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.052] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.052] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x7c [0114.052] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7d [0114.052] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.052] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.052] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.052] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.052] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.052] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x7c [0114.052] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7d [0114.052] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.055] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.055] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.055] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.055] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.055] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x7c [0114.055] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7d [0114.055] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.055] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.055] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.056] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.056] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.056] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x7f [0114.056] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x80 [0114.056] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.056] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.056] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.056] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.056] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.056] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x7f [0114.056] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x80 [0114.056] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.056] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.057] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.057] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.057] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.057] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x7f [0114.057] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x80 [0114.057] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.058] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.058] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.058] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.058] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.058] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x7f [0114.058] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x80 [0114.058] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.058] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.058] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.058] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.058] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.058] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x7c [0114.058] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7d [0114.058] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.059] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.059] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.059] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.059] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.059] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x7c [0114.059] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7d [0114.059] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.059] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.059] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.059] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.059] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.059] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x80 [0114.059] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x81 [0114.059] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.060] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.060] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.060] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.060] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.060] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x80 [0114.060] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x81 [0114.060] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.061] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.061] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.061] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.061] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.061] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x7c [0114.061] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x7d [0114.061] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.061] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.061] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.061] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.061] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.061] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x7c [0114.061] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x7d [0114.061] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.062] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.062] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.062] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.062] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.062] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x7c [0114.062] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x7d [0114.062] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.063] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.063] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.063] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.063] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.063] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x7c [0114.063] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x7d [0114.063] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.063] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.063] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.063] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.063] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.064] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x7d [0114.064] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x7e [0114.064] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.064] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.064] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.064] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.064] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.064] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x7d [0114.064] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x7e [0114.064] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.064] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.064] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.064] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.064] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.065] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x7c [0114.065] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x7d [0114.065] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.065] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.065] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.065] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.066] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.066] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x7c [0114.066] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x7d [0114.066] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.066] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.066] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.066] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.066] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.066] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x7c [0114.066] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x7d [0114.066] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.066] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.066] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.066] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.067] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x7c [0114.067] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x7d [0114.067] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.067] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.067] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.067] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.067] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x7c [0114.067] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x7d [0114.067] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.068] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.068] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.068] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.068] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.068] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x7c [0114.068] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x7d [0114.068] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.068] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.068] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.068] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.068] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.069] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x7c [0114.069] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x7d [0114.069] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.069] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.069] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.069] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.069] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.069] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x7c [0114.069] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x7d [0114.069] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.069] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.069] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.069] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.069] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.070] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x7c [0114.070] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x7d [0114.070] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.070] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.070] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.070] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.070] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x7c [0114.071] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x7d [0114.071] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.071] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.071] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.071] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.071] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x7c [0114.071] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x7d [0114.071] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.071] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.071] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.071] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.072] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.072] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x7c [0114.072] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x7d [0114.072] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.072] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.072] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.072] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.072] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.072] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x7c [0114.072] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x7d [0114.072] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.073] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.073] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.073] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.073] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.073] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x7c [0114.073] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x7d [0114.073] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.074] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.074] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.074] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.074] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.074] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x7c [0114.074] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x7d [0114.074] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.074] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.074] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.074] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.074] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.074] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x7c [0114.074] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x7d [0114.074] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.075] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.075] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.075] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.075] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.075] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x7c [0114.075] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x7d [0114.075] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.076] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.076] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.076] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.076] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.076] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x7c [0114.076] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x7d [0114.076] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.076] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.076] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.076] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.076] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.076] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x7c [0114.076] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x7d [0114.076] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.077] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.077] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.077] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x7c [0114.077] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x7d [0114.077] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.077] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.077] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x7c [0114.077] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x7d [0114.077] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.078] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.078] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x7c [0114.078] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x7d [0114.078] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.078] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.078] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x7c [0114.078] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x7d [0114.079] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.079] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.079] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x7c [0114.079] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x7d [0114.079] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.079] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.079] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x7c [0114.079] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x7d [0114.079] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.080] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.080] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x7c [0114.080] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x7d [0114.080] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.080] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.080] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x7c [0114.080] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x7d [0114.080] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.081] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.081] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x7c [0114.081] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x7d [0114.081] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.081] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.081] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x7f [0114.081] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x80 [0114.081] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.082] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.082] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x7f [0114.082] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x80 [0114.082] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.082] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.082] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x7f [0114.082] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x80 [0114.082] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.083] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x7f [0114.083] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x80 [0114.083] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.083] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x7c [0114.083] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x7d [0114.083] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.084] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x7c [0114.084] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x7d [0114.084] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.084] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru", lpFilePart=0x0) returned 0x7c [0114.085] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x7d [0114.085] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.085] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru", lpFilePart=0x0) returned 0x7c [0114.085] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x7d [0114.085] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.085] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk", lpFilePart=0x0) returned 0x7c [0114.085] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x7d [0114.086] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.086] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.086] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk", lpFilePart=0x0) returned 0x7c [0114.086] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x7d [0114.087] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.087] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl", lpFilePart=0x0) returned 0x7c [0114.087] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x7d [0114.087] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.087] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl", lpFilePart=0x0) returned 0x7c [0114.087] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x7d [0114.087] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.087] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.088] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x7c [0114.088] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x7d [0114.088] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.088] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.088] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x7c [0114.088] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x7d [0114.088] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.089] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x7c [0114.089] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x7d [0114.089] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.089] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x7c [0114.089] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x7d [0114.089] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.089] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x7c [0114.089] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x7d [0114.089] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.090] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.093] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x7c [0114.093] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x7d [0114.093] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.093] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.093] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x7c [0114.093] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x7d [0114.093] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.094] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x7c [0114.094] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x7d [0114.094] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.094] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x7c [0114.094] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x7d [0114.094] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.095] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.095] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x7c [0114.095] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x7d [0114.095] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.095] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.095] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", lpFilePart=0x0) returned 0x7c [0114.095] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x7d [0114.095] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.095] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.095] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", lpFilePart=0x0) returned 0x7c [0114.095] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x7d [0114.095] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.096] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.096] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x7f [0114.096] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x80 [0114.096] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.096] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.096] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x7f [0114.096] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x80 [0114.096] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.097] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.097] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x7f [0114.097] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x80 [0114.097] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.097] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.097] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x7f [0114.097] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x80 [0114.097] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf2d8 [0114.097] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.097] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", lpFilePart=0x0) returned 0x7a [0114.097] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", lpFilePart=0x0) returned 0x7b [0114.097] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf2d8 [0114.098] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.098] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", lpFilePart=0x0) returned 0x7a [0114.098] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", lpFilePart=0x0) returned 0x7b [0114.098] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf2d8 [0114.098] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.098] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpFilePart=0x0) returned 0x6a [0114.098] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpFilePart=0x0) returned 0x6b [0114.098] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf2d8 [0114.099] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.099] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpFilePart=0x0) returned 0x6a [0114.099] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpFilePart=0x0) returned 0x6b [0114.099] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf2d8 [0114.099] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.099] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpFilePart=0x0) returned 0x71 [0114.099] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpFilePart=0x0) returned 0x72 [0114.099] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf2d8 [0114.110] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.111] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpFilePart=0x0) returned 0x71 [0114.111] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpFilePart=0x0) returned 0x72 [0114.112] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf2d8 [0114.113] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0114.113] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x79 [0114.114] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.115] GetFileType (hFile=0x154) returned 0x1 [0114.115] GetFileType (hFile=0x154) returned 0x1 [0114.115] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x1a33 [0114.128] CloseHandle (hObject=0x154) returned 1 [0114.165] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x79 [0114.165] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.167] GetFileType (hFile=0x154) returned 0x1 [0114.167] GetFileType (hFile=0x154) returned 0x1 [0114.167] WriteFile (in: hFile=0x154, lpBuffer=0x19aaf88*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x19aaf88*, lpNumberOfBytesWritten=0x2ae228*=0x1a40, lpOverlapped=0x0) returned 1 [0114.169] CloseHandle (hObject=0x154) returned 1 [0114.169] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x79 [0114.169] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.anonymous", lpFilePart=0x0) returned 0x83 [0114.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe6c6ad30, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe6fde9d0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe2fdee70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a40)) returned 1 [0114.169] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.anonymous")) returned 1 [0114.170] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpFilePart=0x0) returned 0x7a [0114.170] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpFilePart=0x0) returned 0x7b [0114.170] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbefd8 [0114.186] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.187] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpFilePart=0x0) returned 0x7a [0114.187] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpFilePart=0x0) returned 0x7b [0114.187] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbefd8 [0114.188] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0114.189] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7e [0114.189] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.191] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0114.191] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7e [0114.191] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.191] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0114.191] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7e [0114.191] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.191] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0114.191] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7e [0114.191] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.192] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x7d [0114.192] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7e [0114.192] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.193] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x7d [0114.193] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7e [0114.193] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.193] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x7d [0114.193] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7e [0114.193] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.193] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.194] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x7d [0114.194] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7e [0114.194] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.194] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.194] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpFilePart=0x0) returned 0x7d [0114.194] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7e [0114.194] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.195] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.195] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpFilePart=0x0) returned 0x7d [0114.195] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7e [0114.195] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.195] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.195] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpFilePart=0x0) returned 0x7d [0114.195] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7e [0114.195] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.195] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.195] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpFilePart=0x0) returned 0x7d [0114.196] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7e [0114.196] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.196] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.196] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpFilePart=0x0) returned 0x7d [0114.196] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7e [0114.196] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.197] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpFilePart=0x0) returned 0x7d [0114.197] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7e [0114.197] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.197] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x80 [0114.197] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x81 [0114.197] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.197] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.197] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.197] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.198] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.198] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.198] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.198] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.198] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.199] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.199] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.199] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.199] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.259] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.259] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.259] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.259] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.259] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.259] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.259] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.259] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.260] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.260] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.261] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.261] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.261] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.261] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.261] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.261] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.262] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.262] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.262] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.262] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.262] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.262] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.263] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.263] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.264] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.264] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.265] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.265] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.265] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.265] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.265] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.265] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.266] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.266] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.267] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.267] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.267] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.267] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.267] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.268] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.276] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.276] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.276] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.276] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.277] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.277] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.277] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.277] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.278] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.278] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.278] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.279] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.279] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.279] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.279] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.279] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.280] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.280] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.280] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.281] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.281] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.281] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.281] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.281] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.282] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.282] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.283] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.283] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.283] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.283] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.283] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.284] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.284] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.284] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.285] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.285] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.285] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.285] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.286] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.286] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.287] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.287] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.287] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.288] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.288] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.288] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.288] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.288] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.289] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.289] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.289] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.290] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.290] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.290] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.290] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.290] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.291] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.291] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.292] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.292] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.292] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.292] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.292] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.293] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.293] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.294] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.294] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.294] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.294] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.294] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.295] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.295] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.295] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.296] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.296] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.296] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.296] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.296] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.297] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.297] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.298] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.298] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.298] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.298] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.298] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.298] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.299] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.299] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.300] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.300] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.300] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.300] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.300] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.301] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.301] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.301] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbefd8 [0114.302] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.302] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbefd8 [0114.302] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.302] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbefd8 [0114.303] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.306] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbefd8 [0114.306] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.306] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.306] GetFileType (hFile=0x154) returned 0x1 [0114.306] GetFileType (hFile=0x154) returned 0x1 [0114.306] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x1d7b [0114.307] ReadFile (in: hFile=0x154, lpBuffer=0x1a2ca04, nNumberOfBytesToRead=0x1d7b, lpNumberOfBytesRead=0x2ae234, lpOverlapped=0x0 | out: lpBuffer=0x1a2ca04*, lpNumberOfBytesRead=0x2ae234*=0x1d7b, lpOverlapped=0x0) returned 1 [0114.310] CloseHandle (hObject=0x154) returned 1 [0114.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae16c) returned 1 [0114.323] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.325] GetFileType (hFile=0x154) returned 0x1 [0114.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae168) returned 1 [0114.325] GetFileType (hFile=0x154) returned 0x1 [0114.325] WriteFile (in: hFile=0x154, lpBuffer=0x1a82ccc*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x1a82ccc*, lpNumberOfBytesWritten=0x2ae228*=0x1d80, lpOverlapped=0x0) returned 1 [0114.326] CloseHandle (hObject=0x154) returned 1 [0114.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae20c) returned 1 [0114.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3cc9f40, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4ce01e0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe315bc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d80)) returned 1 [0114.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.326] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\128.png.anonymous")) returned 1 [0114.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.327] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.348] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.349] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.350] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.351] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.352] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.353] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.354] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.354] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.354] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.354] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.354] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.356] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.357] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.357] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.357] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.357] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.357] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.358] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.359] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.360] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.361] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.362] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.362] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.362] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.362] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.362] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.362] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.362] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.364] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.374] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.374] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.374] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.374] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.375] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.375] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.375] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.375] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.375] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.375] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.376] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.376] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.376] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.377] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.377] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.377] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.377] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.377] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.377] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.378] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.378] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.379] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.379] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.379] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.379] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.379] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.379] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.380] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.380] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.380] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.381] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.381] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.381] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.381] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.382] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.382] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.382] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.382] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.382] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.382] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.383] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.383] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.383] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.383] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.384] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.384] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.384] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.384] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.384] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.384] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.385] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.385] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.385] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.385] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.385] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.386] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.386] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.386] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.386] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.386] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.387] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.387] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.387] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.387] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.387] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.387] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.387] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.387] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.387] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.388] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.388] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.388] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.388] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.389] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.389] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.389] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.389] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.389] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.389] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.389] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.390] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.390] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.390] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.390] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.390] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.390] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.391] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.391] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.391] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.391] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.392] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.392] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.392] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.392] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.392] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.392] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.392] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.392] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.392] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.392] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.393] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.393] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.393] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.393] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.393] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.394] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.394] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.394] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.394] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.394] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.395] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.395] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.395] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.395] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.395] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.395] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.395] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.395] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.395] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.396] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\eu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.396] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.396] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.397] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.397] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.397] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\eu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.397] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.397] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.397] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.397] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.397] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.398] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.398] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.398] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.398] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.398] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.398] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.399] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.399] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.399] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.399] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.400] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.400] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.400] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.400] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.400] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.400] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.400] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.400] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.400] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.401] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.401] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.402] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.402] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.402] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.402] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.402] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.402] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.402] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.402] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.402] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.403] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.403] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.403] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.403] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.404] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.404] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.404] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.404] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.404] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.404] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.405] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.405] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.405] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.405] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.405] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.406] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.406] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.406] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.406] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.406] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.408] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.408] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.408] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.408] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.408] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.408] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.408] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.408] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.408] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.409] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.409] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.409] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.410] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.410] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.410] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.410] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.410] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.410] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.410] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.410] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.411] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.411] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.411] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.411] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.412] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.412] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.412] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.412] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.412] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.412] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.413] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.413] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.413] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.413] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.413] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.414] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.414] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.414] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.414] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.414] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.415] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.415] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.415] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.415] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.415] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.415] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.415] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.415] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.415] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.416] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.417] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.417] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.417] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.417] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.417] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.417] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.417] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.417] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.417] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.417] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.419] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.419] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.419] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.420] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.420] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.420] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.420] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.420] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.420] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.420] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.421] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.421] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.421] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.421] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.422] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.422] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.422] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.422] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.422] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.422] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.423] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.423] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.423] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.423] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.424] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.424] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.424] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.425] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.425] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\6.2_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.426] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.445] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.445] GetFileType (hFile=0x154) returned 0x1 [0114.445] GetFileType (hFile=0x154) returned 0x1 [0114.446] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0xd97 [0114.458] CloseHandle (hObject=0x154) returned 1 [0114.474] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.475] GetFileType (hFile=0x154) returned 0x1 [0114.475] GetFileType (hFile=0x154) returned 0x1 [0114.476] CloseHandle (hObject=0x154) returned 1 [0114.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3cc9f40, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe508f7a0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe32b2890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xda0)) returned 1 [0114.477] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0\\128.png.anonymous")) returned 1 [0114.567] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.569] GetFileType (hFile=0x154) returned 0x1 [0114.569] GetFileType (hFile=0x154) returned 0x1 [0114.569] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0xd4e [0114.578] CloseHandle (hObject=0x154) returned 1 [0114.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFilePart=0x0) returned 0x7a [0114.594] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.595] GetFileType (hFile=0x154) returned 0x1 [0114.595] GetFileType (hFile=0x154) returned 0x1 [0114.595] WriteFile (in: hFile=0x154, lpBuffer=0x1a83c6c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2ae1fc, lpOverlapped=0x0 | out: lpBuffer=0x1a83c6c*, lpNumberOfBytesWritten=0x2ae1fc*=0xd50, lpOverlapped=0x0) returned 1 [0114.596] CloseHandle (hObject=0x154) returned 1 [0114.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFilePart=0x0) returned 0x7a [0114.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.anonymous", lpFilePart=0x0) returned 0x84 [0114.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7b998b0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe8527d50, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe33e3390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd50)) returned 1 [0114.596] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.anonymous")) returned 1 [0114.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", lpFilePart=0x0) returned 0x7b [0114.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", lpFilePart=0x0) returned 0x7c [0114.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.612] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.612] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.612] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.612] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.612] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.612] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.613] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.614] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.615] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.616] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.616] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.616] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.616] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.616] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.616] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.616] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.617] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", lpFilePart=0x0) returned 0x7b [0114.617] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", lpFilePart=0x0) returned 0x7c [0114.617] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.618] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.618] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.619] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.620] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.621] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.622] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.622] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.623] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", lpFilePart=0x0) returned 0x7e [0114.623] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7f [0114.623] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.625] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.625] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.625] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.625] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.625] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", lpFilePart=0x0) returned 0x7e [0114.625] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7f [0114.625] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.625] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.625] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.625] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.626] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", lpFilePart=0x0) returned 0x7e [0114.626] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7f [0114.626] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.627] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.627] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.627] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.627] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", lpFilePart=0x0) returned 0x7e [0114.627] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7f [0114.627] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.627] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.627] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.628] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.628] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", lpFilePart=0x0) returned 0x7e [0114.628] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7f [0114.628] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.628] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.628] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.628] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.628] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.629] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", lpFilePart=0x0) returned 0x7e [0114.629] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7f [0114.629] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.629] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.629] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.629] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.629] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.629] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", lpFilePart=0x0) returned 0x7e [0114.629] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7f [0114.629] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.630] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.630] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.630] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.630] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.631] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", lpFilePart=0x0) returned 0x7e [0114.631] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7f [0114.631] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.631] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.631] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.631] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.631] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.631] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", lpFilePart=0x0) returned 0x7e [0114.631] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7f [0114.631] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.632] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.632] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.632] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.632] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.632] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", lpFilePart=0x0) returned 0x7e [0114.632] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7f [0114.632] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.632] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.633] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.633] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.633] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.633] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", lpFilePart=0x0) returned 0x7e [0114.633] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7f [0114.633] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.634] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.634] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.634] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.634] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.634] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", lpFilePart=0x0) returned 0x7e [0114.634] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7f [0114.634] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.634] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.634] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.634] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.635] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.635] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", lpFilePart=0x0) returned 0x7e [0114.635] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7f [0114.635] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.635] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.635] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.635] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.635] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.635] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", lpFilePart=0x0) returned 0x7e [0114.635] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7f [0114.635] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.636] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.636] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.636] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.636] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.636] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", lpFilePart=0x0) returned 0x7e [0114.636] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", lpFilePart=0x0) returned 0x7f [0114.636] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.637] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.637] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.637] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.637] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.637] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", lpFilePart=0x0) returned 0x7e [0114.637] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", lpFilePart=0x0) returned 0x7f [0114.637] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.637] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.637] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.637] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.637] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.638] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", lpFilePart=0x0) returned 0x7e [0114.638] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7f [0114.638] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.638] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.638] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.638] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.638] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.639] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", lpFilePart=0x0) returned 0x7e [0114.639] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7f [0114.639] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.639] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.639] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.639] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.639] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.639] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", lpFilePart=0x0) returned 0x7e [0114.639] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x7f [0114.639] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.639] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.639] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.639] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.640] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.640] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", lpFilePart=0x0) returned 0x7e [0114.640] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x7f [0114.640] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.640] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.640] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.640] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.640] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.640] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", lpFilePart=0x0) returned 0x7f [0114.640] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x80 [0114.640] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.641] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.641] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.641] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.641] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.641] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", lpFilePart=0x0) returned 0x7f [0114.641] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x80 [0114.641] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.641] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.641] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.641] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.641] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.642] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", lpFilePart=0x0) returned 0x7e [0114.642] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x7f [0114.642] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.642] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.642] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.642] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.642] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.642] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", lpFilePart=0x0) returned 0x7e [0114.642] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x7f [0114.642] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.642] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.642] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.642] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.643] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.643] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", lpFilePart=0x0) returned 0x7e [0114.643] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", lpFilePart=0x0) returned 0x7f [0114.643] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.643] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.643] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.643] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.644] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", lpFilePart=0x0) returned 0x7e [0114.644] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", lpFilePart=0x0) returned 0x7f [0114.644] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.644] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.644] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.644] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.644] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", lpFilePart=0x0) returned 0x7e [0114.644] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x7f [0114.644] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.644] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.644] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.644] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.645] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.645] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", lpFilePart=0x0) returned 0x7e [0114.645] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x7f [0114.645] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.645] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.645] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.645] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.645] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.645] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", lpFilePart=0x0) returned 0x7e [0114.645] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x7f [0114.645] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.646] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.646] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.646] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.646] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.646] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", lpFilePart=0x0) returned 0x7e [0114.646] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x7f [0114.646] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.646] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.646] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.646] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.646] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", lpFilePart=0x0) returned 0x7e [0114.647] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x7f [0114.647] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.647] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.647] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.647] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.647] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", lpFilePart=0x0) returned 0x7e [0114.647] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x7f [0114.647] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.648] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.648] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.648] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.648] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.648] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", lpFilePart=0x0) returned 0x7e [0114.648] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", lpFilePart=0x0) returned 0x7f [0114.648] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.650] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.650] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.650] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.650] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.650] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", lpFilePart=0x0) returned 0x7e [0114.650] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", lpFilePart=0x0) returned 0x7f [0114.650] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.651] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.651] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.651] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.651] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.651] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", lpFilePart=0x0) returned 0x7e [0114.651] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", lpFilePart=0x0) returned 0x7f [0114.651] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.651] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.651] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.651] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.651] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.651] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", lpFilePart=0x0) returned 0x7e [0114.651] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", lpFilePart=0x0) returned 0x7f [0114.652] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.652] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.652] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.652] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.652] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.652] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", lpFilePart=0x0) returned 0x7e [0114.652] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x7f [0114.652] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.653] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.653] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.653] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.653] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.653] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", lpFilePart=0x0) returned 0x7e [0114.653] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x7f [0114.653] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.653] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.653] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.653] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.653] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.653] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", lpFilePart=0x0) returned 0x7e [0114.653] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x7f [0114.654] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.654] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.654] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.654] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.654] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.654] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", lpFilePart=0x0) returned 0x7e [0114.654] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x7f [0114.654] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.654] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.654] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.654] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.654] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.655] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", lpFilePart=0x0) returned 0x7e [0114.655] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x7f [0114.655] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.655] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.655] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.655] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.655] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.656] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", lpFilePart=0x0) returned 0x7e [0114.656] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x7f [0114.656] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.656] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.656] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", lpFilePart=0x0) returned 0x7e [0114.656] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x7f [0114.656] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.656] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.656] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.657] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", lpFilePart=0x0) returned 0x7e [0114.657] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x7f [0114.657] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.657] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.657] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.657] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.657] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.657] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", lpFilePart=0x0) returned 0x7e [0114.657] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x7f [0114.657] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.658] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.658] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", lpFilePart=0x0) returned 0x7e [0114.658] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x7f [0114.658] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.658] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.658] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.659] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", lpFilePart=0x0) returned 0x7e [0114.659] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", lpFilePart=0x0) returned 0x7f [0114.659] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.659] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.659] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", lpFilePart=0x0) returned 0x7e [0114.659] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", lpFilePart=0x0) returned 0x7f [0114.659] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.659] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.659] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.660] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", lpFilePart=0x0) returned 0x7e [0114.660] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x7f [0114.660] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.660] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.660] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.661] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", lpFilePart=0x0) returned 0x7e [0114.661] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x7f [0114.661] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.661] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.661] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x81 [0114.661] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x82 [0114.661] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.661] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.662] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x81 [0114.662] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x82 [0114.662] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.662] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.662] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.662] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.662] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x81 [0114.662] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x82 [0114.662] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.663] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x81 [0114.663] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x82 [0114.663] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.663] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.664] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.664] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", lpFilePart=0x0) returned 0x7e [0114.664] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x7f [0114.664] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0114.664] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.664] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", lpFilePart=0x0) returned 0x7e [0114.664] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x7f [0114.664] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.664] FindNextFileW (in: hFindFile=0xbee18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0114.665] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.665] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", lpFilePart=0x0) returned 0x7e [0114.665] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x7f [0114.665] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.666] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.666] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", lpFilePart=0x0) returned 0x7e [0114.666] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x7f [0114.666] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.666] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.666] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", lpFilePart=0x0) returned 0x7e [0114.666] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x7f [0114.666] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.666] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.667] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", lpFilePart=0x0) returned 0x7e [0114.667] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x7f [0114.667] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.667] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.667] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", lpFilePart=0x0) returned 0x7e [0114.667] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x7f [0114.667] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.668] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.668] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", lpFilePart=0x0) returned 0x7e [0114.668] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x7f [0114.668] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.668] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.668] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x7e [0114.668] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x7f [0114.668] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.669] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.669] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x7e [0114.669] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x7f [0114.669] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.669] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.669] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x7e [0114.669] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x7f [0114.669] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.670] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.670] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x7e [0114.670] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x7f [0114.670] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.670] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.670] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x7e [0114.670] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", lpFilePart=0x0) returned 0x7f [0114.670] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.671] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.673] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x7e [0114.673] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", lpFilePart=0x0) returned 0x7f [0114.673] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.673] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.673] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x7e [0114.673] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x7f [0114.673] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.674] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.674] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x7e [0114.674] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x7f [0114.674] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.674] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.674] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x7e [0114.674] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x7f [0114.674] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.675] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.675] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x7e [0114.675] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x7f [0114.675] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.675] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.675] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x7e [0114.675] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x7f [0114.675] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.676] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x7e [0114.676] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x7f [0114.676] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.676] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x81 [0114.676] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x82 [0114.676] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.677] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.677] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x81 [0114.677] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x82 [0114.677] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.677] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.677] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x81 [0114.677] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x82 [0114.677] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.678] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0114.678] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x81 [0114.678] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x82 [0114.678] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.678] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0114.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.678] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", lpFilePart=0x0) returned 0x7c [0114.678] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", lpFilePart=0x0) returned 0x7d [0114.678] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.679] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.679] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", lpFilePart=0x0) returned 0x7c [0114.679] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", lpFilePart=0x0) returned 0x7d [0114.679] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.679] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0114.679] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x6a [0114.679] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x6b [0114.679] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee18 [0114.679] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0114.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0114.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0114.680] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x6a [0114.680] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x6b [0114.680] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee18 [0114.680] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.680] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x70 [0114.680] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", lpFilePart=0x0) returned 0x71 [0114.680] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee18 [0114.692] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.693] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x70 [0114.693] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", lpFilePart=0x0) returned 0x71 [0114.694] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee18 [0114.695] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x78 [0114.696] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.697] GetFileType (hFile=0x154) returned 0x1 [0114.697] GetFileType (hFile=0x154) returned 0x1 [0114.697] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x1378 [0114.709] CloseHandle (hObject=0x154) returned 1 [0114.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x78 [0114.722] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.723] GetFileType (hFile=0x154) returned 0x1 [0114.723] GetFileType (hFile=0x154) returned 0x1 [0114.723] WriteFile (in: hFile=0x154, lpBuffer=0x1b4e9e0*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x1b4e9e0*, lpNumberOfBytesWritten=0x2ae228*=0x1380, lpOverlapped=0x0) returned 1 [0114.724] CloseHandle (hObject=0x154) returned 1 [0114.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x78 [0114.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.anonymous", lpFilePart=0x0) returned 0x82 [0114.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe561c600, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe5c6f070, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3513e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1380)) returned 1 [0114.725] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.anonymous")) returned 1 [0114.725] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x79 [0114.725] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", lpFilePart=0x0) returned 0x7a [0114.725] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbefd8 [0114.734] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.735] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x79 [0114.735] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", lpFilePart=0x0) returned 0x7a [0114.735] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbefd8 [0114.737] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7c [0114.738] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", lpFilePart=0x0) returned 0x7d [0114.738] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.739] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.739] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7c [0114.739] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", lpFilePart=0x0) returned 0x7d [0114.739] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.739] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.739] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7c [0114.739] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", lpFilePart=0x0) returned 0x7d [0114.739] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.739] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.739] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7c [0114.739] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", lpFilePart=0x0) returned 0x7d [0114.740] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.740] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7c [0114.740] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7d [0114.740] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.740] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7c [0114.741] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7d [0114.741] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.741] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7c [0114.741] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", lpFilePart=0x0) returned 0x7d [0114.741] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.741] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7c [0114.741] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", lpFilePart=0x0) returned 0x7d [0114.741] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.741] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7c [0114.741] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7d [0114.742] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.742] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.742] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7c [0114.742] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7d [0114.742] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.742] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.742] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7c [0114.743] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x7d [0114.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.743] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7c [0114.743] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x7d [0114.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.743] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x7c [0114.743] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7d [0114.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.744] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x7c [0114.744] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7d [0114.744] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.744] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x7c [0114.744] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7d [0114.744] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.745] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x7c [0114.745] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7d [0114.745] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.745] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x7c [0114.745] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7d [0114.745] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.746] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.746] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x7c [0114.746] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7d [0114.746] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.746] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.746] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x7c [0114.746] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7d [0114.746] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.747] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.747] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x7c [0114.747] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7d [0114.747] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.747] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.747] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x7c [0114.747] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7d [0114.747] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.748] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.748] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x7c [0114.748] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7d [0114.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.748] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.748] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x7f [0114.748] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x80 [0114.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.748] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.748] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x7f [0114.748] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x80 [0114.749] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.749] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.749] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x7f [0114.749] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x80 [0114.749] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.749] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x7f [0114.750] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x80 [0114.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.750] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x7c [0114.750] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7d [0114.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.750] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x7c [0114.750] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7d [0114.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.750] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x80 [0114.750] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x81 [0114.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.751] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.751] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x80 [0114.751] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x81 [0114.751] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.751] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.751] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x7c [0114.751] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", lpFilePart=0x0) returned 0x7d [0114.752] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbefd8 [0114.752] FindClose (in: hFindFile=0xbefd8 | out: hFindFile=0xbefd8) returned 1 [0114.752] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x7c [0114.752] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", lpFilePart=0x0) returned 0x7d [0114.753] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.753] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.754] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x7c [0114.754] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x7d [0114.754] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.754] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.754] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.755] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.755] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.755] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.755] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.755] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.755] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.756] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.756] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.756] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.756] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.757] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.757] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.757] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.757] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.758] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.758] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.758] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.758] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.758] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.758] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.759] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.759] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.759] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.759] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.759] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.759] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.760] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.760] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.760] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.761] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.761] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.761] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.761] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.761] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.762] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.762] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.762] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.762] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.763] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.763] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.763] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.763] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.764] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.764] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.764] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.764] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.764] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.764] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.764] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.764] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.765] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.765] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.765] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.765] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.765] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.766] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.766] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.767] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.767] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.767] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.767] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.768] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.768] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.768] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.768] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.768] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.768] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.768] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.769] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.769] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.769] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.769] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.769] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.770] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.770] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.770] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.770] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.770] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.771] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.771] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.771] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.771] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.771] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.771] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.771] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.775] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.775] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.775] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.775] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.775] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.776] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.776] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.776] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.776] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.777] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.777] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.777] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.777] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.777] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.777] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.777] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.778] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.778] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.778] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.779] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.779] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.780] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.781] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.781] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.781] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.782] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.782] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.782] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.782] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.782] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.782] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.782] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.783] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.783] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.783] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.783] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.784] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.784] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.784] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.784] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.785] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.785] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.785] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.785] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.785] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.785] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.785] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.785] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.786] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.786] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.786] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.786] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.786] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.787] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.787] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.787] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.787] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.787] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.788] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.788] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.788] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.788] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.788] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.788] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.789] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.789] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.789] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.789] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.789] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.789] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.789] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.790] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.790] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.790] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.790] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.791] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.791] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.791] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.792] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.792] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.793] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.793] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.794] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.794] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.795] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.795] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.795] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.796] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.797] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.797] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.798] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.798] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.798] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.799] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.799] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.799] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.800] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.801] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.801] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.802] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.802] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.802] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.803] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.803] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.804] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.805] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.805] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.805] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.806] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.806] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.807] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.807] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.808] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.808] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbee18 [0114.809] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.809] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.810] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.810] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.811] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.811] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee18 [0114.812] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.813] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee18 [0114.813] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.813] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee18 [0114.829] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.830] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee18 [0114.832] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.833] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.837] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.838] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.838] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.838] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.838] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.838] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbee18 [0114.839] FindClose (in: hFindFile=0xbee18 | out: hFindFile=0xbee18) returned 1 [0114.839] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.839] GetFileType (hFile=0x154) returned 0x1 [0114.839] GetFileType (hFile=0x154) returned 0x1 [0114.839] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0x32a [0114.846] CloseHandle (hObject=0x154) returned 1 [0114.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0114.911] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.913] GetFileType (hFile=0x154) returned 0x1 [0114.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0114.913] GetFileType (hFile=0x154) returned 0x1 [0114.917] CloseHandle (hObject=0x154) returned 1 [0114.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0114.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4e5cfa0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4e5d770, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3703070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0114.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0114.917] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.anonymous")) returned 1 [0114.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.918] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbec58 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.954] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.954] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0114.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0114.955] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbec58 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0114.956] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0114.956] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0114.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0114.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0114.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0114.958] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0114.961] GetFileType (hFile=0x154) returned 0x1 [0114.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0114.961] GetFileType (hFile=0x154) returned 0x1 [0114.961] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0x112dc [0114.961] ReadFile (in: hFile=0x154, lpBuffer=0x1a74274, nNumberOfBytesToRead=0x112dc, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x1a74274*, lpNumberOfBytesRead=0x2ae1c0*=0x112dc, lpOverlapped=0x0) returned 1 [0114.983] CloseHandle (hObject=0x154) returned 1 [0115.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.051] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.055] GetFileType (hFile=0x154) returned 0x1 [0115.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.055] GetFileType (hFile=0x154) returned 0x1 [0115.055] WriteFile (in: hFile=0x154, lpBuffer=0x1af4910*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x2ae1b4, lpOverlapped=0x0 | out: lpBuffer=0x1af4910*, lpNumberOfBytesWritten=0x2ae1b4*=0x112e0, lpOverlapped=0x0) returned 1 [0115.058] CloseHandle (hObject=0x154) returned 1 [0115.058] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", lpFilePart=0x0) returned 0x87 [0115.058] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.anonymous", lpFilePart=0x0) returned 0x91 [0115.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4e5cfa0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4e5d770, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3859cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x112e0)) returned 1 [0115.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.059] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.anonymous")) returned 1 [0115.059] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x88 [0115.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.060] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.060] GetFileType (hFile=0x154) returned 0x1 [0115.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.060] GetFileType (hFile=0x154) returned 0x1 [0115.060] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0x1109 [0115.060] ReadFile (in: hFile=0x154, lpBuffer=0x1b062cc, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x1b062cc*, lpNumberOfBytesRead=0x2ae1c0*=0x1109, lpOverlapped=0x0) returned 1 [0115.071] CloseHandle (hObject=0x154) returned 1 [0115.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x88 [0115.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.089] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.091] GetFileType (hFile=0x154) returned 0x1 [0115.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.091] GetFileType (hFile=0x154) returned 0x1 [0115.091] WriteFile (in: hFile=0x154, lpBuffer=0x1b58608*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2ae1b4, lpOverlapped=0x0 | out: lpBuffer=0x1b58608*, lpNumberOfBytesWritten=0x2ae1b4*=0x1110, lpOverlapped=0x0) returned 1 [0115.093] CloseHandle (hObject=0x154) returned 1 [0115.093] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x88 [0115.093] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.anonymous", lpFilePart=0x0) returned 0x92 [0115.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4e5cfa0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe54145b0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe38a5f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1110)) returned 1 [0115.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.093] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.anonymous")) returned 1 [0115.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x87 [0115.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.094] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.094] GetFileType (hFile=0x154) returned 0x1 [0115.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.094] GetFileType (hFile=0x154) returned 0x1 [0115.095] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0x22c [0115.095] ReadFile (in: hFile=0x154, lpBuffer=0x1b5a038, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x1b5a038*, lpNumberOfBytesRead=0x2ae1c0*=0x22c, lpOverlapped=0x0) returned 1 [0115.096] CloseHandle (hObject=0x154) returned 1 [0115.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x87 [0115.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.148] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.150] GetFileType (hFile=0x154) returned 0x1 [0115.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.150] GetFileType (hFile=0x154) returned 0x1 [0115.150] WriteFile (in: hFile=0x154, lpBuffer=0x19a4dfc*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae188, lpOverlapped=0x0 | out: lpBuffer=0x19a4dfc*, lpNumberOfBytesWritten=0x2ae188*=0x230, lpOverlapped=0x0) returned 1 [0115.152] CloseHandle (hObject=0x154) returned 1 [0115.152] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x87 [0115.152] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.anonymous", lpFilePart=0x0) returned 0x91 [0115.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4e5cfa0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe54145b0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe393e510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0115.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.152] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.anonymous")) returned 1 [0115.153] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0x96 [0115.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.153] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.154] GetFileType (hFile=0x154) returned 0x1 [0115.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.154] GetFileType (hFile=0x154) returned 0x1 [0115.154] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0xa0 [0115.154] ReadFile (in: hFile=0x154, lpBuffer=0x19a6420, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x19a6420*, lpNumberOfBytesRead=0x2ae1c0*=0xa0, lpOverlapped=0x0) returned 1 [0115.156] CloseHandle (hObject=0x154) returned 1 [0115.171] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0x96 [0115.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.172] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.173] GetFileType (hFile=0x154) returned 0x1 [0115.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.173] GetFileType (hFile=0x154) returned 0x1 [0115.173] WriteFile (in: hFile=0x154, lpBuffer=0x19f47e0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae188, lpOverlapped=0x0 | out: lpBuffer=0x19f47e0*, lpNumberOfBytesWritten=0x2ae188*=0xb0, lpOverlapped=0x0) returned 1 [0115.174] CloseHandle (hObject=0x154) returned 1 [0115.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0x96 [0115.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.anonymous", lpFilePart=0x0) returned 0xa0 [0115.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4e83100, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4e84870, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3964670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0115.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.174] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.anonymous")) returned 1 [0115.175] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0x9c [0115.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.175] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.175] GetFileType (hFile=0x154) returned 0x1 [0115.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.175] GetFileType (hFile=0x154) returned 0x1 [0115.176] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0xfc [0115.176] ReadFile (in: hFile=0x154, lpBuffer=0x19f5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x19f5ed8*, lpNumberOfBytesRead=0x2ae1c0*=0xfc, lpOverlapped=0x0) returned 1 [0115.177] CloseHandle (hObject=0x154) returned 1 [0115.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0x9c [0115.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.192] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.193] GetFileType (hFile=0x154) returned 0x1 [0115.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.194] GetFileType (hFile=0x154) returned 0x1 [0115.194] WriteFile (in: hFile=0x154, lpBuffer=0x1a441e8*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ae188, lpOverlapped=0x0 | out: lpBuffer=0x1a441e8*, lpNumberOfBytesWritten=0x2ae188*=0x100, lpOverlapped=0x0) returned 1 [0115.195] CloseHandle (hObject=0x154) returned 1 [0115.195] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0x9c [0115.195] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.anonymous", lpFilePart=0x0) returned 0xa6 [0115.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4e83100, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4f2a8b0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe398a7d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0115.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.195] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.anonymous")) returned 1 [0115.196] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0x9c [0115.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.196] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.198] GetFileType (hFile=0x154) returned 0x1 [0115.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.198] GetFileType (hFile=0x154) returned 0x1 [0115.198] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0xa0 [0115.198] ReadFile (in: hFile=0x154, lpBuffer=0x1a458a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x1a458a8*, lpNumberOfBytesRead=0x2ae1c0*=0xa0, lpOverlapped=0x0) returned 1 [0115.199] CloseHandle (hObject=0x154) returned 1 [0115.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0x9c [0115.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.212] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.213] GetFileType (hFile=0x154) returned 0x1 [0115.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.213] GetFileType (hFile=0x154) returned 0x1 [0115.213] WriteFile (in: hFile=0x154, lpBuffer=0x1a93b24*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae188, lpOverlapped=0x0 | out: lpBuffer=0x1a93b24*, lpNumberOfBytesWritten=0x2ae188*=0xb0, lpOverlapped=0x0) returned 1 [0115.214] CloseHandle (hObject=0x154) returned 1 [0115.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0x9c [0115.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.anonymous", lpFilePart=0x0) returned 0xa6 [0115.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4f2fea0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4f31de0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe39d6a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0115.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.215] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.anonymous")) returned 1 [0115.215] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0x9f [0115.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.215] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.216] GetFileType (hFile=0x154) returned 0x1 [0115.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.216] GetFileType (hFile=0x154) returned 0x1 [0115.216] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0xa6 [0115.216] ReadFile (in: hFile=0x154, lpBuffer=0x1a951f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x1a951f4*, lpNumberOfBytesRead=0x2ae1c0*=0xa6, lpOverlapped=0x0) returned 1 [0115.217] CloseHandle (hObject=0x154) returned 1 [0115.229] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0x9f [0115.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.229] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.231] GetFileType (hFile=0x154) returned 0x1 [0115.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.231] GetFileType (hFile=0x154) returned 0x1 [0115.231] WriteFile (in: hFile=0x154, lpBuffer=0x1ae3474*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae188, lpOverlapped=0x0 | out: lpBuffer=0x1ae3474*, lpNumberOfBytesWritten=0x2ae188*=0xb0, lpOverlapped=0x0) returned 1 [0115.232] CloseHandle (hObject=0x154) returned 1 [0115.232] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0x9f [0115.232] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.anonymous", lpFilePart=0x0) returned 0xa9 [0115.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4f34cc0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4f39310, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe39fcbf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0115.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.232] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.anonymous")) returned 1 [0115.233] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x2adc18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0x9e [0115.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae10c) returned 1 [0115.233] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.233] GetFileType (hFile=0x154) returned 0x1 [0115.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae108) returned 1 [0115.233] GetFileType (hFile=0x154) returned 0x1 [0115.233] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae214 | out: lpFileSizeHigh=0x2ae214*=0x0) returned 0xa0 [0115.234] ReadFile (in: hFile=0x154, lpBuffer=0x1ae4b48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae1c0, lpOverlapped=0x0 | out: lpBuffer=0x1ae4b48*, lpNumberOfBytesRead=0x2ae1c0*=0xa0, lpOverlapped=0x0) returned 1 [0115.235] CloseHandle (hObject=0x154) returned 1 [0115.248] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x2adc04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0x9e [0115.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0f8) returned 1 [0115.248] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.249] GetFileType (hFile=0x154) returned 0x1 [0115.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0f4) returned 1 [0115.249] GetFileType (hFile=0x154) returned 0x1 [0115.249] WriteFile (in: hFile=0x154, lpBuffer=0x1b32dcc*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae188, lpOverlapped=0x0 | out: lpBuffer=0x1b32dcc*, lpNumberOfBytesWritten=0x2ae188*=0xb0, lpOverlapped=0x0) returned 1 [0115.250] CloseHandle (hObject=0x154) returned 1 [0115.250] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0x9e [0115.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.anonymous", nBufferLength=0x105, lpBuffer=0x2add38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.anonymous", lpFilePart=0x0) returned 0xa8 [0115.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae198) returned 1 [0115.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae214 | out: lpFileInformation=0x2ae214*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4f3c1f0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4f3e130, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3a22d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0115.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.251] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.anonymous")) returned 1 [0115.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0115.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x7d [0115.251] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x7e [0115.252] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf258 [0115.414] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.414] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.414] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.414] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.414] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.414] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.415] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.415] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.415] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.415] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.415] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.415] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.416] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.416] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.416] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.416] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.416] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.416] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.417] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.418] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.419] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.420] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0115.420] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0115.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0115.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0115.421] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x7d [0115.421] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x7e [0115.421] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf258 [0115.422] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.422] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.422] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.422] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.422] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.422] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.423] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.424] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.425] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.426] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.426] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.426] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0115.426] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0115.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0115.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.427] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x80 [0115.427] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x81 [0115.427] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.429] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.429] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.429] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.429] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.429] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x80 [0115.429] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x81 [0115.429] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.429] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.430] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.430] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.430] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.430] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x80 [0115.430] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x81 [0115.430] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.430] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.431] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.431] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.431] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.431] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x80 [0115.431] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x81 [0115.431] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.431] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.431] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.431] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.432] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.432] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x80 [0115.432] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x81 [0115.432] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.432] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.432] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.432] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.432] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.433] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x80 [0115.433] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x81 [0115.433] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.433] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.433] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.433] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.433] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.433] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x80 [0115.433] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x81 [0115.434] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.434] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.434] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.434] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.434] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.434] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x80 [0115.434] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x81 [0115.434] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.435] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.435] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.435] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.435] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.435] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x80 [0115.435] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x81 [0115.435] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.435] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.436] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.436] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.436] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.436] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x80 [0115.436] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x81 [0115.436] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.436] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.436] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.436] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.437] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.437] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x80 [0115.437] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x81 [0115.437] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.437] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.437] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.437] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.437] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.437] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x80 [0115.437] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x81 [0115.437] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.437] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.437] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.438] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.438] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.438] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x80 [0115.438] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x81 [0115.438] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.438] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.438] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.438] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.438] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.438] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x80 [0115.438] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x81 [0115.438] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.438] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.439] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.439] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.439] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.439] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x83 [0115.439] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x84 [0115.439] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.439] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.439] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.439] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.439] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.439] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x83 [0115.439] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x84 [0115.439] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.440] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.440] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.440] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.440] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.440] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x80 [0115.440] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x81 [0115.440] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.440] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.440] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.440] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.440] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.440] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x80 [0115.440] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x81 [0115.440] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.441] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.441] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.441] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.441] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.441] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x84 [0115.441] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x85 [0115.441] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.441] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.441] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.441] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.441] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.441] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x84 [0115.442] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x85 [0115.442] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.442] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.442] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.442] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.442] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.442] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x80 [0115.442] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x81 [0115.442] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.442] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.442] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.442] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.442] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.443] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x80 [0115.443] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x81 [0115.443] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.443] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.443] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.443] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.443] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.443] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x80 [0115.443] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x81 [0115.443] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.443] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.443] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.443] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.443] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.444] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x80 [0115.444] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x81 [0115.444] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.444] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.444] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.444] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.444] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.444] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x81 [0115.444] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x82 [0115.444] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.444] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.444] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.444] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.445] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.445] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x81 [0115.445] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x82 [0115.445] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.445] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.445] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.445] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.445] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.445] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x80 [0115.445] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x81 [0115.445] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.446] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.446] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.447] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.447] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.447] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x80 [0115.447] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x81 [0115.447] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.447] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.447] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.447] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.447] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x80 [0115.448] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x81 [0115.448] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.448] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.448] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.448] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.448] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x80 [0115.448] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x81 [0115.448] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.448] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.448] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.449] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.449] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.449] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x80 [0115.449] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x81 [0115.449] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.449] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.449] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.449] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.449] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.449] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x80 [0115.449] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x81 [0115.449] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.449] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.450] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.450] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.450] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.450] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x80 [0115.450] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x81 [0115.450] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.450] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.450] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.450] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.450] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.450] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x80 [0115.450] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x81 [0115.450] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.451] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.451] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.451] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.451] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.451] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x80 [0115.451] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x81 [0115.451] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.451] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.451] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.451] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.451] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.451] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x80 [0115.451] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x81 [0115.452] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.452] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.452] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.452] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.452] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.452] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x80 [0115.452] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x81 [0115.452] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.452] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.452] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.452] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.452] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.453] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x80 [0115.453] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x81 [0115.453] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.453] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.453] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.453] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.453] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.453] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x80 [0115.453] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x81 [0115.453] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.454] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.454] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.454] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.454] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.454] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x80 [0115.454] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x81 [0115.454] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.454] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.454] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.454] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.454] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.455] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x80 [0115.455] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x81 [0115.455] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.455] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.455] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.455] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.455] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.455] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x80 [0115.455] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x81 [0115.455] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.455] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.455] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.455] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.455] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.456] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x80 [0115.456] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x81 [0115.456] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.456] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.456] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.456] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.456] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.457] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x80 [0115.457] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x81 [0115.457] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.457] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.457] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.457] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.457] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.457] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x80 [0115.457] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x81 [0115.457] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.457] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.457] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.457] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.458] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x80 [0115.458] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x81 [0115.458] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.458] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.458] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.458] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.458] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x80 [0115.458] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x81 [0115.458] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.459] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.459] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.459] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.459] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.459] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x80 [0115.459] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x81 [0115.459] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.459] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.459] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.459] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.459] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.460] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x80 [0115.460] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x81 [0115.460] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.460] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.460] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.460] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.460] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.460] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x80 [0115.460] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x81 [0115.460] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.460] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.460] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.460] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.461] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x80 [0115.461] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x81 [0115.461] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.462] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.462] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.462] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.462] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.464] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x80 [0115.464] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x81 [0115.464] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.464] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.464] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.464] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.464] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.464] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x83 [0115.464] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x84 [0115.464] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.464] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.464] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.465] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.465] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x83 [0115.465] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x84 [0115.465] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.465] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.465] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.465] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.465] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x83 [0115.465] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x84 [0115.465] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.466] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.466] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.466] FindNextFileW (in: hFindFile=0xbf258, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.466] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.466] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x83 [0115.466] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x84 [0115.466] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.466] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x80 [0115.467] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x81 [0115.467] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.467] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x80 [0115.467] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x81 [0115.467] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf258 [0115.467] FindClose (in: hFindFile=0xbf258 | out: hFindFile=0xbf258) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x80 [0115.467] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x81 [0115.470] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.471] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x80 [0115.471] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x81 [0115.471] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.472] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.472] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", lpFilePart=0x0) returned 0x80 [0115.472] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x81 [0115.472] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.472] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.472] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", lpFilePart=0x0) returned 0x80 [0115.472] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x81 [0115.472] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.473] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.473] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", lpFilePart=0x0) returned 0x80 [0115.473] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x81 [0115.473] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.474] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.474] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", lpFilePart=0x0) returned 0x80 [0115.474] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x81 [0115.474] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.475] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.475] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", lpFilePart=0x0) returned 0x80 [0115.475] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x81 [0115.475] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.477] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.478] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", lpFilePart=0x0) returned 0x80 [0115.478] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x81 [0115.478] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.478] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.478] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", lpFilePart=0x0) returned 0x80 [0115.478] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x81 [0115.478] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.479] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.479] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", lpFilePart=0x0) returned 0x80 [0115.479] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x81 [0115.479] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.480] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.480] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", lpFilePart=0x0) returned 0x80 [0115.480] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", lpFilePart=0x0) returned 0x81 [0115.480] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.481] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0115.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0115.481] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", lpFilePart=0x0) returned 0x80 [0115.481] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", lpFilePart=0x0) returned 0x81 [0115.481] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.481] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0115.481] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", lpFilePart=0x0) returned 0x80 [0115.481] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x81 [0115.482] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.482] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.482] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", lpFilePart=0x0) returned 0x80 [0115.482] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x81 [0115.483] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.483] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.483] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", lpFilePart=0x0) returned 0x80 [0115.483] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x81 [0115.483] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.484] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.484] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", lpFilePart=0x0) returned 0x80 [0115.484] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x81 [0115.484] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.485] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.485] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", lpFilePart=0x0) returned 0x80 [0115.485] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x81 [0115.485] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.485] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.485] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", lpFilePart=0x0) returned 0x80 [0115.486] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x81 [0115.486] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.486] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.486] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x83 [0115.486] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x84 [0115.486] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.487] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x83 [0115.487] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x84 [0115.487] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.488] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x83 [0115.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x84 [0115.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.488] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x83 [0115.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x84 [0115.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbeb98 [0115.489] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.489] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", lpFilePart=0x0) returned 0x7e [0115.489] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", lpFilePart=0x0) returned 0x7f [0115.489] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbeb98 [0115.490] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", lpFilePart=0x0) returned 0x7e [0115.490] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", lpFilePart=0x0) returned 0x7f [0115.490] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbeb98 [0115.490] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x6a [0115.490] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x6b [0115.490] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbeb98 [0115.490] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x6a [0115.490] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x6b [0115.491] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbeb98 [0115.491] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.491] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0", lpFilePart=0x0) returned 0x6e [0115.491] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\", lpFilePart=0x0) returned 0x6f [0115.491] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbeb98 [0115.491] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.491] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0", lpFilePart=0x0) returned 0x6e [0115.491] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\", lpFilePart=0x0) returned 0x6f [0115.491] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbeb98 [0115.491] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.491] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png", lpFilePart=0x0) returned 0x76 [0115.491] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.492] GetFileType (hFile=0x154) returned 0x1 [0115.492] GetFileType (hFile=0x154) returned 0x1 [0115.492] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x170c [0115.504] CloseHandle (hObject=0x154) returned 1 [0115.534] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png", nBufferLength=0x105, lpBuffer=0x2adc78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png", lpFilePart=0x0) returned 0x76 [0115.534] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.536] GetFileType (hFile=0x154) returned 0x1 [0115.536] GetFileType (hFile=0x154) returned 0x1 [0115.536] WriteFile (in: hFile=0x154, lpBuffer=0x1a040b8*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x1a040b8*, lpNumberOfBytesWritten=0x2ae228*=0x1710, lpOverlapped=0x0) returned 1 [0115.537] CloseHandle (hObject=0x154) returned 1 [0115.537] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png", lpFilePart=0x0) returned 0x76 [0115.537] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png.anonymous", nBufferLength=0x105, lpBuffer=0x2addac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png.anonymous", lpFilePart=0x0) returned 0x80 [0115.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3cc9f40, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe4c1f3f0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3cd0610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1710)) returned 1 [0115.538] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\128.png.anonymous")) returned 1 [0115.538] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales", lpFilePart=0x0) returned 0x77 [0115.538] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\", lpFilePart=0x0) returned 0x78 [0115.538] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf218 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.555] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.556] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.557] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.558] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0115.558] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.559] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales", lpFilePart=0x0) returned 0x77 [0115.559] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\", lpFilePart=0x0) returned 0x78 [0115.559] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf218 [0115.560] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.561] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.562] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.563] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.564] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.564] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.564] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.564] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0115.564] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0115.564] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar", lpFilePart=0x0) returned 0x7a [0115.565] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7b [0115.565] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.566] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.566] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.566] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.566] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar", lpFilePart=0x0) returned 0x7a [0115.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x7b [0115.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.567] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.567] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.567] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.567] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg", lpFilePart=0x0) returned 0x7a [0115.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7b [0115.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.568] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.568] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.568] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.568] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg", lpFilePart=0x0) returned 0x7a [0115.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x7b [0115.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.568] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.568] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.568] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.568] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca", lpFilePart=0x0) returned 0x7a [0115.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7b [0115.569] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.569] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.569] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.569] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.569] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca", lpFilePart=0x0) returned 0x7a [0115.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x7b [0115.569] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.569] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.570] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.570] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.570] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs", lpFilePart=0x0) returned 0x7a [0115.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7b [0115.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.570] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.570] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.570] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.571] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs", lpFilePart=0x0) returned 0x7a [0115.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x7b [0115.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.571] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.571] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.571] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.571] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da", lpFilePart=0x0) returned 0x7a [0115.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7b [0115.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.572] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.572] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.572] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.572] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da", lpFilePart=0x0) returned 0x7a [0115.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da\\", lpFilePart=0x0) returned 0x7b [0115.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.572] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.572] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.572] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.573] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de", lpFilePart=0x0) returned 0x7a [0115.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7b [0115.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.573] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.573] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.573] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.573] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de", lpFilePart=0x0) returned 0x7a [0115.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de\\", lpFilePart=0x0) returned 0x7b [0115.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.574] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.574] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.574] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.574] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el", lpFilePart=0x0) returned 0x7a [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7b [0115.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.574] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.574] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.574] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.574] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el", lpFilePart=0x0) returned 0x7a [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el\\", lpFilePart=0x0) returned 0x7b [0115.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.575] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.575] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.575] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.575] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.575] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en", lpFilePart=0x0) returned 0x7a [0115.575] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en\\", lpFilePart=0x0) returned 0x7b [0115.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.575] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.575] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.575] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.575] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.575] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en", lpFilePart=0x0) returned 0x7a [0115.575] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en\\", lpFilePart=0x0) returned 0x7b [0115.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.576] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.576] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.576] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.576] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es", lpFilePart=0x0) returned 0x7a [0115.576] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7b [0115.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.576] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.576] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.576] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.576] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es", lpFilePart=0x0) returned 0x7a [0115.577] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es\\", lpFilePart=0x0) returned 0x7b [0115.577] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.577] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.577] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.577] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.577] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi", lpFilePart=0x0) returned 0x7a [0115.577] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x7b [0115.577] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.577] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.577] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.577] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.577] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi", lpFilePart=0x0) returned 0x7a [0115.578] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x7b [0115.578] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.578] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.578] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.578] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.578] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fil", lpFilePart=0x0) returned 0x7b [0115.578] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x7c [0115.578] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.578] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.578] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.578] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.579] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.579] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.579] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.579] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.579] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.579] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.579] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.579] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.579] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.579] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.579] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.580] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.580] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.580] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.580] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.580] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.580] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.580] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.580] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.580] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.580] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.580] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.581] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.581] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.581] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.581] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.582] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.582] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.582] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.582] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.583] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.583] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.583] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.583] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.583] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.583] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.583] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.583] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.584] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.584] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.584] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.584] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.584] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.584] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.584] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.584] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.584] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.584] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.585] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.585] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.585] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.586] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.586] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.586] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.586] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.586] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.586] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.587] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.587] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.587] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.587] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.587] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.587] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.588] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.588] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.588] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.588] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.588] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.588] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.588] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.589] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.589] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.589] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.589] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.589] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.589] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.590] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.590] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.590] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.590] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.590] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.590] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.590] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.590] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.591] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.591] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.591] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.591] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.591] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.591] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.591] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.591] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.591] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.591] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.592] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.592] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.592] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.593] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.593] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.593] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.593] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.593] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.593] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.593] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.594] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.594] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.594] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.594] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0115.594] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.594] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\se\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.595] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0115.595] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\se\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.595] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.595] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.595] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.596] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.596] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.596] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.597] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.597] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.597] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.598] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.598] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.598] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.598] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.599] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.600] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.600] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.600] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.601] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.601] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.601] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.601] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\__MACOSX\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf218 [0115.601] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.601] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\__MACOSX\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf218 [0115.601] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.601] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\__MACOSX\\_locales\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.602] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.602] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_0\\__MACOSX\\_locales\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf218 [0115.602] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.602] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf218 [0115.618] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.619] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf218 [0115.620] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0115.621] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.623] GetFileType (hFile=0x154) returned 0x1 [0115.623] GetFileType (hFile=0x154) returned 0x1 [0115.623] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae288 | out: lpFileSizeHigh=0x2ae288*=0x0) returned 0x180f [0115.642] CloseHandle (hObject=0x154) returned 1 [0115.660] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.662] GetFileType (hFile=0x154) returned 0x1 [0115.662] GetFileType (hFile=0x154) returned 0x1 [0115.662] WriteFile (in: hFile=0x154, lpBuffer=0x1ac9f44*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x1ac9f44*, lpNumberOfBytesWritten=0x2ae228*=0x1810, lpOverlapped=0x0) returned 1 [0115.663] CloseHandle (hObject=0x154) returned 1 [0115.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae288 | out: lpFileInformation=0x2ae288*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe6870c20, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe6b4f9f0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xe3e01110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1810)) returned 1 [0115.664] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.anonymous")) returned 1 [0115.665] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf118 [0115.667] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.668] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf118 [0115.670] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.671] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.673] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.673] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.673] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.674] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.674] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.674] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.674] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.674] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.675] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.675] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.675] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.675] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.676] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.676] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.677] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.677] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.677] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.678] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.678] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.678] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.679] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.679] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.679] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.679] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.682] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.683] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.683] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.683] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.683] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.683] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.683] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.684] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.684] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.684] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.684] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.684] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.685] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.685] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.685] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.686] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.686] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.687] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.687] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.687] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.687] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.687] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.687] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.687] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.688] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.688] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.688] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.688] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.688] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.689] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.689] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.689] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.689] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.689] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.689] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.690] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.690] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.690] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.690] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.690] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.691] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.691] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.691] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.691] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.692] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.692] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.692] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.692] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.692] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.692] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.693] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.693] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.693] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.693] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.693] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.693] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.694] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.694] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.694] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.694] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.694] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.694] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.694] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.694] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.695] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.695] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.695] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.695] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.695] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.696] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.696] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.696] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.697] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.697] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.697] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.697] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.697] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.697] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.697] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.698] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.698] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.698] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.698] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.698] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.698] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.699] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.699] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.699] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.699] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.699] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.699] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.699] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.700] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.700] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.700] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.700] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.700] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.700] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.701] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.701] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.701] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.701] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.701] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.701] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.702] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.702] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.702] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.702] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.702] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.702] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.702] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.703] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.703] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.703] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.703] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.703] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.703] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.704] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.704] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.704] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.704] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.704] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.704] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.704] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbf118 [0115.705] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0115.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0115.738] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29 [0115.739] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.739] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.739] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.739] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.739] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.740] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.740] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.740] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.740] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.740] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.740] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.741] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.741] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.741] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.741] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.741] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.741] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.742] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.742] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.742] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.742] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.742] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0115.743] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0115.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0115.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0115.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0115.743] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29 [0115.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf118 [0115.743] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.743] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.743] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.744] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.745] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.746] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.746] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.746] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0115.746] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0115.746] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0115.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0115.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.746] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34 [0115.746] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35 [0115.746] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.747] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.747] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.747] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.747] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34 [0115.747] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35 [0115.747] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.748] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.748] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.748] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.748] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x35 [0115.748] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x36 [0115.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.749] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.749] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.749] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.749] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x35 [0115.749] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x36 [0115.749] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.750] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.750] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.750] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e [0115.750] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f [0115.750] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.753] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.753] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.753] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.754] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.754] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.754] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.756] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e [0115.756] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f [0115.756] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.757] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.757] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.757] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.758] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.758] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.758] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.760] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3d [0115.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f [0115.762] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0115.762] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0115.763] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0115.764] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40 [0115.764] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0115.766] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.780] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.780] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.781] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.781] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.781] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.781] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.783] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3d [0115.783] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f [0115.783] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0115.784] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0115.785] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0115.785] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40 [0115.785] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0115.787] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.789] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.789] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.789] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.789] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.790] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.790] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.791] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x54 [0115.792] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56 [0115.792] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0115.793] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.793] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.794] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57 [0115.794] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.796] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.796] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.796] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.797] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.797] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.797] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x54 [0115.798] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56 [0115.798] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2adf80, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0115.798] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.799] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.800] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57 [0115.800] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf54, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.802] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.802] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.802] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.803] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.803] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0115.803] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x55 [0115.804] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x5f [0115.805] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61 [0115.805] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0115.805] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.806] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0115.807] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.807] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0115.808] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62 [0115.808] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0115.810] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0115.811] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0115.811] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0115.811] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0115.811] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0115.811] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0115.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0115.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0115.811] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x55 [0115.812] GetLongPathNameW (in: lpszShortPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x5f [0115.813] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61 [0115.813] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2adf0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0115.814] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.814] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adeec, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0115.815] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0115.816] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0115.816] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62 [0115.817] GetLongPathNameW (in: lpszShortPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2adee0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0115.819] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf118 [0115.819] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0115.819] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0115.819] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0115.820] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0115.820] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0115.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0115.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.821] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34 [0115.821] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35 [0115.821] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.824] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.824] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.824] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.825] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.825] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.825] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.825] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.825] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.825] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.827] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34 [0115.827] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35 [0115.827] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.828] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.828] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.829] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.829] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.829] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.829] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.829] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.829] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.830] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.831] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", lpFilePart=0x0) returned 0x3d [0115.831] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", lpFilePart=0x0) returned 0x3e [0115.831] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.833] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.833] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.833] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.833] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.833] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.833] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.833] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V", lpFilePart=0x0) returned 0x3d [0115.834] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\", lpFilePart=0x0) returned 0x3e [0115.834] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\0TOZKA9V\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.834] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.834] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.834] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.834] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.835] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.835] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", lpFilePart=0x0) returned 0x3d [0115.835] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", lpFilePart=0x0) returned 0x3e [0115.835] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.835] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.835] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.836] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.836] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.836] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.836] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M", lpFilePart=0x0) returned 0x3d [0115.836] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\", lpFilePart=0x0) returned 0x3e [0115.836] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\28NUQX6M\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.837] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.837] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.837] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.837] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.837] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.837] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", lpFilePart=0x0) returned 0x3d [0115.838] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", lpFilePart=0x0) returned 0x3e [0115.838] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.838] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.838] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.838] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.838] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.838] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.839] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL", lpFilePart=0x0) returned 0x3d [0115.839] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\", lpFilePart=0x0) returned 0x3e [0115.839] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\8S73DLQL\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.839] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.839] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.839] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.839] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.839] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.840] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", lpFilePart=0x0) returned 0x3d [0115.840] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", lpFilePart=0x0) returned 0x3e [0115.840] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.840] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.840] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.840] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.841] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.841] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.841] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1", lpFilePart=0x0) returned 0x3d [0115.841] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\", lpFilePart=0x0) returned 0x3e [0115.841] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Feeds Cache\\QVTV2WL1\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0115.841] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.841] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.841] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.842] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.842] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.842] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2e [0115.842] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x2f [0115.842] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.843] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.843] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.843] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.843] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.844] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2e [0115.844] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x2f [0115.844] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.844] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.844] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.844] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.844] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.845] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2e [0115.845] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x2f [0115.845] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.845] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.845] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.846] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2e [0115.846] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x2f [0115.846] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.846] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.846] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.846] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.847] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x2f [0115.847] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x30 [0115.847] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.862] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.863] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.863] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x2f [0115.863] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x30 [0115.863] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.863] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.864] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.864] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.864] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x30 [0115.864] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x31 [0115.864] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.865] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.865] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.865] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.866] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x30 [0115.866] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x31 [0115.866] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.866] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.866] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.866] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.866] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x30 [0115.866] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x31 [0115.867] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.886] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.886] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.886] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.886] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x30 [0115.886] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x31 [0115.887] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.887] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.887] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.887] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.887] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a [0115.887] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b [0115.887] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.890] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.891] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.891] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0115.892] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a [0115.892] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b [0115.892] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf118 [0115.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.894] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.895] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0115.895] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0115.895] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0115.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0115.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0115.896] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFilePart=0x0) returned 0x46 [0115.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0115.896] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.897] GetFileType (hFile=0x154) returned 0x1 [0115.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0115.898] GetFileType (hFile=0x154) returned 0x1 [0115.898] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2f9d [0115.898] ReadFile (in: hFile=0x154, lpBuffer=0x1b7310c, nNumberOfBytesToRead=0x2f9d, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b7310c*, lpNumberOfBytesRead=0x2ae478*=0x2f9d, lpOverlapped=0x0) returned 1 [0115.909] CloseHandle (hObject=0x154) returned 1 [0115.959] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFilePart=0x0) returned 0x46 [0115.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0115.960] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.962] GetFileType (hFile=0x154) returned 0x1 [0115.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0115.962] GetFileType (hFile=0x154) returned 0x1 [0115.962] WriteFile (in: hFile=0x154, lpBuffer=0x19cc304*, nNumberOfBytesToWrite=0x2fa0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19cc304*, lpNumberOfBytesWritten=0x2ae46c*=0x2fa0, lpOverlapped=0x0) returned 1 [0115.963] CloseHandle (hObject=0x154) returned 1 [0115.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFilePart=0x0) returned 0x46 [0115.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.anonymous", lpFilePart=0x0) returned 0x50 [0115.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0115.964] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd14bb0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0xcd14bb0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xe40fac90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0)) returned 1 [0115.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.964] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.anonymous")) returned 1 [0115.965] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0115.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0115.965] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.965] GetFileType (hFile=0x154) returned 0x1 [0115.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0115.965] GetFileType (hFile=0x154) returned 0x1 [0115.965] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2f97 [0115.965] ReadFile (in: hFile=0x154, lpBuffer=0x19cf6f8, nNumberOfBytesToRead=0x2f97, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19cf6f8*, lpNumberOfBytesRead=0x2ae478*=0x2f97, lpOverlapped=0x0) returned 1 [0115.967] CloseHandle (hObject=0x154) returned 1 [0115.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0115.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0115.994] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0115.995] GetFileType (hFile=0x154) returned 0x1 [0115.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0115.995] GetFileType (hFile=0x154) returned 0x1 [0115.996] WriteFile (in: hFile=0x154, lpBuffer=0x1a2b460*, nNumberOfBytesToWrite=0x2fa0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a2b460*, lpNumberOfBytesWritten=0x2ae46c*=0x2fa0, lpOverlapped=0x0) returned 1 [0115.997] CloseHandle (hObject=0x154) returned 1 [0115.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0115.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.anonymous", lpFilePart=0x0) returned 0x50 [0115.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0115.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90add70, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x90add70, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xe4146f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0)) returned 1 [0115.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.997] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.anonymous")) returned 1 [0115.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.998] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x43 [0115.998] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x44 [0115.998] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0115.998] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.998] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.998] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.998] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.999] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.999] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.999] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0115.999] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0115.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0115.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0115.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0115.999] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x43 [0115.999] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x44 [0115.999] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0115.999] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.999] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0115.999] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.000] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.000] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.000] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.000] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.000] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.000] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK", lpFilePart=0x0) returned 0x4c [0116.000] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK\\", lpFilePart=0x0) returned 0x4d [0116.000] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0116.002] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.002] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.002] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.002] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK", lpFilePart=0x0) returned 0x4c [0116.002] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK\\", lpFilePart=0x0) returned 0x4d [0116.002] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\6MN3ELGK\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0116.002] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.003] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.003] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.003] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A", lpFilePart=0x0) returned 0x4c [0116.003] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A\\", lpFilePart=0x0) returned 0x4d [0116.003] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0116.004] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.004] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.004] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.005] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A", lpFilePart=0x0) returned 0x4c [0116.005] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A\\", lpFilePart=0x0) returned 0x4d [0116.005] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HN1MCJ8A\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0116.005] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.005] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.005] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.006] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN", lpFilePart=0x0) returned 0x4c [0116.006] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\", lpFilePart=0x0) returned 0x4d [0116.006] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0116.009] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.009] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.009] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.009] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.009] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN", lpFilePart=0x0) returned 0x4c [0116.009] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\", lpFilePart=0x0) returned 0x4d [0116.009] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb98 [0116.009] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.009] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.010] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.010] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0116.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x64 [0116.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0116.010] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\kl4i7evn\\imagesrv.adition[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.010] GetFileType (hFile=0x154) returned 0x1 [0116.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0116.010] GetFileType (hFile=0x154) returned 0x1 [0116.011] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x63 [0116.011] ReadFile (in: hFile=0x154, lpBuffer=0x1a35928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a35928*, lpNumberOfBytesRead=0x2ae390*=0x63, lpOverlapped=0x0) returned 1 [0116.012] CloseHandle (hObject=0x154) returned 1 [0116.024] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x64 [0116.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0116.025] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\kl4i7evn\\imagesrv.adition[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.026] GetFileType (hFile=0x154) returned 0x1 [0116.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0116.026] GetFileType (hFile=0x154) returned 0x1 [0116.026] WriteFile (in: hFile=0x154, lpBuffer=0x1a83aa0*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a83aa0*, lpNumberOfBytesWritten=0x2ae358*=0x70, lpOverlapped=0x0) returned 1 [0116.027] CloseHandle (hObject=0x154) returned 1 [0116.027] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x64 [0116.027] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml.anonymous", lpFilePart=0x0) returned 0x6e [0116.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0116.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\kl4i7evn\\imagesrv.adition[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9d89a40, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9d89a40, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xe4193210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0116.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.028] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\kl4i7evn\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\KL4I7EVN\\imagesrv.adition[1].xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\kl4i7evn\\imagesrv.adition[1].xml.anonymous")) returned 1 [0116.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.028] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO", lpFilePart=0x0) returned 0x4c [0116.028] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\", lpFilePart=0x0) returned 0x4d [0116.028] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf1d8 [0116.029] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.029] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.029] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.029] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0116.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO", lpFilePart=0x0) returned 0x4c [0116.030] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\", lpFilePart=0x0) returned 0x4d [0116.030] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf1d8 [0116.030] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.030] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.030] FindNextFileW (in: hFindFile=0xbf1d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.030] FindClose (in: hFindFile=0xbf1d8 | out: hFindFile=0xbf1d8) returned 1 [0116.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml", lpFilePart=0x0) returned 0x5b [0116.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0116.030] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\y6hzt8lo\\www.msn[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.033] GetFileType (hFile=0x154) returned 0x1 [0116.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0116.033] GetFileType (hFile=0x154) returned 0x1 [0116.033] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x334 [0116.033] ReadFile (in: hFile=0x154, lpBuffer=0x1a86d74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a86d74*, lpNumberOfBytesRead=0x2ae390*=0x334, lpOverlapped=0x0) returned 1 [0116.047] CloseHandle (hObject=0x154) returned 1 [0116.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml", lpFilePart=0x0) returned 0x5b [0116.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0116.067] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\y6hzt8lo\\www.msn[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.069] GetFileType (hFile=0x154) returned 0x1 [0116.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0116.069] GetFileType (hFile=0x154) returned 0x1 [0116.069] WriteFile (in: hFile=0x154, lpBuffer=0x1ad5d00*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ad5d00*, lpNumberOfBytesWritten=0x2ae358*=0x340, lpOverlapped=0x0) returned 1 [0116.070] CloseHandle (hObject=0x154) returned 1 [0116.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml", lpFilePart=0x0) returned 0x5b [0116.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml.anonymous", lpFilePart=0x0) returned 0x65 [0116.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0116.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\y6hzt8lo\\www.msn[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4292660, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa4292660, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xe4205630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0116.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.071] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\y6hzt8lo\\www.msn[1].xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Y6HZT8LO\\www.msn[1].xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\internet explorer\\domstore\\y6hzt8lo\\www.msn[1].xml.anonymous")) returned 1 [0116.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.072] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x43 [0116.072] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x44 [0116.072] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.073] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.074] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.074] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.074] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x43 [0116.074] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x44 [0116.075] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.075] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.075] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.076] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x4a [0116.076] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x4b [0116.076] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.076] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.076] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.076] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.077] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x4a [0116.077] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x4b [0116.077] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.077] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.077] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.077] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.077] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x4f [0116.077] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x50 [0116.078] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.086] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.087] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.087] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.087] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.087] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.087] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.087] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x4f [0116.089] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x50 [0116.089] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.090] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.090] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.090] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.091] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.091] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.091] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.091] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.092] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35 [0116.092] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36 [0116.093] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.104] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.105] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.105] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.107] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35 [0116.107] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36 [0116.107] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.109] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44 [0116.110] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45 [0116.110] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.112] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.112] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.112] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.112] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.112] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44 [0116.112] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45 [0116.112] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.113] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.113] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.113] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a [0116.113] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b [0116.113] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.114] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.114] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.115] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a [0116.115] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b [0116.115] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.115] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.115] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.115] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.115] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.116] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0116.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", lpFilePart=0x0) returned 0x53 [0116.116] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", lpFilePart=0x0) returned 0x54 [0116.116] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.118] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.118] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.118] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.119] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.120] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.120] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.120] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0116.120] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0116.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0116.121] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D", lpFilePart=0x0) returned 0x53 [0116.121] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\", lpFilePart=0x0) returned 0x54 [0116.121] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0001692D\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.123] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.124] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0116.124] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0116.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0116.125] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC", lpFilePart=0x0) returned 0x53 [0116.125] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC\\", lpFilePart=0x0) returned 0x54 [0116.125] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.148] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.149] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0116.149] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0116.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0116.150] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC", lpFilePart=0x0) returned 0x53 [0116.151] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC\\", lpFilePart=0x0) returned 0x54 [0116.151] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00065ABC\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0116.152] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0116.152] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0116.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.154] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x4c [0116.154] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x4d [0116.154] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.154] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.154] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.154] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.154] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x4c [0116.154] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x4d [0116.155] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.155] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.155] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.155] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.155] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x2f [0116.155] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x30 [0116.155] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.155] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.156] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x2f [0116.156] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x30 [0116.156] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.156] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.156] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.157] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x34 [0116.157] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x35 [0116.157] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.157] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.157] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.157] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.157] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.157] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x34 [0116.157] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x35 [0116.157] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.157] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.158] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.158] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.158] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.158] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x44 [0116.158] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x45 [0116.158] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.159] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.159] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.159] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.159] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.159] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.159] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.159] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x44 [0116.159] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x45 [0116.159] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.159] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.160] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.160] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x36 [0116.160] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x37 [0116.160] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.160] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.160] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.161] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x36 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x37 [0116.161] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.161] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.161] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.161] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.161] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.161] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.161] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x3d [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x3e [0116.161] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.162] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.162] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.162] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.162] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x3d [0116.162] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x3e [0116.162] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.162] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.162] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.162] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.162] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x3b [0116.162] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x3c [0116.162] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.163] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.163] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.163] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.163] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x3b [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x3c [0116.163] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.163] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0116.163] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0116.163] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.164] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x3a [0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x3b [0116.164] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.164] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.164] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.164] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.164] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x3a [0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x3b [0116.164] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.165] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.165] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.165] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.165] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x30 [0116.165] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x31 [0116.165] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.166] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.166] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.166] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.166] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.166] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.166] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.166] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x30 [0116.166] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x31 [0116.167] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.167] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.167] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.167] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x3a [0116.167] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x3b [0116.167] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.176] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.176] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.178] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x3a [0116.178] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x3b [0116.178] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.179] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.179] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.179] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.179] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.179] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.179] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.180] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.180] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0116.180] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0116.180] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x32 [0116.181] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x33 [0116.181] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.182] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.182] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.182] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.182] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x32 [0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x33 [0116.183] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.183] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.183] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.183] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x3c [0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x3d [0116.183] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.184] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.184] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.184] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.184] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x3c [0116.184] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x3d [0116.184] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.184] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.184] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.184] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.185] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x2e [0116.185] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x2f [0116.185] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.185] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.185] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.185] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.185] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.185] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.185] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x2e [0116.186] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x2f [0116.186] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0116.186] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.186] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30 [0116.186] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x31 [0116.186] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.186] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0116.187] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0116.187] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30 [0116.187] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x31 [0116.187] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0116.188] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0116.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0116.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.188] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x35 [0116.188] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033\\", lpFilePart=0x0) returned 0x36 [0116.188] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.188] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x35 [0116.189] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033\\", lpFilePart=0x0) returned 0x36 [0116.189] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.189] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x35 [0116.189] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x36 [0116.189] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.189] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x35 [0116.190] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x36 [0116.190] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.190] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3a [0116.190] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x3b [0116.190] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.190] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3a [0116.190] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x3b [0116.190] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.191] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x3b [0116.191] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", lpFilePart=0x0) returned 0x3c [0116.191] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.192] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x3b [0116.192] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", lpFilePart=0x0) returned 0x3c [0116.192] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.192] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x3b [0116.192] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", lpFilePart=0x0) returned 0x3c [0116.192] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.193] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x3b [0116.193] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", lpFilePart=0x0) returned 0x3c [0116.193] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.193] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x37 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x38 [0116.194] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.194] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.194] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x37 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x38 [0116.194] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.194] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.194] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x39 [0116.195] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x3a [0116.195] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.195] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.196] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x39 [0116.196] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x3a [0116.196] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.196] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.196] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3d [0116.196] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x3e [0116.196] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.197] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3d [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x3e [0116.197] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.197] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x38 [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x39 [0116.197] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.198] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0116.198] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x38 [0116.198] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x39 [0116.198] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.198] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0116.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0116.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.198] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0116.198] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0116.198] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.198] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0116.199] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0116.199] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0116.199] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.199] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0116.199] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923", lpFilePart=0x0) returned 0x5d [0116.199] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923\\", lpFilePart=0x0) returned 0x5e [0116.199] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.199] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923", lpFilePart=0x0) returned 0x5d [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923\\", lpFilePart=0x0) returned 0x5e [0116.200] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018092220180923\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.200] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x3c [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x3d [0116.200] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.200] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x3c [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x3d [0116.200] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.201] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", lpFilePart=0x0) returned 0x48 [0116.201] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", lpFilePart=0x0) returned 0x49 [0116.201] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.201] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", lpFilePart=0x0) returned 0x48 [0116.201] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", lpFilePart=0x0) returned 0x49 [0116.201] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.201] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706", lpFilePart=0x0) returned 0x61 [0116.202] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\", lpFilePart=0x0) returned 0x62 [0116.202] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea18 [0116.202] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.202] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706", lpFilePart=0x0) returned 0x61 [0116.202] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\", lpFilePart=0x0) returned 0x62 [0116.202] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea18 [0116.202] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.202] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x3a [0116.202] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x3b [0116.202] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.204] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x3a [0116.204] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x3b [0116.204] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.204] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0116.204] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0116.204] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.204] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0116.204] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0116.204] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0116.205] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.205] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0116.205] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.205] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.205] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0116.205] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.205] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.205] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B", lpFilePart=0x0) returned 0x5e [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\", lpFilePart=0x0) returned 0x5f [0116.206] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.276] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.277] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B", lpFilePart=0x0) returned 0x5e [0116.277] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\", lpFilePart=0x0) returned 0x5f [0116.277] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\B9MX3V6B\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.278] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.280] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN", lpFilePart=0x0) returned 0x5e [0116.280] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\", lpFilePart=0x0) returned 0x5f [0116.280] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.283] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.284] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN", lpFilePart=0x0) returned 0x5e [0116.284] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\", lpFilePart=0x0) returned 0x5f [0116.284] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CWLQGLLN\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.285] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD", lpFilePart=0x0) returned 0x5e [0116.287] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\", lpFilePart=0x0) returned 0x5f [0116.287] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.289] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.291] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD", lpFilePart=0x0) returned 0x5e [0116.291] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\", lpFilePart=0x0) returned 0x5f [0116.291] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\I81WO4AD\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.292] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.293] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E", lpFilePart=0x0) returned 0x5e [0116.294] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\", lpFilePart=0x0) returned 0x5f [0116.294] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.309] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.311] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E", lpFilePart=0x0) returned 0x5e [0116.311] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\", lpFilePart=0x0) returned 0x5f [0116.311] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QN4DSE0E\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.312] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.314] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x55 [0116.314] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", lpFilePart=0x0) returned 0x56 [0116.314] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.315] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.315] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x55 [0116.315] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", lpFilePart=0x0) returned 0x56 [0116.315] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.315] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.316] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x56 [0116.316] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", lpFilePart=0x0) returned 0x57 [0116.316] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.316] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.317] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x56 [0116.317] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", lpFilePart=0x0) returned 0x57 [0116.317] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.317] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.317] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x4d [0116.317] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x4e [0116.317] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.318] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.318] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x4d [0116.318] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x4e [0116.318] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0116.318] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.318] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", lpFilePart=0x0) returned 0x59 [0116.318] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpFilePart=0x0) returned 0x5a [0116.318] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.319] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.319] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", lpFilePart=0x0) returned 0x59 [0116.319] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpFilePart=0x0) returned 0x5a [0116.319] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0116.319] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.319] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3", lpFilePart=0x0) returned 0x62 [0116.319] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\", lpFilePart=0x0) returned 0x63 [0116.320] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea18 [0116.407] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.409] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3", lpFilePart=0x0) returned 0x62 [0116.409] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\", lpFilePart=0x0) returned 0x63 [0116.409] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea18 [0116.411] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0116.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png", lpFilePart=0x0) returned 0x71 [0116.413] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa3e1oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.416] GetFileType (hFile=0x154) returned 0x1 [0116.416] GetFileType (hFile=0x154) returned 0x1 [0116.416] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x29b [0116.495] CloseHandle (hObject=0x154) returned 1 [0116.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png", lpFilePart=0x0) returned 0x71 [0116.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.549] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa3e1oo[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.551] GetFileType (hFile=0x154) returned 0x1 [0116.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.551] GetFileType (hFile=0x154) returned 0x1 [0116.551] WriteFile (in: hFile=0x154, lpBuffer=0x1989404*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1989404*, lpNumberOfBytesWritten=0x2ae270*=0x2a0, lpOverlapped=0x0) returned 1 [0116.552] CloseHandle (hObject=0x154) returned 1 [0116.553] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png", lpFilePart=0x0) returned 0x71 [0116.553] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa3e1oo[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7794b670, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7794b670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe467bf70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1 [0116.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.553] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA3e1oO[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa3e1oo[1].png.anonymous")) returned 1 [0116.554] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png", lpFilePart=0x0) returned 0x71 [0116.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.554] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42ckd[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.555] GetFileType (hFile=0x154) returned 0x1 [0116.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.555] GetFileType (hFile=0x154) returned 0x1 [0116.556] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2c2 [0116.556] ReadFile (in: hFile=0x154, lpBuffer=0x198ab64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x198ab64*, lpNumberOfBytesRead=0x2ae2a8*=0x2c2, lpOverlapped=0x0) returned 1 [0116.570] CloseHandle (hObject=0x154) returned 1 [0116.589] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png", lpFilePart=0x0) returned 0x71 [0116.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.589] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42ckd[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.594] GetFileType (hFile=0x154) returned 0x1 [0116.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.594] GetFileType (hFile=0x154) returned 0x1 [0116.595] WriteFile (in: hFile=0x154, lpBuffer=0x19d9a4c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19d9a4c*, lpNumberOfBytesWritten=0x2ae270*=0x2d0, lpOverlapped=0x0) returned 1 [0116.596] CloseHandle (hObject=0x154) returned 1 [0116.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png", lpFilePart=0x0) returned 0x71 [0116.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42ckd[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbbbbe0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbbbbe0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe46ee390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1 [0116.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.597] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42ckd[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42ckd[1].png.anonymous")) returned 1 [0116.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png", lpFilePart=0x0) returned 0x71 [0116.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.598] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42x3v[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.599] GetFileType (hFile=0x154) returned 0x1 [0116.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.599] GetFileType (hFile=0x154) returned 0x1 [0116.600] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3e3 [0116.600] ReadFile (in: hFile=0x154, lpBuffer=0x19db2cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19db2cc*, lpNumberOfBytesRead=0x2ae2a8*=0x3e3, lpOverlapped=0x0) returned 1 [0116.647] CloseHandle (hObject=0x154) returned 1 [0116.665] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png", lpFilePart=0x0) returned 0x71 [0116.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.665] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42x3v[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.666] GetFileType (hFile=0x154) returned 0x1 [0116.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.667] GetFileType (hFile=0x154) returned 0x1 [0116.667] WriteFile (in: hFile=0x154, lpBuffer=0x1a2a5f8*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a2a5f8*, lpNumberOfBytesWritten=0x2ae270*=0x3f0, lpOverlapped=0x0) returned 1 [0116.668] CloseHandle (hObject=0x154) returned 1 [0116.668] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png", lpFilePart=0x0) returned 0x71 [0116.669] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42x3v[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7c3f90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7c3f90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe47aca70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0116.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.669] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA42x3V[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa42x3v[1].png.anonymous")) returned 1 [0116.670] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png", lpFilePart=0x0) returned 0x71 [0116.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.670] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61akn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.670] GetFileType (hFile=0x154) returned 0x1 [0116.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.670] GetFileType (hFile=0x154) returned 0x1 [0116.670] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x248 [0116.670] ReadFile (in: hFile=0x154, lpBuffer=0x1a2bcdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a2bcdc*, lpNumberOfBytesRead=0x2ae2a8*=0x248, lpOverlapped=0x0) returned 1 [0116.685] CloseHandle (hObject=0x154) returned 1 [0116.703] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png", lpFilePart=0x0) returned 0x71 [0116.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.703] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61akn[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.705] GetFileType (hFile=0x154) returned 0x1 [0116.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.705] GetFileType (hFile=0x154) returned 0x1 [0116.705] WriteFile (in: hFile=0x154, lpBuffer=0x1a7a7e0*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a7a7e0*, lpNumberOfBytesWritten=0x2ae270*=0x250, lpOverlapped=0x0) returned 1 [0116.707] CloseHandle (hObject=0x154) returned 1 [0116.707] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png", lpFilePart=0x0) returned 0x71 [0116.707] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61akn[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2f4ac0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2f4ac0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe47f8d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0116.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.707] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61akn[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61AKN[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61akn[1].png.anonymous")) returned 1 [0116.708] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png", lpFilePart=0x0) returned 0x71 [0116.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.708] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61ilp[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.726] GetFileType (hFile=0x154) returned 0x1 [0116.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.726] GetFileType (hFile=0x154) returned 0x1 [0116.726] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x204 [0116.726] ReadFile (in: hFile=0x154, lpBuffer=0x1a7be80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a7be80*, lpNumberOfBytesRead=0x2ae2a8*=0x204, lpOverlapped=0x0) returned 1 [0116.736] CloseHandle (hObject=0x154) returned 1 [0116.753] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png", lpFilePart=0x0) returned 0x71 [0116.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.754] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61ilp[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.755] GetFileType (hFile=0x154) returned 0x1 [0116.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.755] GetFileType (hFile=0x154) returned 0x1 [0116.756] WriteFile (in: hFile=0x154, lpBuffer=0x1aca848*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aca848*, lpNumberOfBytesWritten=0x2ae270*=0x210, lpOverlapped=0x0) returned 1 [0116.758] CloseHandle (hObject=0x154) returned 1 [0116.758] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png", lpFilePart=0x0) returned 0x71 [0116.758] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.758] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61ilp[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c3ff460, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c3ff460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe48912b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0116.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.758] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61ilp[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AA61ILp[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aa61ilp[1].png.anonymous")) returned 1 [0116.759] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png", lpFilePart=0x0) returned 0x71 [0116.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.759] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aabyinc[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.760] GetFileType (hFile=0x154) returned 0x1 [0116.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.760] GetFileType (hFile=0x154) returned 0x1 [0116.760] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2fc [0116.760] ReadFile (in: hFile=0x154, lpBuffer=0x1acbfe0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1acbfe0*, lpNumberOfBytesRead=0x2ae2a8*=0x2fc, lpOverlapped=0x0) returned 1 [0116.772] CloseHandle (hObject=0x154) returned 1 [0116.791] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png", lpFilePart=0x0) returned 0x71 [0116.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.791] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aabyinc[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.793] GetFileType (hFile=0x154) returned 0x1 [0116.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.793] GetFileType (hFile=0x154) returned 0x1 [0116.793] WriteFile (in: hFile=0x154, lpBuffer=0x1b1ae50*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b1ae50*, lpNumberOfBytesWritten=0x2ae270*=0x300, lpOverlapped=0x0) returned 1 [0116.795] CloseHandle (hObject=0x154) returned 1 [0116.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aabyinc[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c76b400, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c76b400, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe48dd570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x300)) returned 1 [0116.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.795] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aabyinc[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAbyinC[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aabyinc[1].png.anonymous")) returned 1 [0116.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.796] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aaktc4c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.797] GetFileType (hFile=0x154) returned 0x1 [0116.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.797] GetFileType (hFile=0x154) returned 0x1 [0116.797] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x189e [0116.797] ReadFile (in: hFile=0x154, lpBuffer=0x1b1c2e0, nNumberOfBytesToRead=0x189e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b1c2e0*, lpNumberOfBytesRead=0x2ae2a8*=0x189e, lpOverlapped=0x0) returned 1 [0116.799] CloseHandle (hObject=0x154) returned 1 [0116.820] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg", lpFilePart=0x0) returned 0x71 [0116.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.821] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aaktc4c[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.822] GetFileType (hFile=0x154) returned 0x1 [0116.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.822] GetFileType (hFile=0x154) returned 0x1 [0116.822] WriteFile (in: hFile=0x154, lpBuffer=0x19739a0*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19739a0*, lpNumberOfBytesWritten=0x2ae29c*=0x18a0, lpOverlapped=0x0) returned 1 [0116.824] CloseHandle (hObject=0x154) returned 1 [0116.824] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg", lpFilePart=0x0) returned 0x71 [0116.824] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0116.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aaktc4c[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d751b70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d751b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4929830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18a0)) returned 1 [0116.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.824] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aaktc4c[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAkTc4c[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aaktc4c[1].jpg.anonymous")) returned 1 [0116.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png", lpFilePart=0x0) returned 0x71 [0116.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.835] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aamuyv2[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.836] GetFileType (hFile=0x154) returned 0x1 [0116.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.836] GetFileType (hFile=0x154) returned 0x1 [0116.836] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x19a [0116.836] ReadFile (in: hFile=0x154, lpBuffer=0x19759f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19759f0*, lpNumberOfBytesRead=0x2ae2a8*=0x19a, lpOverlapped=0x0) returned 1 [0116.843] CloseHandle (hObject=0x154) returned 1 [0116.880] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png", lpFilePart=0x0) returned 0x71 [0116.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.880] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aamuyv2[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.897] GetFileType (hFile=0x154) returned 0x1 [0116.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.897] GetFileType (hFile=0x154) returned 0x1 [0116.897] WriteFile (in: hFile=0x154, lpBuffer=0x19c42e0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19c42e0*, lpNumberOfBytesWritten=0x2ae270*=0x1a0, lpOverlapped=0x0) returned 1 [0116.898] CloseHandle (hObject=0x154) returned 1 [0116.898] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png", lpFilePart=0x0) returned 0x71 [0116.898] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aamuyv2[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc54160, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc54160, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe49e7f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0116.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.899] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\AAmUyV2[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\aamuyv2[1].png.anonymous")) returned 1 [0116.899] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png", lpFilePart=0x0) returned 0x71 [0116.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.899] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1ccoi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.929] GetFileType (hFile=0x154) returned 0x1 [0116.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.929] GetFileType (hFile=0x154) returned 0x1 [0116.929] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1d0 [0116.930] ReadFile (in: hFile=0x154, lpBuffer=0x19c598c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19c598c*, lpNumberOfBytesRead=0x2ae2a8*=0x1d0, lpOverlapped=0x0) returned 1 [0116.947] CloseHandle (hObject=0x154) returned 1 [0116.961] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png", lpFilePart=0x0) returned 0x71 [0116.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0116.961] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1ccoi[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.962] GetFileType (hFile=0x154) returned 0x1 [0116.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0116.962] GetFileType (hFile=0x154) returned 0x1 [0116.962] WriteFile (in: hFile=0x154, lpBuffer=0x1a14268*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a14268*, lpNumberOfBytesWritten=0x2ae270*=0x1e0, lpOverlapped=0x0) returned 1 [0116.963] CloseHandle (hObject=0x154) returned 1 [0116.963] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png", lpFilePart=0x0) returned 0x71 [0116.963] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0116.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0116.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1ccoi[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b0ce300, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0ce300, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe4a80490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1 [0116.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0116.964] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1CcOi[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1ccoi[1].png.anonymous")) returned 1 [0116.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png", lpFilePart=0x0) returned 0x71 [0116.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0116.964] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1kvzy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0116.964] GetFileType (hFile=0x154) returned 0x1 [0116.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0116.964] GetFileType (hFile=0x154) returned 0x1 [0116.971] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x459 [0116.971] ReadFile (in: hFile=0x154, lpBuffer=0x1a15b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a15b60*, lpNumberOfBytesRead=0x2ae2a8*=0x459, lpOverlapped=0x0) returned 1 [0117.029] CloseHandle (hObject=0x154) returned 1 [0117.040] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png", lpFilePart=0x0) returned 0x71 [0117.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.040] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1kvzy[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.042] GetFileType (hFile=0x154) returned 0x1 [0117.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.042] GetFileType (hFile=0x154) returned 0x1 [0117.042] WriteFile (in: hFile=0x154, lpBuffer=0x1a650b4*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a650b4*, lpNumberOfBytesWritten=0x2ae270*=0x460, lpOverlapped=0x0) returned 1 [0117.043] CloseHandle (hObject=0x154) returned 1 [0117.043] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png", lpFilePart=0x0) returned 0x71 [0117.043] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0117.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.043] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1kvzy[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x773ca390, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7aedf120, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe4b3eb70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0117.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.044] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1kvzy[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB1kvzy[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb1kvzy[1].png.anonymous")) returned 1 [0117.044] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png", lpFilePart=0x0) returned 0x71 [0117.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.044] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb5ktiv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.049] GetFileType (hFile=0x154) returned 0x1 [0117.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.050] GetFileType (hFile=0x154) returned 0x1 [0117.050] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x121 [0117.050] ReadFile (in: hFile=0x154, lpBuffer=0x1a66674, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a66674*, lpNumberOfBytesRead=0x2ae2a8*=0x121, lpOverlapped=0x0) returned 1 [0117.051] CloseHandle (hObject=0x154) returned 1 [0117.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png", lpFilePart=0x0) returned 0x71 [0117.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.071] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb5ktiv[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.081] GetFileType (hFile=0x154) returned 0x1 [0117.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.081] GetFileType (hFile=0x154) returned 0x1 [0117.081] WriteFile (in: hFile=0x154, lpBuffer=0x1ab4be0*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ab4be0*, lpNumberOfBytesWritten=0x2ae270*=0x130, lpOverlapped=0x0) returned 1 [0117.082] CloseHandle (hObject=0x154) returned 1 [0117.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png", lpFilePart=0x0) returned 0x71 [0117.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0117.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb5ktiv[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7ea0f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7ea0f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4b8ae30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1 [0117.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.083] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB5kTiV[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb5ktiv[1].png.anonymous")) returned 1 [0117.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png", lpFilePart=0x0) returned 0x71 [0117.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.084] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb8adqn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.092] GetFileType (hFile=0x154) returned 0x1 [0117.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.092] GetFileType (hFile=0x154) returned 0x1 [0117.092] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x156 [0117.092] ReadFile (in: hFile=0x154, lpBuffer=0x1ab61d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab61d4*, lpNumberOfBytesRead=0x2ae2a8*=0x156, lpOverlapped=0x0) returned 1 [0117.134] CloseHandle (hObject=0x154) returned 1 [0117.168] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png", lpFilePart=0x0) returned 0x71 [0117.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.168] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb8adqn[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.172] GetFileType (hFile=0x154) returned 0x1 [0117.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.172] GetFileType (hFile=0x154) returned 0x1 [0117.173] WriteFile (in: hFile=0x154, lpBuffer=0x1b0482c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b0482c*, lpNumberOfBytesWritten=0x2ae270*=0x160, lpOverlapped=0x0) returned 1 [0117.177] CloseHandle (hObject=0x154) returned 1 [0117.177] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png", lpFilePart=0x0) returned 0x71 [0117.177] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0117.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.177] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb8adqn[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c340d80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c340d80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe4c6f670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1 [0117.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.177] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BB8AdqN[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bb8adqn[1].png.anonymous")) returned 1 [0117.178] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png", lpFilePart=0x0) returned 0x71 [0117.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.178] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbb9wh0[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.181] GetFileType (hFile=0x154) returned 0x1 [0117.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.181] GetFileType (hFile=0x154) returned 0x1 [0117.181] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x234 [0117.181] ReadFile (in: hFile=0x154, lpBuffer=0x1b05efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b05efc*, lpNumberOfBytesRead=0x2ae2a8*=0x234, lpOverlapped=0x0) returned 1 [0117.197] CloseHandle (hObject=0x154) returned 1 [0117.221] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png", lpFilePart=0x0) returned 0x71 [0117.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.222] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbb9wh0[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.225] GetFileType (hFile=0x154) returned 0x1 [0117.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.225] GetFileType (hFile=0x154) returned 0x1 [0117.225] WriteFile (in: hFile=0x154, lpBuffer=0x1b549b4*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b549b4*, lpNumberOfBytesWritten=0x2ae270*=0x240, lpOverlapped=0x0) returned 1 [0117.226] CloseHandle (hObject=0x154) returned 1 [0117.227] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png", lpFilePart=0x0) returned 0x71 [0117.227] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0117.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.227] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbb9wh0[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c95a5e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c95a5e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe4d07bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0117.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.227] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBB9wH0[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbb9wh0[1].png.anonymous")) returned 1 [0117.228] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg", lpFilePart=0x0) returned 0x71 [0117.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.228] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczs7[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.229] GetFileType (hFile=0x154) returned 0x1 [0117.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.229] GetFileType (hFile=0x154) returned 0x1 [0117.229] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x834 [0117.229] ReadFile (in: hFile=0x154, lpBuffer=0x1b56684, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b56684*, lpNumberOfBytesRead=0x2ae2a8*=0x834, lpOverlapped=0x0) returned 1 [0117.245] CloseHandle (hObject=0x154) returned 1 [0117.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg", lpFilePart=0x0) returned 0x71 [0117.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.297] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczs7[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.299] GetFileType (hFile=0x154) returned 0x1 [0117.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.299] GetFileType (hFile=0x154) returned 0x1 [0117.299] WriteFile (in: hFile=0x154, lpBuffer=0x19a7be4*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a7be4*, lpNumberOfBytesWritten=0x2ae270*=0x840, lpOverlapped=0x0) returned 1 [0117.301] CloseHandle (hObject=0x154) returned 1 [0117.301] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg", lpFilePart=0x0) returned 0x71 [0117.301] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczs7[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8a87d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8a87d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4da0170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x840)) returned 1 [0117.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.301] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczs7[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZS7[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczs7[1].jpg.anonymous")) returned 1 [0117.302] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg", lpFilePart=0x0) returned 0x71 [0117.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.302] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczsv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.303] GetFileType (hFile=0x154) returned 0x1 [0117.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.303] GetFileType (hFile=0x154) returned 0x1 [0117.303] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7e8 [0117.303] ReadFile (in: hFile=0x154, lpBuffer=0x19a9868, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a9868*, lpNumberOfBytesRead=0x2ae2a8*=0x7e8, lpOverlapped=0x0) returned 1 [0117.314] CloseHandle (hObject=0x154) returned 1 [0117.332] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg", lpFilePart=0x0) returned 0x71 [0117.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.332] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczsv[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.334] GetFileType (hFile=0x154) returned 0x1 [0117.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.335] GetFileType (hFile=0x154) returned 0x1 [0117.335] WriteFile (in: hFile=0x154, lpBuffer=0x19fa0e8*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19fa0e8*, lpNumberOfBytesWritten=0x2ae270*=0x7f0, lpOverlapped=0x0) returned 1 [0117.336] CloseHandle (hObject=0x154) returned 1 [0117.336] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg", lpFilePart=0x0) returned 0x71 [0117.336] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.337] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczsv[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da25590, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da25590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4e12590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7f0)) returned 1 [0117.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.337] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczsv[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBCZSv[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbczsv[1].jpg.anonymous")) returned 1 [0117.338] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg", lpFilePart=0x0) returned 0x71 [0117.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.338] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbdbjs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.339] GetFileType (hFile=0x154) returned 0x1 [0117.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.339] GetFileType (hFile=0x154) returned 0x1 [0117.339] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7eb [0117.339] ReadFile (in: hFile=0x154, lpBuffer=0x19fbd70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19fbd70*, lpNumberOfBytesRead=0x2ae2a8*=0x7eb, lpOverlapped=0x0) returned 1 [0117.341] CloseHandle (hObject=0x154) returned 1 [0117.359] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg", lpFilePart=0x0) returned 0x71 [0117.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.359] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbdbjs[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.361] GetFileType (hFile=0x154) returned 0x1 [0117.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.361] GetFileType (hFile=0x154) returned 0x1 [0117.361] WriteFile (in: hFile=0x154, lpBuffer=0x1a4c494*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a4c494*, lpNumberOfBytesWritten=0x2ae270*=0x7f0, lpOverlapped=0x0) returned 1 [0117.363] CloseHandle (hObject=0x154) returned 1 [0117.363] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg", lpFilePart=0x0) returned 0x71 [0117.363] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbdbjs[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d79de30, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d79de30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4e386f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7f0)) returned 1 [0117.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.363] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbdbjs[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBDBjs[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbdbjs[1].jpg.anonymous")) returned 1 [0117.364] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg", lpFilePart=0x0) returned 0x71 [0117.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.364] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbf6om[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.365] GetFileType (hFile=0x154) returned 0x1 [0117.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.365] GetFileType (hFile=0x154) returned 0x1 [0117.365] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x95c [0117.365] ReadFile (in: hFile=0x154, lpBuffer=0x1a4e28c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4e28c*, lpNumberOfBytesRead=0x2ae2a8*=0x95c, lpOverlapped=0x0) returned 1 [0117.392] CloseHandle (hObject=0x154) returned 1 [0117.410] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg", lpFilePart=0x0) returned 0x71 [0117.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.411] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbf6om[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.412] GetFileType (hFile=0x154) returned 0x1 [0117.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.413] GetFileType (hFile=0x154) returned 0x1 [0117.413] WriteFile (in: hFile=0x154, lpBuffer=0x1a9f0dc*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a9f0dc*, lpNumberOfBytesWritten=0x2ae270*=0x960, lpOverlapped=0x0) returned 1 [0117.414] CloseHandle (hObject=0x154) returned 1 [0117.414] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg", lpFilePart=0x0) returned 0x71 [0117.414] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbf6om[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8363b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8363b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4ed0c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x960)) returned 1 [0117.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.415] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbf6om[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBF6OM[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbf6om[1].jpg.anonymous")) returned 1 [0117.416] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg", lpFilePart=0x0) returned 0x71 [0117.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.416] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfrg0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.417] GetFileType (hFile=0x154) returned 0x1 [0117.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.417] GetFileType (hFile=0x154) returned 0x1 [0117.417] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x71c [0117.417] ReadFile (in: hFile=0x154, lpBuffer=0x1aa0c94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa0c94*, lpNumberOfBytesRead=0x2ae2a8*=0x71c, lpOverlapped=0x0) returned 1 [0117.419] CloseHandle (hObject=0x154) returned 1 [0117.438] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg", lpFilePart=0x0) returned 0x71 [0117.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.438] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfrg0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.440] GetFileType (hFile=0x154) returned 0x1 [0117.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.440] GetFileType (hFile=0x154) returned 0x1 [0117.441] WriteFile (in: hFile=0x154, lpBuffer=0x1af0fa4*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1af0fa4*, lpNumberOfBytesWritten=0x2ae270*=0x720, lpOverlapped=0x0) returned 1 [0117.442] CloseHandle (hObject=0x154) returned 1 [0117.442] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg", lpFilePart=0x0) returned 0x71 [0117.442] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfrg0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d85c510, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d85c510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4ef6dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x720)) returned 1 [0117.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.442] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfrg0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFRG0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfrg0[1].jpg.anonymous")) returned 1 [0117.444] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg", lpFilePart=0x0) returned 0x71 [0117.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.444] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfszx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.445] GetFileType (hFile=0x154) returned 0x1 [0117.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.445] GetFileType (hFile=0x154) returned 0x1 [0117.445] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x886 [0117.445] ReadFile (in: hFile=0x154, lpBuffer=0x1af2cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af2cc8*, lpNumberOfBytesRead=0x2ae2a8*=0x886, lpOverlapped=0x0) returned 1 [0117.454] CloseHandle (hObject=0x154) returned 1 [0117.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg", lpFilePart=0x0) returned 0x71 [0117.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.471] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfszx[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.473] GetFileType (hFile=0x154) returned 0x1 [0117.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.473] GetFileType (hFile=0x154) returned 0x1 [0117.474] WriteFile (in: hFile=0x154, lpBuffer=0x1b43710*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b43710*, lpNumberOfBytesWritten=0x2ae270*=0x890, lpOverlapped=0x0) returned 1 [0117.475] CloseHandle (hObject=0x154) returned 1 [0117.475] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg", lpFilePart=0x0) returned 0x71 [0117.475] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfszx[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x778d9250, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x778d9250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe4f691f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x890)) returned 1 [0117.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.476] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfszx[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFSZx[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfszx[1].jpg.anonymous")) returned 1 [0117.477] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg", lpFilePart=0x0) returned 0x71 [0117.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.477] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfzsx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.477] GetFileType (hFile=0x154) returned 0x1 [0117.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.477] GetFileType (hFile=0x154) returned 0x1 [0117.477] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x33b2 [0117.477] ReadFile (in: hFile=0x154, lpBuffer=0x1b44ba0, nNumberOfBytesToRead=0x33b2, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b44ba0*, lpNumberOfBytesRead=0x2ae2a8*=0x33b2, lpOverlapped=0x0) returned 1 [0117.497] CloseHandle (hObject=0x154) returned 1 [0117.550] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg", lpFilePart=0x0) returned 0x71 [0117.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.551] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfzsx[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.552] GetFileType (hFile=0x154) returned 0x1 [0117.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.552] GetFileType (hFile=0x154) returned 0x1 [0117.553] WriteFile (in: hFile=0x154, lpBuffer=0x19a6510*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19a6510*, lpNumberOfBytesWritten=0x2ae29c*=0x33c0, lpOverlapped=0x0) returned 1 [0117.554] CloseHandle (hObject=0x154) returned 1 [0117.554] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg", lpFilePart=0x0) returned 0x71 [0117.554] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfzsx[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da979b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da979b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe50278d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x33c0)) returned 1 [0117.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.554] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfzsx[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBFZSx[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbfzsx[1].jpg.anonymous")) returned 1 [0117.555] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg", lpFilePart=0x0) returned 0x71 [0117.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.555] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbgufy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.555] GetFileType (hFile=0x154) returned 0x1 [0117.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.555] GetFileType (hFile=0x154) returned 0x1 [0117.555] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1f67 [0117.555] ReadFile (in: hFile=0x154, lpBuffer=0x19a9ed8, nNumberOfBytesToRead=0x1f67, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a9ed8*, lpNumberOfBytesRead=0x2ae2a8*=0x1f67, lpOverlapped=0x0) returned 1 [0117.608] CloseHandle (hObject=0x154) returned 1 [0117.622] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg", lpFilePart=0x0) returned 0x71 [0117.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.623] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbgufy[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.624] GetFileType (hFile=0x154) returned 0x1 [0117.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.624] GetFileType (hFile=0x154) returned 0x1 [0117.624] WriteFile (in: hFile=0x154, lpBuffer=0x1a00b50*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a00b50*, lpNumberOfBytesWritten=0x2ae29c*=0x1f70, lpOverlapped=0x0) returned 1 [0117.626] CloseHandle (hObject=0x154) returned 1 [0117.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg", lpFilePart=0x0) returned 0x71 [0117.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbgufy[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bfa70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d3bfa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe50bfe50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f70)) returned 1 [0117.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.626] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbgufy[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBGUfy[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbgufy[1].jpg.anonymous")) returned 1 [0117.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg", lpFilePart=0x0) returned 0x71 [0117.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.627] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbhqva[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.627] GetFileType (hFile=0x154) returned 0x1 [0117.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.627] GetFileType (hFile=0x154) returned 0x1 [0117.627] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x5cf [0117.627] ReadFile (in: hFile=0x154, lpBuffer=0x1a036a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a036a4*, lpNumberOfBytesRead=0x2ae2a8*=0x5cf, lpOverlapped=0x0) returned 1 [0117.629] CloseHandle (hObject=0x154) returned 1 [0117.643] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg", lpFilePart=0x0) returned 0x71 [0117.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.643] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbhqva[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.645] GetFileType (hFile=0x154) returned 0x1 [0117.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.645] GetFileType (hFile=0x154) returned 0x1 [0117.645] WriteFile (in: hFile=0x154, lpBuffer=0x1a53324*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a53324*, lpNumberOfBytesWritten=0x2ae270*=0x5d0, lpOverlapped=0x0) returned 1 [0117.646] CloseHandle (hObject=0x154) returned 1 [0117.646] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg", lpFilePart=0x0) returned 0x71 [0117.646] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbhqva[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77997930, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x77997930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe510c110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5d0)) returned 1 [0117.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.647] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbhqva[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBHQvA[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbhqva[1].jpg.anonymous")) returned 1 [0117.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg", lpFilePart=0x0) returned 0x71 [0117.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.647] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbibdo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.648] GetFileType (hFile=0x154) returned 0x1 [0117.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.648] GetFileType (hFile=0x154) returned 0x1 [0117.648] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9a3 [0117.648] ReadFile (in: hFile=0x154, lpBuffer=0x1a55164, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a55164*, lpNumberOfBytesRead=0x2ae2a8*=0x9a3, lpOverlapped=0x0) returned 1 [0117.672] CloseHandle (hObject=0x154) returned 1 [0117.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg", lpFilePart=0x0) returned 0x71 [0117.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.690] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbibdo[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.693] GetFileType (hFile=0x154) returned 0x1 [0117.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.693] GetFileType (hFile=0x154) returned 0x1 [0117.693] WriteFile (in: hFile=0x154, lpBuffer=0x1aa6150*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa6150*, lpNumberOfBytesWritten=0x2ae270*=0x9b0, lpOverlapped=0x0) returned 1 [0117.695] CloseHandle (hObject=0x154) returned 1 [0117.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg", lpFilePart=0x0) returned 0x71 [0117.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbibdo[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d966eb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d966eb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe517e530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0117.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.696] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbibdo[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIBdo[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbibdo[1].jpg.anonymous")) returned 1 [0117.697] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg", lpFilePart=0x0) returned 0x71 [0117.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.697] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbic61[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.697] GetFileType (hFile=0x154) returned 0x1 [0117.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.698] GetFileType (hFile=0x154) returned 0x1 [0117.698] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa98 [0117.698] ReadFile (in: hFile=0x154, lpBuffer=0x1aa8084, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa8084*, lpNumberOfBytesRead=0x2ae2a8*=0xa98, lpOverlapped=0x0) returned 1 [0117.701] CloseHandle (hObject=0x154) returned 1 [0117.717] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg", lpFilePart=0x0) returned 0x71 [0117.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.717] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbic61[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.719] GetFileType (hFile=0x154) returned 0x1 [0117.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.719] GetFileType (hFile=0x154) returned 0x1 [0117.719] WriteFile (in: hFile=0x154, lpBuffer=0x1af9518*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1af9518*, lpNumberOfBytesWritten=0x2ae270*=0xaa0, lpOverlapped=0x0) returned 1 [0117.721] CloseHandle (hObject=0x154) returned 1 [0117.721] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg", lpFilePart=0x0) returned 0x71 [0117.721] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbic61[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9ff430, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9ff430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe51a4690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaa0)) returned 1 [0117.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.722] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbic61[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIC61[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbic61[1].jpg.anonymous")) returned 1 [0117.723] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg", lpFilePart=0x0) returned 0x71 [0117.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.723] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiddj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.724] GetFileType (hFile=0x154) returned 0x1 [0117.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.724] GetFileType (hFile=0x154) returned 0x1 [0117.724] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x6a7 [0117.724] ReadFile (in: hFile=0x154, lpBuffer=0x1afb05c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1afb05c*, lpNumberOfBytesRead=0x2ae2a8*=0x6a7, lpOverlapped=0x0) returned 1 [0117.740] CloseHandle (hObject=0x154) returned 1 [0117.761] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg", lpFilePart=0x0) returned 0x71 [0117.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.761] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiddj[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.763] GetFileType (hFile=0x154) returned 0x1 [0117.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.763] GetFileType (hFile=0x154) returned 0x1 [0117.763] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b144*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b4b144*, lpNumberOfBytesWritten=0x2ae270*=0x6b0, lpOverlapped=0x0) returned 1 [0117.765] CloseHandle (hObject=0x154) returned 1 [0117.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg", lpFilePart=0x0) returned 0x71 [0117.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiddj[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6df750, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6df750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5216ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6b0)) returned 1 [0117.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.765] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiddj[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIDdj[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiddj[1].jpg.anonymous")) returned 1 [0117.766] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg", lpFilePart=0x0) returned 0x71 [0117.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.766] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbifdw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.766] GetFileType (hFile=0x154) returned 0x1 [0117.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.766] GetFileType (hFile=0x154) returned 0x1 [0117.767] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1626 [0117.767] ReadFile (in: hFile=0x154, lpBuffer=0x1b4c5d4, nNumberOfBytesToRead=0x1626, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b4c5d4*, lpNumberOfBytesRead=0x2ae2a8*=0x1626, lpOverlapped=0x0) returned 1 [0117.782] CloseHandle (hObject=0x154) returned 1 [0117.838] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg", lpFilePart=0x0) returned 0x71 [0117.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.838] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbifdw[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.841] GetFileType (hFile=0x154) returned 0x1 [0117.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.841] GetFileType (hFile=0x154) returned 0x1 [0117.841] WriteFile (in: hFile=0x154, lpBuffer=0x19a84ec*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19a84ec*, lpNumberOfBytesWritten=0x2ae29c*=0x1630, lpOverlapped=0x0) returned 1 [0117.843] CloseHandle (hObject=0x154) returned 1 [0117.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg", lpFilePart=0x0) returned 0x71 [0117.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbifdw[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x773f04f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x773f04f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe52d5190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1630)) returned 1 [0117.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.843] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbifdw[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFdW[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbifdw[1].jpg.anonymous")) returned 1 [0117.845] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg", lpFilePart=0x0) returned 0x71 [0117.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.845] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiflm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.846] GetFileType (hFile=0x154) returned 0x1 [0117.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.846] GetFileType (hFile=0x154) returned 0x1 [0117.846] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa68 [0117.846] ReadFile (in: hFile=0x154, lpBuffer=0x19aab98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19aab98*, lpNumberOfBytesRead=0x2ae2a8*=0xa68, lpOverlapped=0x0) returned 1 [0117.849] CloseHandle (hObject=0x154) returned 1 [0117.869] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg", lpFilePart=0x0) returned 0x71 [0117.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.870] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiflm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.871] GetFileType (hFile=0x154) returned 0x1 [0117.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.871] GetFileType (hFile=0x154) returned 0x1 [0117.871] WriteFile (in: hFile=0x154, lpBuffer=0x19fc098*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19fc098*, lpNumberOfBytesWritten=0x2ae270*=0xa70, lpOverlapped=0x0) returned 1 [0117.873] CloseHandle (hObject=0x154) returned 1 [0117.873] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg", lpFilePart=0x0) returned 0x71 [0117.873] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiflm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9d92d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9d92d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5321450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa70)) returned 1 [0117.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.874] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiflm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIFLM[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiflm[1].jpg.anonymous")) returned 1 [0117.875] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg", lpFilePart=0x0) returned 0x71 [0117.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.875] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbihlr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.875] GetFileType (hFile=0x154) returned 0x1 [0117.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.875] GetFileType (hFile=0x154) returned 0x1 [0117.875] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x76f [0117.875] ReadFile (in: hFile=0x154, lpBuffer=0x19fdca4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19fdca4*, lpNumberOfBytesRead=0x2ae2a8*=0x76f, lpOverlapped=0x0) returned 1 [0117.878] CloseHandle (hObject=0x154) returned 1 [0117.914] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg", lpFilePart=0x0) returned 0x71 [0117.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.914] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbihlr[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.916] GetFileType (hFile=0x154) returned 0x1 [0117.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.916] GetFileType (hFile=0x154) returned 0x1 [0117.916] WriteFile (in: hFile=0x154, lpBuffer=0x1a4e144*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a4e144*, lpNumberOfBytesWritten=0x2ae270*=0x770, lpOverlapped=0x0) returned 1 [0117.918] CloseHandle (hObject=0x154) returned 1 [0117.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg", lpFilePart=0x0) returned 0x71 [0117.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbihlr[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6df750, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6df750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5393870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x770)) returned 1 [0117.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.918] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbihlr[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIHLr[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbihlr[1].jpg.anonymous")) returned 1 [0117.919] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg", lpFilePart=0x0) returned 0x71 [0117.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.919] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbijmg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.920] GetFileType (hFile=0x154) returned 0x1 [0117.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.920] GetFileType (hFile=0x154) returned 0x1 [0117.920] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x13e7 [0117.920] ReadFile (in: hFile=0x154, lpBuffer=0x1a4f5d4, nNumberOfBytesToRead=0x13e7, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4f5d4*, lpNumberOfBytesRead=0x2ae2a8*=0x13e7, lpOverlapped=0x0) returned 1 [0117.922] CloseHandle (hObject=0x154) returned 1 [0117.939] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg", lpFilePart=0x0) returned 0x71 [0117.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.939] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbijmg[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.941] GetFileType (hFile=0x154) returned 0x1 [0117.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.941] GetFileType (hFile=0x154) returned 0x1 [0117.941] WriteFile (in: hFile=0x154, lpBuffer=0x1aa2770*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1aa2770*, lpNumberOfBytesWritten=0x2ae29c*=0x13f0, lpOverlapped=0x0) returned 1 [0117.943] CloseHandle (hObject=0x154) returned 1 [0117.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg", lpFilePart=0x0) returned 0x71 [0117.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.943] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbijmg[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4a42b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d4a42b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe53dfb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13f0)) returned 1 [0117.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.943] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbijmg[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIJMg[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbijmg[1].jpg.anonymous")) returned 1 [0117.944] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg", lpFilePart=0x0) returned 0x71 [0117.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.944] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbikc3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.944] GetFileType (hFile=0x154) returned 0x1 [0117.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.944] GetFileType (hFile=0x154) returned 0x1 [0117.944] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x261f [0117.944] ReadFile (in: hFile=0x154, lpBuffer=0x1aa4168, nNumberOfBytesToRead=0x261f, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa4168*, lpNumberOfBytesRead=0x2ae2a8*=0x261f, lpOverlapped=0x0) returned 1 [0117.946] CloseHandle (hObject=0x154) returned 1 [0117.960] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg", lpFilePart=0x0) returned 0x71 [0117.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0117.960] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbikc3[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.962] GetFileType (hFile=0x154) returned 0x1 [0117.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0117.962] GetFileType (hFile=0x154) returned 0x1 [0117.962] WriteFile (in: hFile=0x154, lpBuffer=0x1afcdf4*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1afcdf4*, lpNumberOfBytesWritten=0x2ae29c*=0x2620, lpOverlapped=0x0) returned 1 [0117.964] CloseHandle (hObject=0x154) returned 1 [0117.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg", lpFilePart=0x0) returned 0x71 [0117.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0117.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0117.964] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbikc3[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8a87d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8a87d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5405c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2620)) returned 1 [0117.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0117.965] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbikc3[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIkc3[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbikc3[1].jpg.anonymous")) returned 1 [0117.965] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg", lpFilePart=0x0) returned 0x71 [0117.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0117.965] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbilr0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0117.966] GetFileType (hFile=0x154) returned 0x1 [0117.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0117.966] GetFileType (hFile=0x154) returned 0x1 [0117.966] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3637 [0117.966] ReadFile (in: hFile=0x154, lpBuffer=0x1affa1c, nNumberOfBytesToRead=0x3637, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1affa1c*, lpNumberOfBytesRead=0x2ae2a8*=0x3637, lpOverlapped=0x0) returned 1 [0117.976] CloseHandle (hObject=0x154) returned 1 [0118.025] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg", lpFilePart=0x0) returned 0x71 [0118.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.025] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbilr0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.027] GetFileType (hFile=0x154) returned 0x1 [0118.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.027] GetFileType (hFile=0x154) returned 0x1 [0118.027] WriteFile (in: hFile=0x154, lpBuffer=0x1b5d748*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b5d748*, lpNumberOfBytesWritten=0x2ae29c*=0x3640, lpOverlapped=0x0) returned 1 [0118.029] CloseHandle (hObject=0x154) returned 1 [0118.032] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg", lpFilePart=0x0) returned 0x71 [0118.033] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbilr0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d85c510, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d85c510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe549e210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3640)) returned 1 [0118.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.033] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbilr0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIlR0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbilr0[1].jpg.anonymous")) returned 1 [0118.034] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg", lpFilePart=0x0) returned 0x71 [0118.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.035] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbimgi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.035] GetFileType (hFile=0x154) returned 0x1 [0118.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.035] GetFileType (hFile=0x154) returned 0x1 [0118.035] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x5a1 [0118.035] ReadFile (in: hFile=0x154, lpBuffer=0x1b61940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b61940*, lpNumberOfBytesRead=0x2ae2a8*=0x5a1, lpOverlapped=0x0) returned 1 [0118.081] CloseHandle (hObject=0x154) returned 1 [0118.132] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg", lpFilePart=0x0) returned 0x71 [0118.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.133] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbimgi[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.134] GetFileType (hFile=0x154) returned 0x1 [0118.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.135] GetFileType (hFile=0x154) returned 0x1 [0118.135] WriteFile (in: hFile=0x154, lpBuffer=0x19b4bcc*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19b4bcc*, lpNumberOfBytesWritten=0x2ae270*=0x5b0, lpOverlapped=0x0) returned 1 [0118.136] CloseHandle (hObject=0x154) returned 1 [0118.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg", lpFilePart=0x0) returned 0x71 [0118.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbimgi[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x778b30f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x778b30f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe55a8bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0118.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.137] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbimgi[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBImGI[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbimgi[1].jpg.anonymous")) returned 1 [0118.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg", lpFilePart=0x0) returned 0x71 [0118.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.138] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiofn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.140] GetFileType (hFile=0x154) returned 0x1 [0118.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.140] GetFileType (hFile=0x154) returned 0x1 [0118.140] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x190e [0118.140] ReadFile (in: hFile=0x154, lpBuffer=0x19b605c, nNumberOfBytesToRead=0x190e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b605c*, lpNumberOfBytesRead=0x2ae2a8*=0x190e, lpOverlapped=0x0) returned 1 [0118.155] CloseHandle (hObject=0x154) returned 1 [0118.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg", lpFilePart=0x0) returned 0x71 [0118.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.175] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiofn[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.177] GetFileType (hFile=0x154) returned 0x1 [0118.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.177] GetFileType (hFile=0x154) returned 0x1 [0118.177] WriteFile (in: hFile=0x154, lpBuffer=0x1a0acf4*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a0acf4*, lpNumberOfBytesWritten=0x2ae29c*=0x1910, lpOverlapped=0x0) returned 1 [0118.179] CloseHandle (hObject=0x154) returned 1 [0118.179] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg", lpFilePart=0x0) returned 0x71 [0118.179] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiofn[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d98d010, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d98d010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe561afd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1910)) returned 1 [0118.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.180] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiofn[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIoFN[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiofn[1].jpg.anonymous")) returned 1 [0118.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg", lpFilePart=0x0) returned 0x71 [0118.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.181] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbipnb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.182] GetFileType (hFile=0x154) returned 0x1 [0118.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.183] GetFileType (hFile=0x154) returned 0x1 [0118.183] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x89e [0118.183] ReadFile (in: hFile=0x154, lpBuffer=0x1a0d4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a0d4b8*, lpNumberOfBytesRead=0x2ae2a8*=0x89e, lpOverlapped=0x0) returned 1 [0118.185] CloseHandle (hObject=0x154) returned 1 [0118.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg", lpFilePart=0x0) returned 0x71 [0118.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.200] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbipnb[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.202] GetFileType (hFile=0x154) returned 0x1 [0118.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.202] GetFileType (hFile=0x154) returned 0x1 [0118.202] WriteFile (in: hFile=0x154, lpBuffer=0x1a5df48*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a5df48*, lpNumberOfBytesWritten=0x2ae270*=0x8a0, lpOverlapped=0x0) returned 1 [0118.203] CloseHandle (hObject=0x154) returned 1 [0118.203] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg", lpFilePart=0x0) returned 0x71 [0118.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbipnb[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6b95f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6b95f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5641130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8a0)) returned 1 [0118.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.204] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbipnb[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIpnb[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbipnb[1].jpg.anonymous")) returned 1 [0118.205] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg", lpFilePart=0x0) returned 0x71 [0118.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.205] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbivwr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.205] GetFileType (hFile=0x154) returned 0x1 [0118.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.206] GetFileType (hFile=0x154) returned 0x1 [0118.206] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x284a [0118.206] ReadFile (in: hFile=0x154, lpBuffer=0x1a5f3d8, nNumberOfBytesToRead=0x284a, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a5f3d8*, lpNumberOfBytesRead=0x2ae2a8*=0x284a, lpOverlapped=0x0) returned 1 [0118.208] CloseHandle (hObject=0x154) returned 1 [0118.226] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg", lpFilePart=0x0) returned 0x71 [0118.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.226] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbivwr[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.229] GetFileType (hFile=0x154) returned 0x1 [0118.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.229] GetFileType (hFile=0x154) returned 0x1 [0118.229] WriteFile (in: hFile=0x154, lpBuffer=0x1ab8b54*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ab8b54*, lpNumberOfBytesWritten=0x2ae29c*=0x2850, lpOverlapped=0x0) returned 1 [0118.230] CloseHandle (hObject=0x154) returned 1 [0118.231] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg", lpFilePart=0x0) returned 0x71 [0118.231] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbivwr[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da4b6f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da4b6f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe568d3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2850)) returned 1 [0118.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.231] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbivwr[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIvWr[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbivwr[1].jpg.anonymous")) returned 1 [0118.235] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg", lpFilePart=0x0) returned 0x71 [0118.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.235] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbixq7[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.235] GetFileType (hFile=0x154) returned 0x1 [0118.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.235] GetFileType (hFile=0x154) returned 0x1 [0118.235] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9ac [0118.235] ReadFile (in: hFile=0x154, lpBuffer=0x1abc364, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1abc364*, lpNumberOfBytesRead=0x2ae2a8*=0x9ac, lpOverlapped=0x0) returned 1 [0118.237] CloseHandle (hObject=0x154) returned 1 [0118.252] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg", lpFilePart=0x0) returned 0x71 [0118.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.252] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbixq7[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.254] GetFileType (hFile=0x154) returned 0x1 [0118.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.254] GetFileType (hFile=0x154) returned 0x1 [0118.254] WriteFile (in: hFile=0x154, lpBuffer=0x1b0d344*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b0d344*, lpNumberOfBytesWritten=0x2ae270*=0x9b0, lpOverlapped=0x0) returned 1 [0118.255] CloseHandle (hObject=0x154) returned 1 [0118.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg", lpFilePart=0x0) returned 0x71 [0118.256] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbixq7[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d72ba10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d72ba10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe56d96b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0118.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.256] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbixq7[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIXQ7[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbixq7[1].jpg.anonymous")) returned 1 [0118.257] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg", lpFilePart=0x0) returned 0x71 [0118.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.257] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiyvz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.258] GetFileType (hFile=0x154) returned 0x1 [0118.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.258] GetFileType (hFile=0x154) returned 0x1 [0118.258] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x765 [0118.258] ReadFile (in: hFile=0x154, lpBuffer=0x1b0ef48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b0ef48*, lpNumberOfBytesRead=0x2ae2a8*=0x765, lpOverlapped=0x0) returned 1 [0118.261] CloseHandle (hObject=0x154) returned 1 [0118.274] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg", lpFilePart=0x0) returned 0x71 [0118.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.274] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiyvz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.275] GetFileType (hFile=0x154) returned 0x1 [0118.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.275] GetFileType (hFile=0x154) returned 0x1 [0118.275] WriteFile (in: hFile=0x154, lpBuffer=0x1b5f3f0*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b5f3f0*, lpNumberOfBytesWritten=0x2ae270*=0x770, lpOverlapped=0x0) returned 1 [0118.276] CloseHandle (hObject=0x154) returned 1 [0118.276] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg", lpFilePart=0x0) returned 0x71 [0118.277] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiyvz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da979b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da979b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe56ff810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x770)) returned 1 [0118.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.277] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiyvz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIyvz[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbiyvz[1].jpg.anonymous")) returned 1 [0118.277] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg", lpFilePart=0x0) returned 0x71 [0118.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.277] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbizny[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.278] GetFileType (hFile=0x154) returned 0x1 [0118.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.278] GetFileType (hFile=0x154) returned 0x1 [0118.278] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2903 [0118.278] ReadFile (in: hFile=0x154, lpBuffer=0x1b60880, nNumberOfBytesToRead=0x2903, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b60880*, lpNumberOfBytesRead=0x2ae2a8*=0x2903, lpOverlapped=0x0) returned 1 [0118.280] CloseHandle (hObject=0x154) returned 1 [0118.319] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg", lpFilePart=0x0) returned 0x71 [0118.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.319] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbizny[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.321] GetFileType (hFile=0x154) returned 0x1 [0118.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.321] GetFileType (hFile=0x154) returned 0x1 [0118.321] WriteFile (in: hFile=0x154, lpBuffer=0x19bdca4*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19bdca4*, lpNumberOfBytesWritten=0x2ae29c*=0x2910, lpOverlapped=0x0) returned 1 [0118.322] CloseHandle (hObject=0x154) returned 1 [0118.322] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg", lpFilePart=0x0) returned 0x71 [0118.322] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbizny[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7dabdb10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7dabdb10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5771c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2910)) returned 1 [0118.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.322] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbizny[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBBIZny[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbizny[1].jpg.anonymous")) returned 1 [0118.323] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg", lpFilePart=0x0) returned 0x71 [0118.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.323] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbyxe9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.324] GetFileType (hFile=0x154) returned 0x1 [0118.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.324] GetFileType (hFile=0x154) returned 0x1 [0118.324] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2369 [0118.324] ReadFile (in: hFile=0x154, lpBuffer=0x19c0bbc, nNumberOfBytesToRead=0x2369, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19c0bbc*, lpNumberOfBytesRead=0x2ae2a8*=0x2369, lpOverlapped=0x0) returned 1 [0118.326] CloseHandle (hObject=0x154) returned 1 [0118.339] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg", lpFilePart=0x0) returned 0x71 [0118.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.339] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbyxe9[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.340] GetFileType (hFile=0x154) returned 0x1 [0118.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.340] GetFileType (hFile=0x154) returned 0x1 [0118.340] WriteFile (in: hFile=0x154, lpBuffer=0x1a18c34*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a18c34*, lpNumberOfBytesWritten=0x2ae29c*=0x2370, lpOverlapped=0x0) returned 1 [0118.341] CloseHandle (hObject=0x154) returned 1 [0118.342] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg", lpFilePart=0x0) returned 0x71 [0118.342] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbyxe9[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9b3170, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9b3170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe5797d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2370)) returned 1 [0118.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.342] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbyxe9[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBByXE9[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbbyxe9[1].jpg.anonymous")) returned 1 [0118.343] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg", lpFilePart=0x0) returned 0x71 [0118.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.343] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbde29t[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.344] GetFileType (hFile=0x154) returned 0x1 [0118.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.344] GetFileType (hFile=0x154) returned 0x1 [0118.344] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x27fa [0118.344] ReadFile (in: hFile=0x154, lpBuffer=0x1a1b5ac, nNumberOfBytesToRead=0x27fa, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a1b5ac*, lpNumberOfBytesRead=0x2ae2a8*=0x27fa, lpOverlapped=0x0) returned 1 [0118.362] CloseHandle (hObject=0x154) returned 1 [0118.374] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg", lpFilePart=0x0) returned 0x71 [0118.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.374] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbde29t[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.376] GetFileType (hFile=0x154) returned 0x1 [0118.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.376] GetFileType (hFile=0x154) returned 0x1 [0118.376] WriteFile (in: hFile=0x154, lpBuffer=0x1a74b98*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a74b98*, lpNumberOfBytesWritten=0x2ae29c*=0x2800, lpOverlapped=0x0) returned 1 [0118.377] CloseHandle (hObject=0x154) returned 1 [0118.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg", lpFilePart=0x0) returned 0x71 [0118.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbde29t[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c934480, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c934480, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe57e4050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1 [0118.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.377] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbde29t[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDE29T[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbde29t[1].jpg.anonymous")) returned 1 [0118.378] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg", lpFilePart=0x0) returned 0x71 [0118.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.378] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdebhy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.379] GetFileType (hFile=0x154) returned 0x1 [0118.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.379] GetFileType (hFile=0x154) returned 0x1 [0118.379] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x731 [0118.379] ReadFile (in: hFile=0x154, lpBuffer=0x1a780e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a780e0*, lpNumberOfBytesRead=0x2ae2a8*=0x731, lpOverlapped=0x0) returned 1 [0118.424] CloseHandle (hObject=0x154) returned 1 [0118.436] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg", lpFilePart=0x0) returned 0x71 [0118.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.436] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdebhy[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.438] GetFileType (hFile=0x154) returned 0x1 [0118.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.438] GetFileType (hFile=0x154) returned 0x1 [0118.438] WriteFile (in: hFile=0x154, lpBuffer=0x1ac849c*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ac849c*, lpNumberOfBytesWritten=0x2ae270*=0x740, lpOverlapped=0x0) returned 1 [0118.439] CloseHandle (hObject=0x154) returned 1 [0118.439] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg", lpFilePart=0x0) returned 0x71 [0118.439] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdebhy[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc54160, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc54160, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe587c5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x740)) returned 1 [0118.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.439] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdebhy[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEBhY[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdebhy[1].jpg.anonymous")) returned 1 [0118.440] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg", lpFilePart=0x0) returned 0x71 [0118.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.440] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdeop9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.461] GetFileType (hFile=0x154) returned 0x1 [0118.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.461] GetFileType (hFile=0x154) returned 0x1 [0118.461] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2335 [0118.461] ReadFile (in: hFile=0x154, lpBuffer=0x1ac992c, nNumberOfBytesToRead=0x2335, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ac992c*, lpNumberOfBytesRead=0x2ae2a8*=0x2335, lpOverlapped=0x0) returned 1 [0118.482] CloseHandle (hObject=0x154) returned 1 [0118.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg", lpFilePart=0x0) returned 0x71 [0118.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.495] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdeop9[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.496] GetFileType (hFile=0x154) returned 0x1 [0118.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.496] GetFileType (hFile=0x154) returned 0x1 [0118.497] WriteFile (in: hFile=0x154, lpBuffer=0x1b21758*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b21758*, lpNumberOfBytesWritten=0x2ae29c*=0x2340, lpOverlapped=0x0) returned 1 [0118.498] CloseHandle (hObject=0x154) returned 1 [0118.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg", lpFilePart=0x0) returned 0x71 [0118.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdeop9[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5a2380, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5a2380, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5914b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2340)) returned 1 [0118.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.498] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdeop9[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDEop9[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdeop9[1].jpg.anonymous")) returned 1 [0118.499] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg", lpFilePart=0x0) returned 0x71 [0118.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.499] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfk8w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.626] GetFileType (hFile=0x154) returned 0x1 [0118.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.626] GetFileType (hFile=0x154) returned 0x1 [0118.626] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2536 [0118.626] ReadFile (in: hFile=0x154, lpBuffer=0x1b240a0, nNumberOfBytesToRead=0x2536, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b240a0*, lpNumberOfBytesRead=0x2ae2a8*=0x2536, lpOverlapped=0x0) returned 1 [0118.653] CloseHandle (hObject=0x154) returned 1 [0118.666] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg", lpFilePart=0x0) returned 0x71 [0118.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.666] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfk8w[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.667] GetFileType (hFile=0x154) returned 0x1 [0118.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.667] GetFileType (hFile=0x154) returned 0x1 [0118.668] WriteFile (in: hFile=0x154, lpBuffer=0x1b7c8cc*, nNumberOfBytesToWrite=0x2540, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b7c8cc*, lpNumberOfBytesWritten=0x2ae29c*=0x2540, lpOverlapped=0x0) returned 1 [0118.669] CloseHandle (hObject=0x154) returned 1 [0118.669] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg", lpFilePart=0x0) returned 0x71 [0118.669] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfk8w[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4979e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4979e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5ab7a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2540)) returned 1 [0118.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.669] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfk8w[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFK8W[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfk8w[1].jpg.anonymous")) returned 1 [0118.670] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg", lpFilePart=0x0) returned 0x71 [0118.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.670] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfqfk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.671] GetFileType (hFile=0x154) returned 0x1 [0118.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.671] GetFileType (hFile=0x154) returned 0x1 [0118.671] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2cb8 [0118.671] ReadFile (in: hFile=0x154, lpBuffer=0x1b7f414, nNumberOfBytesToRead=0x2cb8, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b7f414*, lpNumberOfBytesRead=0x2ae2a8*=0x2cb8, lpOverlapped=0x0) returned 1 [0118.705] CloseHandle (hObject=0x154) returned 1 [0118.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg", lpFilePart=0x0) returned 0x71 [0118.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.744] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfqfk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.748] GetFileType (hFile=0x154) returned 0x1 [0118.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.748] GetFileType (hFile=0x154) returned 0x1 [0118.748] WriteFile (in: hFile=0x154, lpBuffer=0x19da578*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19da578*, lpNumberOfBytesWritten=0x2ae29c*=0x2cc0, lpOverlapped=0x0) returned 1 [0118.750] CloseHandle (hObject=0x154) returned 1 [0118.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg", lpFilePart=0x0) returned 0x71 [0118.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.750] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfqfk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8067fb00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x8067fb00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5b76150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2cc0)) returned 1 [0118.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.750] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfqfk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDFqfK[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdfqfk[1].jpg.anonymous")) returned 1 [0118.751] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg", lpFilePart=0x0) returned 0x71 [0118.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.751] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdk6de[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.752] GetFileType (hFile=0x154) returned 0x1 [0118.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.752] GetFileType (hFile=0x154) returned 0x1 [0118.752] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x27cc [0118.752] ReadFile (in: hFile=0x154, lpBuffer=0x19dd840, nNumberOfBytesToRead=0x27cc, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19dd840*, lpNumberOfBytesRead=0x2ae2a8*=0x27cc, lpOverlapped=0x0) returned 1 [0118.765] CloseHandle (hObject=0x154) returned 1 [0118.785] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg", lpFilePart=0x0) returned 0x71 [0118.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.785] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdk6de[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.787] GetFileType (hFile=0x154) returned 0x1 [0118.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.787] GetFileType (hFile=0x154) returned 0x1 [0118.787] WriteFile (in: hFile=0x154, lpBuffer=0x1a36e94*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a36e94*, lpNumberOfBytesWritten=0x2ae29c*=0x27d0, lpOverlapped=0x0) returned 1 [0118.789] CloseHandle (hObject=0x154) returned 1 [0118.789] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg", lpFilePart=0x0) returned 0x71 [0118.789] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdk6de[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5a2380, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5a2380, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5be8570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27d0)) returned 1 [0118.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.790] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdk6de[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDK6DE[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdk6de[1].jpg.anonymous")) returned 1 [0118.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg", lpFilePart=0x0) returned 0x71 [0118.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.790] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdko2p[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.805] GetFileType (hFile=0x154) returned 0x1 [0118.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.805] GetFileType (hFile=0x154) returned 0x1 [0118.805] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x8ab [0118.805] ReadFile (in: hFile=0x154, lpBuffer=0x1a3a524, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a3a524*, lpNumberOfBytesRead=0x2ae2a8*=0x8ab, lpOverlapped=0x0) returned 1 [0118.811] CloseHandle (hObject=0x154) returned 1 [0118.829] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg", lpFilePart=0x0) returned 0x71 [0118.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.829] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdko2p[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.832] GetFileType (hFile=0x154) returned 0x1 [0118.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.832] GetFileType (hFile=0x154) returned 0x1 [0118.832] WriteFile (in: hFile=0x154, lpBuffer=0x1a8b008*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a8b008*, lpNumberOfBytesWritten=0x2ae270*=0x8b0, lpOverlapped=0x0) returned 1 [0118.834] CloseHandle (hObject=0x154) returned 1 [0118.834] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg", lpFilePart=0x0) returned 0x71 [0118.834] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdko2p[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x793f1840, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0f4460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5c5a990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1 [0118.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.834] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdko2p[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDKo2P[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdko2p[1].jpg.anonymous")) returned 1 [0118.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg", lpFilePart=0x0) returned 0x71 [0118.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.835] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlgpz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.848] GetFileType (hFile=0x154) returned 0x1 [0118.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.849] GetFileType (hFile=0x154) returned 0x1 [0118.849] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa53 [0118.849] ReadFile (in: hFile=0x154, lpBuffer=0x1a8cef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a8cef8*, lpNumberOfBytesRead=0x2ae2a8*=0xa53, lpOverlapped=0x0) returned 1 [0118.936] CloseHandle (hObject=0x154) returned 1 [0118.970] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg", lpFilePart=0x0) returned 0x71 [0118.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0118.970] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlgpz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.972] GetFileType (hFile=0x154) returned 0x1 [0118.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0118.972] GetFileType (hFile=0x154) returned 0x1 [0118.972] WriteFile (in: hFile=0x154, lpBuffer=0x1ade254*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ade254*, lpNumberOfBytesWritten=0x2ae270*=0xa60, lpOverlapped=0x0) returned 1 [0118.975] CloseHandle (hObject=0x154) returned 1 [0118.975] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg", lpFilePart=0x0) returned 0x71 [0118.975] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0118.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0118.975] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlgpz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4979e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4979e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5db15f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa60)) returned 1 [0118.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0118.975] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlgpz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLGpz[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlgpz[1].jpg.anonymous")) returned 1 [0118.976] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg", lpFilePart=0x0) returned 0x71 [0118.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0118.976] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdljvu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0118.977] GetFileType (hFile=0x154) returned 0x1 [0118.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0118.977] GetFileType (hFile=0x154) returned 0x1 [0118.977] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x20ea [0118.977] ReadFile (in: hFile=0x154, lpBuffer=0x1adf6e4, nNumberOfBytesToRead=0x20ea, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1adf6e4*, lpNumberOfBytesRead=0x2ae2a8*=0x20ea, lpOverlapped=0x0) returned 1 [0118.992] CloseHandle (hObject=0x154) returned 1 [0119.025] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.025] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdljvu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.027] GetFileType (hFile=0x154) returned 0x1 [0119.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.027] GetFileType (hFile=0x154) returned 0x1 [0119.027] WriteFile (in: hFile=0x154, lpBuffer=0x1b36980*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b36980*, lpNumberOfBytesWritten=0x2ae29c*=0x20f0, lpOverlapped=0x0) returned 1 [0119.038] CloseHandle (hObject=0x154) returned 1 [0119.038] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.039] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdljvu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b0f4460, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0f4460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5e49b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20f0)) returned 1 [0119.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.039] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdljvu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLJvu[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdljvu[1].jpg.anonymous")) returned 1 [0119.040] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg", lpFilePart=0x0) returned 0x71 [0119.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.040] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdllqz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.041] GetFileType (hFile=0x154) returned 0x1 [0119.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.041] GetFileType (hFile=0x154) returned 0x1 [0119.041] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1b56 [0119.041] ReadFile (in: hFile=0x154, lpBuffer=0x1b39078, nNumberOfBytesToRead=0x1b56, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b39078*, lpNumberOfBytesRead=0x2ae2a8*=0x1b56, lpOverlapped=0x0) returned 1 [0119.070] CloseHandle (hObject=0x154) returned 1 [0119.102] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg", lpFilePart=0x0) returned 0x71 [0119.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.102] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdllqz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.103] GetFileType (hFile=0x154) returned 0x1 [0119.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.103] GetFileType (hFile=0x154) returned 0x1 [0119.103] WriteFile (in: hFile=0x154, lpBuffer=0x198e4a4*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x198e4a4*, lpNumberOfBytesWritten=0x2ae29c*=0x1b60, lpOverlapped=0x0) returned 1 [0119.105] CloseHandle (hObject=0x154) returned 1 [0119.105] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg", lpFilePart=0x0) returned 0x71 [0119.105] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdllqz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c63a900, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c63a900, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5ee20f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b60)) returned 1 [0119.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.105] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdllqz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLLQz[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdllqz[1].jpg.anonymous")) returned 1 [0119.106] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.106] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmdu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.106] GetFileType (hFile=0x154) returned 0x1 [0119.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.106] GetFileType (hFile=0x154) returned 0x1 [0119.106] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7bb [0119.107] ReadFile (in: hFile=0x154, lpBuffer=0x1990dd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1990dd4*, lpNumberOfBytesRead=0x2ae2a8*=0x7bb, lpOverlapped=0x0) returned 1 [0119.109] CloseHandle (hObject=0x154) returned 1 [0119.169] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.169] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmdu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.171] GetFileType (hFile=0x154) returned 0x1 [0119.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.171] GetFileType (hFile=0x154) returned 0x1 [0119.171] WriteFile (in: hFile=0x154, lpBuffer=0x19e1564*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19e1564*, lpNumberOfBytesWritten=0x2ae270*=0x7c0, lpOverlapped=0x0) returned 1 [0119.173] CloseHandle (hObject=0x154) returned 1 [0119.173] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.173] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmdu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b0ce300, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0ce300, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5f7a670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7c0)) returned 1 [0119.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.173] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmdu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmdu[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmdu[1].jpg.anonymous")) returned 1 [0119.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg", lpFilePart=0x0) returned 0x71 [0119.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.174] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmef[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.175] GetFileType (hFile=0x154) returned 0x1 [0119.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.175] GetFileType (hFile=0x154) returned 0x1 [0119.176] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3b10 [0119.176] ReadFile (in: hFile=0x154, lpBuffer=0x19e29f4, nNumberOfBytesToRead=0x3b10, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19e29f4*, lpNumberOfBytesRead=0x2ae2a8*=0x3b10, lpOverlapped=0x0) returned 1 [0119.190] CloseHandle (hObject=0x154) returned 1 [0119.209] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg", lpFilePart=0x0) returned 0x71 [0119.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.209] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmef[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.211] GetFileType (hFile=0x154) returned 0x1 [0119.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.211] GetFileType (hFile=0x154) returned 0x1 [0119.211] WriteFile (in: hFile=0x154, lpBuffer=0x1a41f7c*, nNumberOfBytesToWrite=0x3b20, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a41f7c*, lpNumberOfBytesWritten=0x2ae29c*=0x3b20, lpOverlapped=0x0) returned 1 [0119.213] CloseHandle (hObject=0x154) returned 1 [0119.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg", lpFilePart=0x0) returned 0x71 [0119.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmef[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2363e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2363e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe5feca90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b20)) returned 1 [0119.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.214] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmef[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLmEf[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlmef[1].jpg.anonymous")) returned 1 [0119.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg", lpFilePart=0x0) returned 0x71 [0119.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.215] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlq44[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.215] GetFileType (hFile=0x154) returned 0x1 [0119.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.216] GetFileType (hFile=0x154) returned 0x1 [0119.216] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x703 [0119.216] ReadFile (in: hFile=0x154, lpBuffer=0x1a467b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a467b4*, lpNumberOfBytesRead=0x2ae2a8*=0x703, lpOverlapped=0x0) returned 1 [0119.231] CloseHandle (hObject=0x154) returned 1 [0119.250] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg", lpFilePart=0x0) returned 0x71 [0119.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.250] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlq44[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.252] GetFileType (hFile=0x154) returned 0x1 [0119.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.252] GetFileType (hFile=0x154) returned 0x1 [0119.252] WriteFile (in: hFile=0x154, lpBuffer=0x1a96a80*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a96a80*, lpNumberOfBytesWritten=0x2ae270*=0x710, lpOverlapped=0x0) returned 1 [0119.254] CloseHandle (hObject=0x154) returned 1 [0119.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg", lpFilePart=0x0) returned 0x71 [0119.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlq44[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cb6f920, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cb6f920, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe605eeb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x710)) returned 1 [0119.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.255] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlq44[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDLq44[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdlq44[1].jpg.anonymous")) returned 1 [0119.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg", lpFilePart=0x0) returned 0x71 [0119.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.255] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmald[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.302] GetFileType (hFile=0x154) returned 0x1 [0119.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.302] GetFileType (hFile=0x154) returned 0x1 [0119.302] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7bf [0119.302] ReadFile (in: hFile=0x154, lpBuffer=0x1a986dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a986dc*, lpNumberOfBytesRead=0x2ae2a8*=0x7bf, lpOverlapped=0x0) returned 1 [0119.322] CloseHandle (hObject=0x154) returned 1 [0119.339] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg", lpFilePart=0x0) returned 0x71 [0119.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.340] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmald[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.341] GetFileType (hFile=0x154) returned 0x1 [0119.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.341] GetFileType (hFile=0x154) returned 0x1 [0119.341] WriteFile (in: hFile=0x154, lpBuffer=0x1ae8d0c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ae8d0c*, lpNumberOfBytesWritten=0x2ae270*=0x7c0, lpOverlapped=0x0) returned 1 [0119.343] CloseHandle (hObject=0x154) returned 1 [0119.343] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg", lpFilePart=0x0) returned 0x71 [0119.343] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmald[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c52ff60, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c52ff60, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe611d590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7c0)) returned 1 [0119.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.343] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmald[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMalD[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmald[1].jpg.anonymous")) returned 1 [0119.344] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg", lpFilePart=0x0) returned 0x71 [0119.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.344] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmdsm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.359] GetFileType (hFile=0x154) returned 0x1 [0119.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.359] GetFileType (hFile=0x154) returned 0x1 [0119.359] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1e84 [0119.359] ReadFile (in: hFile=0x154, lpBuffer=0x1aea19c, nNumberOfBytesToRead=0x1e84, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aea19c*, lpNumberOfBytesRead=0x2ae2a8*=0x1e84, lpOverlapped=0x0) returned 1 [0119.377] CloseHandle (hObject=0x154) returned 1 [0119.391] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg", lpFilePart=0x0) returned 0x71 [0119.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.391] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmdsm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.393] GetFileType (hFile=0x154) returned 0x1 [0119.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.393] GetFileType (hFile=0x154) returned 0x1 [0119.393] WriteFile (in: hFile=0x154, lpBuffer=0x1b40854*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b40854*, lpNumberOfBytesWritten=0x2ae29c*=0x1e90, lpOverlapped=0x0) returned 1 [0119.394] CloseHandle (hObject=0x154) returned 1 [0119.394] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg", lpFilePart=0x0) returned 0x71 [0119.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmdsm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c340d80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c340d80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe61b5b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e90)) returned 1 [0119.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.395] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmdsm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMdsm[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmdsm[1].jpg.anonymous")) returned 1 [0119.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg", lpFilePart=0x0) returned 0x71 [0119.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.395] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdme2k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.396] GetFileType (hFile=0x154) returned 0x1 [0119.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.396] GetFileType (hFile=0x154) returned 0x1 [0119.396] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x669 [0119.396] ReadFile (in: hFile=0x154, lpBuffer=0x1b43364, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b43364*, lpNumberOfBytesRead=0x2ae2a8*=0x669, lpOverlapped=0x0) returned 1 [0119.405] CloseHandle (hObject=0x154) returned 1 [0119.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg", lpFilePart=0x0) returned 0x71 [0119.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.448] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdme2k[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.450] GetFileType (hFile=0x154) returned 0x1 [0119.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.450] GetFileType (hFile=0x154) returned 0x1 [0119.450] WriteFile (in: hFile=0x154, lpBuffer=0x198ff7c*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x198ff7c*, lpNumberOfBytesWritten=0x2ae270*=0x670, lpOverlapped=0x0) returned 1 [0119.452] CloseHandle (hObject=0x154) returned 1 [0119.452] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg", lpFilePart=0x0) returned 0x71 [0119.452] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdme2k[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4979e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4979e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6227f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x670)) returned 1 [0119.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.452] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdme2k[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDME2K[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdme2k[1].jpg.anonymous")) returned 1 [0119.453] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg", lpFilePart=0x0) returned 0x71 [0119.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.453] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmlrb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.454] GetFileType (hFile=0x154) returned 0x1 [0119.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.454] GetFileType (hFile=0x154) returned 0x1 [0119.454] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24a8 [0119.454] ReadFile (in: hFile=0x154, lpBuffer=0x199140c, nNumberOfBytesToRead=0x24a8, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199140c*, lpNumberOfBytesRead=0x2ae2a8*=0x24a8, lpOverlapped=0x0) returned 1 [0119.459] CloseHandle (hObject=0x154) returned 1 [0119.477] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg", lpFilePart=0x0) returned 0x71 [0119.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.477] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmlrb[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.479] GetFileType (hFile=0x154) returned 0x1 [0119.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.479] GetFileType (hFile=0x154) returned 0x1 [0119.479] WriteFile (in: hFile=0x154, lpBuffer=0x19e9ac0*, nNumberOfBytesToWrite=0x24b0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19e9ac0*, lpNumberOfBytesWritten=0x2ae29c*=0x24b0, lpOverlapped=0x0) returned 1 [0119.481] CloseHandle (hObject=0x154) returned 1 [0119.481] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg", lpFilePart=0x0) returned 0x71 [0119.481] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmlrb[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5560c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5560c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe62741f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24b0)) returned 1 [0119.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.481] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmlrb[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMLRB[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmlrb[1].jpg.anonymous")) returned 1 [0119.482] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg", lpFilePart=0x0) returned 0x71 [0119.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.482] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmpdz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.484] GetFileType (hFile=0x154) returned 0x1 [0119.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.484] GetFileType (hFile=0x154) returned 0x1 [0119.484] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7dc [0119.484] ReadFile (in: hFile=0x154, lpBuffer=0x19ecd60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19ecd60*, lpNumberOfBytesRead=0x2ae2a8*=0x7dc, lpOverlapped=0x0) returned 1 [0119.530] CloseHandle (hObject=0x154) returned 1 [0119.543] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg", lpFilePart=0x0) returned 0x71 [0119.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.543] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmpdz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.545] GetFileType (hFile=0x154) returned 0x1 [0119.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.545] GetFileType (hFile=0x154) returned 0x1 [0119.545] WriteFile (in: hFile=0x154, lpBuffer=0x1a3d430*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a3d430*, lpNumberOfBytesWritten=0x2ae270*=0x7e0, lpOverlapped=0x0) returned 1 [0119.546] CloseHandle (hObject=0x154) returned 1 [0119.546] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg", lpFilePart=0x0) returned 0x71 [0119.546] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmpdz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c366ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c366ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe630c770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7e0)) returned 1 [0119.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.546] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmpdz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMpdZ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmpdz[1].jpg.anonymous")) returned 1 [0119.547] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg", lpFilePart=0x0) returned 0x71 [0119.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.547] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmq9q[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.548] GetFileType (hFile=0x154) returned 0x1 [0119.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.548] GetFileType (hFile=0x154) returned 0x1 [0119.548] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x241a [0119.548] ReadFile (in: hFile=0x154, lpBuffer=0x1a3e8c0, nNumberOfBytesToRead=0x241a, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a3e8c0*, lpNumberOfBytesRead=0x2ae2a8*=0x241a, lpOverlapped=0x0) returned 1 [0119.561] CloseHandle (hObject=0x154) returned 1 [0119.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg", lpFilePart=0x0) returned 0x71 [0119.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.573] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmq9q[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.577] GetFileType (hFile=0x154) returned 0x1 [0119.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.577] GetFileType (hFile=0x154) returned 0x1 [0119.577] WriteFile (in: hFile=0x154, lpBuffer=0x1a96b4c*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a96b4c*, lpNumberOfBytesWritten=0x2ae29c*=0x2420, lpOverlapped=0x0) returned 1 [0119.578] CloseHandle (hObject=0x154) returned 1 [0119.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg", lpFilePart=0x0) returned 0x71 [0119.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmq9q[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5c84e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5c84e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6358a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2420)) returned 1 [0119.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.579] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmq9q[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMq9Q[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmq9q[1].jpg.anonymous")) returned 1 [0119.579] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg", lpFilePart=0x0) returned 0x71 [0119.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.579] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrb5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.581] GetFileType (hFile=0x154) returned 0x1 [0119.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.581] GetFileType (hFile=0x154) returned 0x1 [0119.581] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2ba2 [0119.581] ReadFile (in: hFile=0x154, lpBuffer=0x1a99574, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a99574*, lpNumberOfBytesRead=0x2ae2a8*=0x2ba2, lpOverlapped=0x0) returned 1 [0119.613] CloseHandle (hObject=0x154) returned 1 [0119.624] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg", lpFilePart=0x0) returned 0x71 [0119.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.624] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrb5[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.626] GetFileType (hFile=0x154) returned 0x1 [0119.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.626] GetFileType (hFile=0x154) returned 0x1 [0119.626] WriteFile (in: hFile=0x154, lpBuffer=0x1af3dd0*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1af3dd0*, lpNumberOfBytesWritten=0x2ae29c*=0x2bb0, lpOverlapped=0x0) returned 1 [0119.627] CloseHandle (hObject=0x154) returned 1 [0119.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg", lpFilePart=0x0) returned 0x71 [0119.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrb5[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5ee640, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5ee640, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe63f0fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2bb0)) returned 1 [0119.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.628] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrb5[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrb5[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrb5[1].jpg.anonymous")) returned 1 [0119.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg", lpFilePart=0x0) returned 0x71 [0119.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.628] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrkc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.629] GetFileType (hFile=0x154) returned 0x1 [0119.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.629] GetFileType (hFile=0x154) returned 0x1 [0119.629] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa97 [0119.629] ReadFile (in: hFile=0x154, lpBuffer=0x1af7a2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af7a2c*, lpNumberOfBytesRead=0x2ae2a8*=0xa97, lpOverlapped=0x0) returned 1 [0119.647] CloseHandle (hObject=0x154) returned 1 [0119.660] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg", lpFilePart=0x0) returned 0x71 [0119.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.660] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrkc[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.662] GetFileType (hFile=0x154) returned 0x1 [0119.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.662] GetFileType (hFile=0x154) returned 0x1 [0119.662] WriteFile (in: hFile=0x154, lpBuffer=0x1b48ec4*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b48ec4*, lpNumberOfBytesWritten=0x2ae270*=0xaa0, lpOverlapped=0x0) returned 1 [0119.663] CloseHandle (hObject=0x154) returned 1 [0119.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg", lpFilePart=0x0) returned 0x71 [0119.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrkc[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbbbbe0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbbbbe0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe643d270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaa0)) returned 1 [0119.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.663] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrkc[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMrkc[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmrkc[1].jpg.anonymous")) returned 1 [0119.664] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg", lpFilePart=0x0) returned 0x71 [0119.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.664] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwmg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.665] GetFileType (hFile=0x154) returned 0x1 [0119.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.665] GetFileType (hFile=0x154) returned 0x1 [0119.665] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2730 [0119.665] ReadFile (in: hFile=0x154, lpBuffer=0x1b4a354, nNumberOfBytesToRead=0x2730, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b4a354*, lpNumberOfBytesRead=0x2ae2a8*=0x2730, lpOverlapped=0x0) returned 1 [0119.672] CloseHandle (hObject=0x154) returned 1 [0119.709] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg", lpFilePart=0x0) returned 0x71 [0119.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.710] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwmg[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.711] GetFileType (hFile=0x154) returned 0x1 [0119.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.711] GetFileType (hFile=0x154) returned 0x1 [0119.711] WriteFile (in: hFile=0x154, lpBuffer=0x19a5620*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19a5620*, lpNumberOfBytesWritten=0x2ae29c*=0x2740, lpOverlapped=0x0) returned 1 [0119.713] CloseHandle (hObject=0x154) returned 1 [0119.713] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg", lpFilePart=0x0) returned 0x71 [0119.713] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwmg[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1c3fc0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c1c3fc0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe64af690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2740)) returned 1 [0119.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.713] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwmg[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwMg[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwmg[1].jpg.anonymous")) returned 1 [0119.714] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg", lpFilePart=0x0) returned 0x71 [0119.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.714] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.714] GetFileType (hFile=0x154) returned 0x1 [0119.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.714] GetFileType (hFile=0x154) returned 0x1 [0119.714] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x257a [0119.714] ReadFile (in: hFile=0x154, lpBuffer=0x19a8368, nNumberOfBytesToRead=0x257a, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a8368*, lpNumberOfBytesRead=0x2ae2a8*=0x257a, lpOverlapped=0x0) returned 1 [0119.728] CloseHandle (hObject=0x154) returned 1 [0119.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg", lpFilePart=0x0) returned 0x71 [0119.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.740] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.741] GetFileType (hFile=0x154) returned 0x1 [0119.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.742] GetFileType (hFile=0x154) returned 0x1 [0119.742] WriteFile (in: hFile=0x154, lpBuffer=0x1a00e30*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a00e30*, lpNumberOfBytesWritten=0x2ae29c*=0x2580, lpOverlapped=0x0) returned 1 [0119.743] CloseHandle (hObject=0x154) returned 1 [0119.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg", lpFilePart=0x0) returned 0x71 [0119.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2363e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2363e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe64fb950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2580)) returned 1 [0119.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.743] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[1].jpg.anonymous")) returned 1 [0119.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg", lpFilePart=0x0) returned 0x71 [0119.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.744] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.745] GetFileType (hFile=0x154) returned 0x1 [0119.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.745] GetFileType (hFile=0x154) returned 0x1 [0119.745] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x300e [0119.745] ReadFile (in: hFile=0x154, lpBuffer=0x1a039b8, nNumberOfBytesToRead=0x300e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a039b8*, lpNumberOfBytesRead=0x2ae2a8*=0x300e, lpOverlapped=0x0) returned 1 [0119.761] CloseHandle (hObject=0x154) returned 1 [0119.773] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg", lpFilePart=0x0) returned 0x71 [0119.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.774] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[2].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.775] GetFileType (hFile=0x154) returned 0x1 [0119.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.775] GetFileType (hFile=0x154) returned 0x1 [0119.775] WriteFile (in: hFile=0x154, lpBuffer=0x1a5f7f4*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a5f7f4*, lpNumberOfBytesWritten=0x2ae29c*=0x3010, lpOverlapped=0x0) returned 1 [0119.776] CloseHandle (hObject=0x154) returned 1 [0119.776] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg", lpFilePart=0x0) returned 0x71 [0119.777] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[2].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d671ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7d671ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6547c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1 [0119.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.777] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[2].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDMwuY[2].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdmwuy[2].jpg.anonymous")) returned 1 [0119.777] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.777] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdr3zu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.778] GetFileType (hFile=0x154) returned 0x1 [0119.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.778] GetFileType (hFile=0x154) returned 0x1 [0119.778] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x95d [0119.778] ReadFile (in: hFile=0x154, lpBuffer=0x1a63778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a63778*, lpNumberOfBytesRead=0x2ae2a8*=0x95d, lpOverlapped=0x0) returned 1 [0119.792] CloseHandle (hObject=0x154) returned 1 [0119.808] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.808] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdr3zu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.810] GetFileType (hFile=0x154) returned 0x1 [0119.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.810] GetFileType (hFile=0x154) returned 0x1 [0119.810] WriteFile (in: hFile=0x154, lpBuffer=0x1ab45c8*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ab45c8*, lpNumberOfBytesWritten=0x2ae270*=0x960, lpOverlapped=0x0) returned 1 [0119.811] CloseHandle (hObject=0x154) returned 1 [0119.811] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg", lpFilePart=0x0) returned 0x71 [0119.811] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdr3zu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc07ea0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc07ea0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6593ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x960)) returned 1 [0119.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.812] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdr3zu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDr3Zu[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdr3zu[1].jpg.anonymous")) returned 1 [0119.812] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg", lpFilePart=0x0) returned 0x71 [0119.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.812] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdtrbe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.813] GetFileType (hFile=0x154) returned 0x1 [0119.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.813] GetFileType (hFile=0x154) returned 0x1 [0119.813] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x39ff [0119.813] ReadFile (in: hFile=0x154, lpBuffer=0x1ab5a58, nNumberOfBytesToRead=0x39ff, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab5a58*, lpNumberOfBytesRead=0x2ae2a8*=0x39ff, lpOverlapped=0x0) returned 1 [0119.972] CloseHandle (hObject=0x154) returned 1 [0119.985] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg", lpFilePart=0x0) returned 0x71 [0119.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0119.985] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdtrbe[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.987] GetFileType (hFile=0x154) returned 0x1 [0119.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0119.987] GetFileType (hFile=0x154) returned 0x1 [0119.987] WriteFile (in: hFile=0x154, lpBuffer=0x1b14a44*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b14a44*, lpNumberOfBytesWritten=0x2ae29c*=0x3a00, lpOverlapped=0x0) returned 1 [0119.988] CloseHandle (hObject=0x154) returned 1 [0119.988] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg", lpFilePart=0x0) returned 0x71 [0119.988] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0119.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0119.988] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdtrbe[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4bdb40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4bdb40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe675cf50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a00)) returned 1 [0119.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0119.988] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdtrbe[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDtRBe[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbdtrbe[1].jpg.anonymous")) returned 1 [0119.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg", lpFilePart=0x0) returned 0x71 [0119.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0119.989] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbduj15[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0119.989] GetFileType (hFile=0x154) returned 0x1 [0119.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0119.989] GetFileType (hFile=0x154) returned 0x1 [0119.989] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x929 [0119.989] ReadFile (in: hFile=0x154, lpBuffer=0x1b19384, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b19384*, lpNumberOfBytesRead=0x2ae2a8*=0x929, lpOverlapped=0x0) returned 1 [0119.994] CloseHandle (hObject=0x154) returned 1 [0120.006] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg", lpFilePart=0x0) returned 0x71 [0120.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.006] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbduj15[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.007] GetFileType (hFile=0x154) returned 0x1 [0120.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.008] GetFileType (hFile=0x154) returned 0x1 [0120.008] WriteFile (in: hFile=0x154, lpBuffer=0x1b6a0e8*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b6a0e8*, lpNumberOfBytesWritten=0x2ae270*=0x930, lpOverlapped=0x0) returned 1 [0120.009] CloseHandle (hObject=0x154) returned 1 [0120.009] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg", lpFilePart=0x0) returned 0x71 [0120.009] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0120.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbduj15[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c509e00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c509e00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe67830b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x930)) returned 1 [0120.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.009] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbduj15[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBDuJ15[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbduj15[1].jpg.anonymous")) returned 1 [0120.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png", lpFilePart=0x0) returned 0x71 [0120.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.010] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbmuxrk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.010] GetFileType (hFile=0x154) returned 0x1 [0120.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.010] GetFileType (hFile=0x154) returned 0x1 [0120.010] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24c [0120.011] ReadFile (in: hFile=0x154, lpBuffer=0x1b6b7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b6b7d0*, lpNumberOfBytesRead=0x2ae2a8*=0x24c, lpOverlapped=0x0) returned 1 [0120.043] CloseHandle (hObject=0x154) returned 1 [0120.081] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png", lpFilePart=0x0) returned 0x71 [0120.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.081] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbmuxrk[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.083] GetFileType (hFile=0x154) returned 0x1 [0120.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.083] GetFileType (hFile=0x154) returned 0x1 [0120.083] WriteFile (in: hFile=0x154, lpBuffer=0x19b7d84*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19b7d84*, lpNumberOfBytesWritten=0x2ae270*=0x250, lpOverlapped=0x0) returned 1 [0120.084] CloseHandle (hObject=0x154) returned 1 [0120.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png", lpFilePart=0x0) returned 0x71 [0120.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbmuxrk[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8067fb00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x8067fb00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6841790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0120.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.084] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBmUxRK[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbmuxrk[1].png.anonymous")) returned 1 [0120.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png", lpFilePart=0x0) returned 0x71 [0120.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.085] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbo1lfj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.111] GetFileType (hFile=0x154) returned 0x1 [0120.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.111] GetFileType (hFile=0x154) returned 0x1 [0120.111] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x36e [0120.111] ReadFile (in: hFile=0x154, lpBuffer=0x19b9590, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b9590*, lpNumberOfBytesRead=0x2ae2a8*=0x36e, lpOverlapped=0x0) returned 1 [0120.122] CloseHandle (hObject=0x154) returned 1 [0120.134] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png", lpFilePart=0x0) returned 0x71 [0120.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.134] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbo1lfj[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.135] GetFileType (hFile=0x154) returned 0x1 [0120.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.135] GetFileType (hFile=0x154) returned 0x1 [0120.135] WriteFile (in: hFile=0x154, lpBuffer=0x1a0878c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a0878c*, lpNumberOfBytesWritten=0x2ae270*=0x370, lpOverlapped=0x0) returned 1 [0120.136] CloseHandle (hObject=0x154) returned 1 [0120.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png", lpFilePart=0x0) returned 0x71 [0120.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbo1lfj[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c52ff60, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c52ff60, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe68b3bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0120.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.137] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbo1lfj[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBo1lFJ[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbo1lfj[1].png.anonymous")) returned 1 [0120.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg", lpFilePart=0x0) returned 0x71 [0120.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.137] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbphubz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.138] GetFileType (hFile=0x154) returned 0x1 [0120.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.138] GetFileType (hFile=0x154) returned 0x1 [0120.138] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x758 [0120.138] ReadFile (in: hFile=0x154, lpBuffer=0x1a0a380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a0a380*, lpNumberOfBytesRead=0x2ae2a8*=0x758, lpOverlapped=0x0) returned 1 [0120.146] CloseHandle (hObject=0x154) returned 1 [0120.159] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg", lpFilePart=0x0) returned 0x71 [0120.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.159] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbphubz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.160] GetFileType (hFile=0x154) returned 0x1 [0120.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.160] GetFileType (hFile=0x154) returned 0x1 [0120.160] WriteFile (in: hFile=0x154, lpBuffer=0x1a5a7d4*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a5a7d4*, lpNumberOfBytesWritten=0x2ae270*=0x760, lpOverlapped=0x0) returned 1 [0120.161] CloseHandle (hObject=0x154) returned 1 [0120.162] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg", lpFilePart=0x0) returned 0x71 [0120.162] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0120.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.162] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbphubz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d72ba10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d72ba10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe68ffe70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0120.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.162] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbphubz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBphubZ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbphubz[1].jpg.anonymous")) returned 1 [0120.162] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg", lpFilePart=0x0) returned 0x71 [0120.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.162] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbqcocm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.163] GetFileType (hFile=0x154) returned 0x1 [0120.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.163] GetFileType (hFile=0x154) returned 0x1 [0120.163] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2d34 [0120.163] ReadFile (in: hFile=0x154, lpBuffer=0x1a5bc64, nNumberOfBytesToRead=0x2d34, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a5bc64*, lpNumberOfBytesRead=0x2ae2a8*=0x2d34, lpOverlapped=0x0) returned 1 [0120.201] CloseHandle (hObject=0x154) returned 1 [0120.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg", lpFilePart=0x0) returned 0x71 [0120.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.214] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbqcocm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.215] GetFileType (hFile=0x154) returned 0x1 [0120.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.215] GetFileType (hFile=0x154) returned 0x1 [0120.215] WriteFile (in: hFile=0x154, lpBuffer=0x1ab6c8c*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ab6c8c*, lpNumberOfBytesWritten=0x2ae29c*=0x2d40, lpOverlapped=0x0) returned 1 [0120.216] CloseHandle (hObject=0x154) returned 1 [0120.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg", lpFilePart=0x0) returned 0x71 [0120.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0120.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbqcocm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8ce930, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8ce930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe6972290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d40)) returned 1 [0120.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.217] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbqcocm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBqcocM[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbqcocm[1].jpg.anonymous")) returned 1 [0120.218] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg", lpFilePart=0x0) returned 0x71 [0120.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.218] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbvnrk0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.218] GetFileType (hFile=0x154) returned 0x1 [0120.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.218] GetFileType (hFile=0x154) returned 0x1 [0120.218] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3295 [0120.219] ReadFile (in: hFile=0x154, lpBuffer=0x1ab9fd4, nNumberOfBytesToRead=0x3295, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab9fd4*, lpNumberOfBytesRead=0x2ae2a8*=0x3295, lpOverlapped=0x0) returned 1 [0120.272] CloseHandle (hObject=0x154) returned 1 [0120.283] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg", lpFilePart=0x0) returned 0x71 [0120.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.283] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbvnrk0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.285] GetFileType (hFile=0x154) returned 0x1 [0120.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.285] GetFileType (hFile=0x154) returned 0x1 [0120.285] WriteFile (in: hFile=0x154, lpBuffer=0x1b16ae0*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b16ae0*, lpNumberOfBytesWritten=0x2ae29c*=0x32a0, lpOverlapped=0x0) returned 1 [0120.286] CloseHandle (hObject=0x154) returned 1 [0120.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg", lpFilePart=0x0) returned 0x71 [0120.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0120.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbvnrk0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4a42b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d4a42b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe6a30970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x32a0)) returned 1 [0120.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.286] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbvnrk0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBvNRK0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbvnrk0[1].jpg.anonymous")) returned 1 [0120.287] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png", lpFilePart=0x0) returned 0x71 [0120.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.287] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbztfyu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.288] GetFileType (hFile=0x154) returned 0x1 [0120.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.288] GetFileType (hFile=0x154) returned 0x1 [0120.288] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x151 [0120.288] ReadFile (in: hFile=0x154, lpBuffer=0x1b1a4e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b1a4e8*, lpNumberOfBytesRead=0x2ae2a8*=0x151, lpOverlapped=0x0) returned 1 [0120.311] CloseHandle (hObject=0x154) returned 1 [0120.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png", lpFilePart=0x0) returned 0x71 [0120.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.324] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbztfyu[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.326] GetFileType (hFile=0x154) returned 0x1 [0120.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.326] GetFileType (hFile=0x154) returned 0x1 [0120.326] WriteFile (in: hFile=0x154, lpBuffer=0x1b68b44*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b68b44*, lpNumberOfBytesWritten=0x2ae270*=0x160, lpOverlapped=0x0) returned 1 [0120.327] CloseHandle (hObject=0x154) returned 1 [0120.327] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png", lpFilePart=0x0) returned 0x71 [0120.327] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.327] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbztfyu[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c84fc40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c84fc40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6a7cc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1 [0120.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.327] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbztfyu[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\BBztfYU[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\bbztfyu[1].png.anonymous")) returned 1 [0120.328] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif", lpFilePart=0x0) returned 0x71 [0120.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.328] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\collect[2].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.329] GetFileType (hFile=0x154) returned 0x1 [0120.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.329] GetFileType (hFile=0x154) returned 0x1 [0120.329] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2b [0120.329] ReadFile (in: hFile=0x154, lpBuffer=0x1b6a020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b6a020*, lpNumberOfBytesRead=0x2ae2a8*=0x2b, lpOverlapped=0x0) returned 1 [0120.352] CloseHandle (hObject=0x154) returned 1 [0120.388] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif", lpFilePart=0x0) returned 0x71 [0120.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.388] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\collect[2].gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.390] GetFileType (hFile=0x154) returned 0x1 [0120.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.390] GetFileType (hFile=0x154) returned 0x1 [0120.390] WriteFile (in: hFile=0x154, lpBuffer=0x19b7ee4*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19b7ee4*, lpNumberOfBytesWritten=0x2ae270*=0x30, lpOverlapped=0x0) returned 1 [0120.392] CloseHandle (hObject=0x154) returned 1 [0120.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif", lpFilePart=0x0) returned 0x71 [0120.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif.anonymous", lpFilePart=0x0) returned 0x7b [0120.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\collect[2].gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da9c560, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7da9c560, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6b3b310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30)) returned 1 [0120.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.392] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\collect[2].gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\collect[2].gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\collect[2].gif.anonymous")) returned 1 [0120.393] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif", lpFilePart=0x0) returned 0x70 [0120.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.393] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\e151e5[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.394] GetFileType (hFile=0x154) returned 0x1 [0120.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.394] GetFileType (hFile=0x154) returned 0x1 [0120.394] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2b [0120.394] ReadFile (in: hFile=0x154, lpBuffer=0x19b93c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b93c0*, lpNumberOfBytesRead=0x2ae2a8*=0x2b, lpOverlapped=0x0) returned 1 [0120.409] CloseHandle (hObject=0x154) returned 1 [0120.420] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif", lpFilePart=0x0) returned 0x70 [0120.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.420] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\e151e5[1].gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.421] GetFileType (hFile=0x154) returned 0x1 [0120.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.422] GetFileType (hFile=0x154) returned 0x1 [0120.422] WriteFile (in: hFile=0x154, lpBuffer=0x1a07610*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a07610*, lpNumberOfBytesWritten=0x2ae270*=0x30, lpOverlapped=0x0) returned 1 [0120.423] CloseHandle (hObject=0x154) returned 1 [0120.423] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif", lpFilePart=0x0) returned 0x70 [0120.423] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif.anonymous", lpFilePart=0x0) returned 0x7a [0120.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.423] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\e151e5[1].gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7adae620, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7adae620, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6b875d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30)) returned 1 [0120.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.423] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\e151e5[1].gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\2BY1Z7W3\\e151e5[1].gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\2by1z7w3\\e151e5[1].gif.anonymous")) returned 1 [0120.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0120.424] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1", lpFilePart=0x0) returned 0x62 [0120.424] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\", lpFilePart=0x0) returned 0x63 [0120.424] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf058 [0120.448] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.449] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.449] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.449] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.449] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.450] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.451] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.452] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.454] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.455] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.456] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.457] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.458] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.458] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.459] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.460] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.461] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.462] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0120.462] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0120.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0120.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0120.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0120.463] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1", lpFilePart=0x0) returned 0x62 [0120.463] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\", lpFilePart=0x0) returned 0x63 [0120.463] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf058 [0120.464] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.464] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.464] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.464] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.465] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.466] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.467] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.468] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.469] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0120.470] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0120.470] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0120.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0120.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0120.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif", lpFilePart=0x0) returned 0x72 [0120.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.472] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\19619567[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.490] GetFileType (hFile=0x154) returned 0x1 [0120.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.490] GetFileType (hFile=0x154) returned 0x1 [0120.490] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xc37e [0120.490] ReadFile (in: hFile=0x154, lpBuffer=0x1a2625c, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a2625c*, lpNumberOfBytesRead=0x2ae2a8*=0xc37e, lpOverlapped=0x0) returned 1 [0120.497] CloseHandle (hObject=0x154) returned 1 [0120.511] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif", lpFilePart=0x0) returned 0x72 [0120.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.511] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\19619567[1].gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.513] GetFileType (hFile=0x154) returned 0x1 [0120.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.513] GetFileType (hFile=0x154) returned 0x1 [0120.513] WriteFile (in: hFile=0x154, lpBuffer=0x1a97adc*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a97adc*, lpNumberOfBytesWritten=0x2ae29c*=0xc380, lpOverlapped=0x0) returned 1 [0120.515] CloseHandle (hObject=0x154) returned 1 [0120.515] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif", lpFilePart=0x0) returned 0x72 [0120.515] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif.anonymous", lpFilePart=0x0) returned 0x7c [0120.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\19619567[1].gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c177d00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c177d00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6c45cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc380)) returned 1 [0120.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.516] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\19619567[1].gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\19619567[1].gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\19619567[1].gif.anonymous")) returned 1 [0120.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg", lpFilePart=0x0) returned 0x8e [0120.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.517] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.530] GetFileType (hFile=0x154) returned 0x1 [0120.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.531] GetFileType (hFile=0x154) returned 0x1 [0120.531] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9ab1 [0120.531] ReadFile (in: hFile=0x154, lpBuffer=0x1aa44e8, nNumberOfBytesToRead=0x9ab1, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa44e8*, lpNumberOfBytesRead=0x2ae2a8*=0x9ab1, lpOverlapped=0x0) returned 1 [0120.541] CloseHandle (hObject=0x154) returned 1 [0120.554] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg", lpFilePart=0x0) returned 0x8e [0120.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.554] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.555] GetFileType (hFile=0x154) returned 0x1 [0120.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.555] GetFileType (hFile=0x154) returned 0x1 [0120.555] WriteFile (in: hFile=0x154, lpBuffer=0x1b21894*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b21894*, lpNumberOfBytesWritten=0x2ae29c*=0x9ac0, lpOverlapped=0x0) returned 1 [0120.557] CloseHandle (hObject=0x154) returned 1 [0120.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg", lpFilePart=0x0) returned 0x8e [0120.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg.anonymous", lpFilePart=0x0) returned 0x98 [0120.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a57360, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x79a57360, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6cb80d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9ac0)) returned 1 [0120.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.558] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\7136de35-ea2a-410f-8140-bb29414999fc[1].jpg.anonymous")) returned 1 [0120.558] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png", lpFilePart=0x0) returned 0x71 [0120.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.558] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e1pt[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.558] GetFileType (hFile=0x154) returned 0x1 [0120.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.559] GetFileType (hFile=0x154) returned 0x1 [0120.559] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x197 [0120.559] ReadFile (in: hFile=0x154, lpBuffer=0x1b2bc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b2bc28*, lpNumberOfBytesRead=0x2ae2a8*=0x197, lpOverlapped=0x0) returned 1 [0120.576] CloseHandle (hObject=0x154) returned 1 [0120.589] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png", lpFilePart=0x0) returned 0x71 [0120.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.590] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e1pt[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.591] GetFileType (hFile=0x154) returned 0x1 [0120.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.591] GetFileType (hFile=0x154) returned 0x1 [0120.591] WriteFile (in: hFile=0x154, lpBuffer=0x1b7a3c0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b7a3c0*, lpNumberOfBytesWritten=0x2ae270*=0x1a0, lpOverlapped=0x0) returned 1 [0120.593] CloseHandle (hObject=0x154) returned 1 [0120.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png", lpFilePart=0x0) returned 0x71 [0120.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e1pt[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7788cf90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7788cf90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe6d04390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0120.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.593] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e1pt[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e1pt[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e1pt[1].png.anonymous")) returned 1 [0120.595] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png", lpFilePart=0x0) returned 0x71 [0120.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.595] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e3xc[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.604] GetFileType (hFile=0x154) returned 0x1 [0120.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.604] GetFileType (hFile=0x154) returned 0x1 [0120.605] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x135 [0120.605] ReadFile (in: hFile=0x154, lpBuffer=0x1b7b994, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b7b994*, lpNumberOfBytesRead=0x2ae2a8*=0x135, lpOverlapped=0x0) returned 1 [0120.609] CloseHandle (hObject=0x154) returned 1 [0120.651] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png", lpFilePart=0x0) returned 0x71 [0120.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.652] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e3xc[2].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.653] GetFileType (hFile=0x154) returned 0x1 [0120.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.653] GetFileType (hFile=0x154) returned 0x1 [0120.653] WriteFile (in: hFile=0x154, lpBuffer=0x19cf848*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19cf848*, lpNumberOfBytesWritten=0x2ae270*=0x140, lpOverlapped=0x0) returned 1 [0120.654] CloseHandle (hObject=0x154) returned 1 [0120.654] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png", lpFilePart=0x0) returned 0x71 [0120.654] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e3xc[2].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b11a5c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b11a5c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6d9c910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x140)) returned 1 [0120.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.654] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA3e3XC[2].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa3e3xc[2].png.anonymous")) returned 1 [0120.655] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png", lpFilePart=0x0) returned 0x71 [0120.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.655] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61ofl[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.655] GetFileType (hFile=0x154) returned 0x1 [0120.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.655] GetFileType (hFile=0x154) returned 0x1 [0120.655] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1c4 [0120.655] ReadFile (in: hFile=0x154, lpBuffer=0x19d0ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19d0ea8*, lpNumberOfBytesRead=0x2ae2a8*=0x1c4, lpOverlapped=0x0) returned 1 [0120.679] CloseHandle (hObject=0x154) returned 1 [0120.691] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png", lpFilePart=0x0) returned 0x71 [0120.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.691] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61ofl[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.692] GetFileType (hFile=0x154) returned 0x1 [0120.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.692] GetFileType (hFile=0x154) returned 0x1 [0120.692] WriteFile (in: hFile=0x154, lpBuffer=0x1a1f88c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a1f88c*, lpNumberOfBytesWritten=0x2ae270*=0x1d0, lpOverlapped=0x0) returned 1 [0120.693] CloseHandle (hObject=0x154) returned 1 [0120.694] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png", lpFilePart=0x0) returned 0x71 [0120.694] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61ofl[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6b95f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6b95f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe6e0ed30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1 [0120.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.694] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61Ofl[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61ofl[1].png.anonymous")) returned 1 [0120.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png", lpFilePart=0x0) returned 0x71 [0120.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.695] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61yi9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.695] GetFileType (hFile=0x154) returned 0x1 [0120.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.695] GetFileType (hFile=0x154) returned 0x1 [0120.695] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x19d [0120.695] ReadFile (in: hFile=0x154, lpBuffer=0x1a20ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a20ec8*, lpNumberOfBytesRead=0x2ae2a8*=0x19d, lpOverlapped=0x0) returned 1 [0120.762] CloseHandle (hObject=0x154) returned 1 [0120.779] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png", lpFilePart=0x0) returned 0x71 [0120.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.779] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61yi9[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.781] GetFileType (hFile=0x154) returned 0x1 [0120.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.781] GetFileType (hFile=0x154) returned 0x1 [0120.781] WriteFile (in: hFile=0x154, lpBuffer=0x1a6f658*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a6f658*, lpNumberOfBytesWritten=0x2ae270*=0x1a0, lpOverlapped=0x0) returned 1 [0120.782] CloseHandle (hObject=0x154) returned 1 [0120.782] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png", lpFilePart=0x0) returned 0x71 [0120.782] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61yi9[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d671ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7d671ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6ef3570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0120.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.783] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA61yi9[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa61yi9[1].png.anonymous")) returned 1 [0120.783] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png", lpFilePart=0x0) returned 0x71 [0120.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.783] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7xcq3[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.784] GetFileType (hFile=0x154) returned 0x1 [0120.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.784] GetFileType (hFile=0x154) returned 0x1 [0120.784] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x27b [0120.785] ReadFile (in: hFile=0x154, lpBuffer=0x1a70d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a70d70*, lpNumberOfBytesRead=0x2ae2a8*=0x27b, lpOverlapped=0x0) returned 1 [0120.786] CloseHandle (hObject=0x154) returned 1 [0120.802] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png", lpFilePart=0x0) returned 0x71 [0120.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.802] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7xcq3[2].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.803] GetFileType (hFile=0x154) returned 0x1 [0120.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.803] GetFileType (hFile=0x154) returned 0x1 [0120.803] WriteFile (in: hFile=0x154, lpBuffer=0x1abf964*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1abf964*, lpNumberOfBytesWritten=0x2ae270*=0x280, lpOverlapped=0x0) returned 1 [0120.804] CloseHandle (hObject=0x154) returned 1 [0120.804] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png", lpFilePart=0x0) returned 0x71 [0120.804] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.804] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7xcq3[2].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7943db00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b140720, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6f196d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x280)) returned 1 [0120.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.805] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7xcq3[2].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7XCQ3[2].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7xcq3[2].png.anonymous")) returned 1 [0120.805] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png", lpFilePart=0x0) returned 0x71 [0120.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.805] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7zvad[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.806] GetFileType (hFile=0x154) returned 0x1 [0120.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.806] GetFileType (hFile=0x154) returned 0x1 [0120.806] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1dc [0120.806] ReadFile (in: hFile=0x154, lpBuffer=0x1ac0fdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ac0fdc*, lpNumberOfBytesRead=0x2ae2a8*=0x1dc, lpOverlapped=0x0) returned 1 [0120.817] CloseHandle (hObject=0x154) returned 1 [0120.833] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png", lpFilePart=0x0) returned 0x71 [0120.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.833] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7zvad[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.835] GetFileType (hFile=0x154) returned 0x1 [0120.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.835] GetFileType (hFile=0x154) returned 0x1 [0120.835] WriteFile (in: hFile=0x154, lpBuffer=0x1b0f8ac*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b0f8ac*, lpNumberOfBytesWritten=0x2ae270*=0x1e0, lpOverlapped=0x0) returned 1 [0120.836] CloseHandle (hObject=0x154) returned 1 [0120.836] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png", lpFilePart=0x0) returned 0x71 [0120.837] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7zvad[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc07ea0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc07ea0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6f65990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1 [0120.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.837] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7zvad[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA7zvAd[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa7zvad[1].png.anonymous")) returned 1 [0120.838] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png", lpFilePart=0x0) returned 0x71 [0120.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.838] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa8uco4[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.838] GetFileType (hFile=0x154) returned 0x1 [0120.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.838] GetFileType (hFile=0x154) returned 0x1 [0120.838] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2c8 [0120.838] ReadFile (in: hFile=0x154, lpBuffer=0x1b11010, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b11010*, lpNumberOfBytesRead=0x2ae2a8*=0x2c8, lpOverlapped=0x0) returned 1 [0120.859] CloseHandle (hObject=0x154) returned 1 [0120.871] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png", lpFilePart=0x0) returned 0x71 [0120.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0120.871] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa8uco4[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.873] GetFileType (hFile=0x154) returned 0x1 [0120.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0120.873] GetFileType (hFile=0x154) returned 0x1 [0120.873] WriteFile (in: hFile=0x154, lpBuffer=0x1b5fd94*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b5fd94*, lpNumberOfBytesWritten=0x2ae270*=0x2d0, lpOverlapped=0x0) returned 1 [0120.874] CloseHandle (hObject=0x154) returned 1 [0120.874] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png", lpFilePart=0x0) returned 0x71 [0120.874] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0120.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0120.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa8uco4[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x792287c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0f4460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe6fb1c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1 [0120.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0120.874] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AA8uCo4[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aa8uco4[1].png.anonymous")) returned 1 [0120.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png", lpFilePart=0x0) returned 0x71 [0120.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0120.905] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaa1vhm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0120.905] GetFileType (hFile=0x154) returned 0x1 [0120.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0120.905] GetFileType (hFile=0x154) returned 0x1 [0120.905] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x19e [0120.905] ReadFile (in: hFile=0x154, lpBuffer=0x1b613d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b613d0*, lpNumberOfBytesRead=0x2ae2a8*=0x19e, lpOverlapped=0x0) returned 1 [0120.933] CloseHandle (hObject=0x154) returned 1 [0121.005] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png", lpFilePart=0x0) returned 0x71 [0121.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.005] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaa1vhm[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.006] GetFileType (hFile=0x154) returned 0x1 [0121.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.006] GetFileType (hFile=0x154) returned 0x1 [0121.006] WriteFile (in: hFile=0x154, lpBuffer=0x19afbcc*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19afbcc*, lpNumberOfBytesWritten=0x2ae270*=0x1a0, lpOverlapped=0x0) returned 1 [0121.007] CloseHandle (hObject=0x154) returned 1 [0121.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png", lpFilePart=0x0) returned 0x71 [0121.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaa1vhm[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8363b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8363b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe71088b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0121.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.008] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAa1vhm[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaa1vhm[1].png.anonymous")) returned 1 [0121.008] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png", lpFilePart=0x0) returned 0x71 [0121.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.008] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaag599[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.009] GetFileType (hFile=0x154) returned 0x1 [0121.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.009] GetFileType (hFile=0x154) returned 0x1 [0121.009] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x18c [0121.009] ReadFile (in: hFile=0x154, lpBuffer=0x19b11f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b11f4*, lpNumberOfBytesRead=0x2ae2a8*=0x18c, lpOverlapped=0x0) returned 1 [0121.021] CloseHandle (hObject=0x154) returned 1 [0121.032] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png", lpFilePart=0x0) returned 0x71 [0121.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.032] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaag599[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.033] GetFileType (hFile=0x154) returned 0x1 [0121.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.033] GetFileType (hFile=0x154) returned 0x1 [0121.034] WriteFile (in: hFile=0x154, lpBuffer=0x19ffa90*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19ffa90*, lpNumberOfBytesWritten=0x2ae270*=0x190, lpOverlapped=0x0) returned 1 [0121.034] CloseHandle (hObject=0x154) returned 1 [0121.035] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png", lpFilePart=0x0) returned 0x71 [0121.035] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaag599[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c366ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c366ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7154b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x190)) returned 1 [0121.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.035] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaag599[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAag599[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaag599[1].png.anonymous")) returned 1 [0121.035] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png", lpFilePart=0x0) returned 0x71 [0121.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.035] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aacn2ks[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.036] GetFileType (hFile=0x154) returned 0x1 [0121.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.036] GetFileType (hFile=0x154) returned 0x1 [0121.036] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2b1 [0121.036] ReadFile (in: hFile=0x154, lpBuffer=0x1a011e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a011e0*, lpNumberOfBytesRead=0x2ae2a8*=0x2b1, lpOverlapped=0x0) returned 1 [0121.076] CloseHandle (hObject=0x154) returned 1 [0121.088] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png", lpFilePart=0x0) returned 0x71 [0121.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.088] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aacn2ks[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.090] GetFileType (hFile=0x154) returned 0x1 [0121.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.090] GetFileType (hFile=0x154) returned 0x1 [0121.090] WriteFile (in: hFile=0x154, lpBuffer=0x1a4ff1c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a4ff1c*, lpNumberOfBytesWritten=0x2ae270*=0x2c0, lpOverlapped=0x0) returned 1 [0121.091] CloseHandle (hObject=0x154) returned 1 [0121.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png", lpFilePart=0x0) returned 0x71 [0121.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aacn2ks[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b140720, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b140720, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe71c6f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1 [0121.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.092] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aacn2ks[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAcN2Ks[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aacn2ks[1].png.anonymous")) returned 1 [0121.093] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png", lpFilePart=0x0) returned 0x71 [0121.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.093] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aadavrm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.093] GetFileType (hFile=0x154) returned 0x1 [0121.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.093] GetFileType (hFile=0x154) returned 0x1 [0121.093] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x342 [0121.093] ReadFile (in: hFile=0x154, lpBuffer=0x1a516fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a516fc*, lpNumberOfBytesRead=0x2ae2a8*=0x342, lpOverlapped=0x0) returned 1 [0121.109] CloseHandle (hObject=0x154) returned 1 [0121.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png", lpFilePart=0x0) returned 0x71 [0121.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.120] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aadavrm[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.122] GetFileType (hFile=0x154) returned 0x1 [0121.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.122] GetFileType (hFile=0x154) returned 0x1 [0121.122] WriteFile (in: hFile=0x154, lpBuffer=0x1aa0708*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa0708*, lpNumberOfBytesWritten=0x2ae270*=0x350, lpOverlapped=0x0) returned 1 [0121.123] CloseHandle (hObject=0x154) returned 1 [0121.123] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png", lpFilePart=0x0) returned 0x71 [0121.123] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aadavrm[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cb6f920, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cb6f920, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7213250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0121.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.123] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aadavrm[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAdAVrM[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aadavrm[1].png.anonymous")) returned 1 [0121.126] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg", lpFilePart=0x0) returned 0x71 [0121.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.126] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaicw5w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.144] GetFileType (hFile=0x154) returned 0x1 [0121.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.144] GetFileType (hFile=0x154) returned 0x1 [0121.144] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x340b [0121.144] ReadFile (in: hFile=0x154, lpBuffer=0x1aa1b98, nNumberOfBytesToRead=0x340b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa1b98*, lpNumberOfBytesRead=0x2ae2a8*=0x340b, lpOverlapped=0x0) returned 1 [0121.166] CloseHandle (hObject=0x154) returned 1 [0121.178] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg", lpFilePart=0x0) returned 0x71 [0121.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.178] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaicw5w[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.180] GetFileType (hFile=0x154) returned 0x1 [0121.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.180] GetFileType (hFile=0x154) returned 0x1 [0121.180] WriteFile (in: hFile=0x154, lpBuffer=0x1afedd4*, nNumberOfBytesToWrite=0x3410, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1afedd4*, lpNumberOfBytesWritten=0x2ae29c*=0x3410, lpOverlapped=0x0) returned 1 [0121.181] CloseHandle (hObject=0x154) returned 1 [0121.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg", lpFilePart=0x0) returned 0x71 [0121.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaicw5w[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c57c220, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c57c220, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe72ab7d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3410)) returned 1 [0121.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.181] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAicW5W[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aaicw5w[1].jpg.anonymous")) returned 1 [0121.182] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png", lpFilePart=0x0) returned 0x71 [0121.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.182] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aam2un1[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.183] GetFileType (hFile=0x154) returned 0x1 [0121.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.183] GetFileType (hFile=0x154) returned 0x1 [0121.183] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x19a [0121.183] ReadFile (in: hFile=0x154, lpBuffer=0x1b02994, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b02994*, lpNumberOfBytesRead=0x2ae2a8*=0x19a, lpOverlapped=0x0) returned 1 [0121.204] CloseHandle (hObject=0x154) returned 1 [0121.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png", lpFilePart=0x0) returned 0x71 [0121.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.216] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aam2un1[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.217] GetFileType (hFile=0x154) returned 0x1 [0121.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.217] GetFileType (hFile=0x154) returned 0x1 [0121.217] WriteFile (in: hFile=0x154, lpBuffer=0x1b51128*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b51128*, lpNumberOfBytesWritten=0x2ae270*=0x1a0, lpOverlapped=0x0) returned 1 [0121.219] CloseHandle (hObject=0x154) returned 1 [0121.219] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png", lpFilePart=0x0) returned 0x71 [0121.219] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aam2un1[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4bdb40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4bdb40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe731dbf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0121.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.219] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aam2un1[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAm2UN1[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aam2un1[1].png.anonymous")) returned 1 [0121.220] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png", lpFilePart=0x0) returned 0x71 [0121.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.220] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aamry2q[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.220] GetFileType (hFile=0x154) returned 0x1 [0121.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.220] GetFileType (hFile=0x154) returned 0x1 [0121.220] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x12c [0121.220] ReadFile (in: hFile=0x154, lpBuffer=0x1b526f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b526f0*, lpNumberOfBytesRead=0x2ae2a8*=0x12c, lpOverlapped=0x0) returned 1 [0121.278] CloseHandle (hObject=0x154) returned 1 [0121.323] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png", lpFilePart=0x0) returned 0x71 [0121.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.323] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aamry2q[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.324] GetFileType (hFile=0x154) returned 0x1 [0121.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.324] GetFileType (hFile=0x154) returned 0x1 [0121.324] WriteFile (in: hFile=0x154, lpBuffer=0x19a0c1c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a0c1c*, lpNumberOfBytesWritten=0x2ae270*=0x130, lpOverlapped=0x0) returned 1 [0121.326] CloseHandle (hObject=0x154) returned 1 [0121.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png", lpFilePart=0x0) returned 0x71 [0121.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aamry2q[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4979e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4979e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7402430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1 [0121.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.326] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aamry2q[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\AAmRY2Q[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\aamry2q[1].png.anonymous")) returned 1 [0121.328] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png", lpFilePart=0x0) returned 0x71 [0121.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.328] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6abyr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.328] GetFileType (hFile=0x154) returned 0x1 [0121.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.329] GetFileType (hFile=0x154) returned 0x1 [0121.329] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x23e [0121.329] ReadFile (in: hFile=0x154, lpBuffer=0x19a2360, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a2360*, lpNumberOfBytesRead=0x2ae2a8*=0x23e, lpOverlapped=0x0) returned 1 [0121.355] CloseHandle (hObject=0x154) returned 1 [0121.368] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png", lpFilePart=0x0) returned 0x71 [0121.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.368] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6abyr[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.369] GetFileType (hFile=0x154) returned 0x1 [0121.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.369] GetFileType (hFile=0x154) returned 0x1 [0121.369] WriteFile (in: hFile=0x154, lpBuffer=0x19f0f6c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19f0f6c*, lpNumberOfBytesWritten=0x2ae270*=0x240, lpOverlapped=0x0) returned 1 [0121.370] CloseHandle (hObject=0x154) returned 1 [0121.370] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png", lpFilePart=0x0) returned 0x71 [0121.370] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.370] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6abyr[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9d92d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9d92d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7474850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0121.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.370] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6abyr[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6AbYr[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6abyr[1].png.anonymous")) returned 1 [0121.371] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png", lpFilePart=0x0) returned 0x71 [0121.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.371] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6ma4a[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.372] GetFileType (hFile=0x154) returned 0x1 [0121.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.372] GetFileType (hFile=0x154) returned 0x1 [0121.372] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x18c [0121.372] ReadFile (in: hFile=0x154, lpBuffer=0x19f2594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f2594*, lpNumberOfBytesRead=0x2ae2a8*=0x18c, lpOverlapped=0x0) returned 1 [0121.387] CloseHandle (hObject=0x154) returned 1 [0121.399] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png", lpFilePart=0x0) returned 0x71 [0121.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.399] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6ma4a[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.400] GetFileType (hFile=0x154) returned 0x1 [0121.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.400] GetFileType (hFile=0x154) returned 0x1 [0121.400] WriteFile (in: hFile=0x154, lpBuffer=0x1a40cd4*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a40cd4*, lpNumberOfBytesWritten=0x2ae270*=0x190, lpOverlapped=0x0) returned 1 [0121.401] CloseHandle (hObject=0x154) returned 1 [0121.401] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png", lpFilePart=0x0) returned 0x71 [0121.401] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6ma4a[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c31ac20, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c31ac20, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe74c0b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x190)) returned 1 [0121.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.401] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB6Ma4a[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb6ma4a[1].png.anonymous")) returned 1 [0121.402] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png", lpFilePart=0x0) returned 0x71 [0121.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.402] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb74fls[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.403] GetFileType (hFile=0x154) returned 0x1 [0121.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.403] GetFileType (hFile=0x154) returned 0x1 [0121.403] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x168 [0121.403] ReadFile (in: hFile=0x154, lpBuffer=0x1a422d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a422d8*, lpNumberOfBytesRead=0x2ae2a8*=0x168, lpOverlapped=0x0) returned 1 [0121.426] CloseHandle (hObject=0x154) returned 1 [0121.438] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png", lpFilePart=0x0) returned 0x71 [0121.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.438] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb74fls[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.439] GetFileType (hFile=0x154) returned 0x1 [0121.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.439] GetFileType (hFile=0x154) returned 0x1 [0121.439] WriteFile (in: hFile=0x154, lpBuffer=0x1a9097c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a9097c*, lpNumberOfBytesWritten=0x2ae270*=0x170, lpOverlapped=0x0) returned 1 [0121.440] CloseHandle (hObject=0x154) returned 1 [0121.441] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png", lpFilePart=0x0) returned 0x71 [0121.441] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0121.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.441] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb74fls[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1ea120, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c1ea120, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7532f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1 [0121.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.441] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb74fls[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB74fLs[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb74fls[1].png.anonymous")) returned 1 [0121.441] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png", lpFilePart=0x0) returned 0x70 [0121.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.441] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb7gre[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.442] GetFileType (hFile=0x154) returned 0x1 [0121.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.442] GetFileType (hFile=0x154) returned 0x1 [0121.442] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1e2 [0121.442] ReadFile (in: hFile=0x154, lpBuffer=0x1a91ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a91ff8*, lpNumberOfBytesRead=0x2ae2a8*=0x1e2, lpOverlapped=0x0) returned 1 [0121.457] CloseHandle (hObject=0x154) returned 1 [0121.469] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png", lpFilePart=0x0) returned 0x70 [0121.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.469] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb7gre[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.470] GetFileType (hFile=0x154) returned 0x1 [0121.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.470] GetFileType (hFile=0x154) returned 0x1 [0121.470] WriteFile (in: hFile=0x154, lpBuffer=0x1ae0920*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ae0920*, lpNumberOfBytesWritten=0x2ae270*=0x1f0, lpOverlapped=0x0) returned 1 [0121.471] CloseHandle (hObject=0x154) returned 1 [0121.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png", lpFilePart=0x0) returned 0x70 [0121.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png.anonymous", lpFilePart=0x0) returned 0x7a [0121.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb7gre[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c340d80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c340d80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe757f1f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1 [0121.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.472] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb7gre[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BB7gRE[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bb7gre[1].png.anonymous")) returned 1 [0121.472] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg", lpFilePart=0x0) returned 0x71 [0121.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.472] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbb8zbm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.473] GetFileType (hFile=0x154) returned 0x1 [0121.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.473] GetFileType (hFile=0x154) returned 0x1 [0121.473] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1c22 [0121.473] ReadFile (in: hFile=0x154, lpBuffer=0x1ae1db0, nNumberOfBytesToRead=0x1c22, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ae1db0*, lpNumberOfBytesRead=0x2ae2a8*=0x1c22, lpOverlapped=0x0) returned 1 [0121.482] CloseHandle (hObject=0x154) returned 1 [0121.494] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg", lpFilePart=0x0) returned 0x71 [0121.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.494] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbb8zbm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.495] GetFileType (hFile=0x154) returned 0x1 [0121.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.495] GetFileType (hFile=0x154) returned 0x1 [0121.495] WriteFile (in: hFile=0x154, lpBuffer=0x1b3788c*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b3788c*, lpNumberOfBytesWritten=0x2ae29c*=0x1c30, lpOverlapped=0x0) returned 1 [0121.496] CloseHandle (hObject=0x154) returned 1 [0121.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg", lpFilePart=0x0) returned 0x71 [0121.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbb8zbm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c57c220, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c57c220, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe75a5350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c30)) returned 1 [0121.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.497] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBB8ZbM[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbb8zbm[1].jpg.anonymous")) returned 1 [0121.497] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg", lpFilePart=0x0) returned 0x71 [0121.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.497] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbbcmb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.497] GetFileType (hFile=0x154) returned 0x1 [0121.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.497] GetFileType (hFile=0x154) returned 0x1 [0121.497] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24d8 [0121.498] ReadFile (in: hFile=0x154, lpBuffer=0x1b39ac4, nNumberOfBytesToRead=0x24d8, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b39ac4*, lpNumberOfBytesRead=0x2ae2a8*=0x24d8, lpOverlapped=0x0) returned 1 [0121.500] CloseHandle (hObject=0x154) returned 1 [0121.514] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg", lpFilePart=0x0) returned 0x71 [0121.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.515] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbbcmb[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.516] GetFileType (hFile=0x154) returned 0x1 [0121.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.516] GetFileType (hFile=0x154) returned 0x1 [0121.516] WriteFile (in: hFile=0x154, lpBuffer=0x1996c5c*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1996c5c*, lpNumberOfBytesWritten=0x2ae29c*=0x24e0, lpOverlapped=0x0) returned 1 [0121.517] CloseHandle (hObject=0x154) returned 1 [0121.517] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg", lpFilePart=0x0) returned 0x71 [0121.517] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbbcmb[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d882670, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d882670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe75f1610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24e0)) returned 1 [0121.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.518] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbbcmb[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBBcMB[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbbcmb[1].jpg.anonymous")) returned 1 [0121.518] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg", lpFilePart=0x0) returned 0x71 [0121.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.518] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbcl6s[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.518] GetFileType (hFile=0x154) returned 0x1 [0121.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.518] GetFileType (hFile=0x154) returned 0x1 [0121.518] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x87f [0121.518] ReadFile (in: hFile=0x154, lpBuffer=0x1999fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1999fd0*, lpNumberOfBytesRead=0x2ae2a8*=0x87f, lpOverlapped=0x0) returned 1 [0121.539] CloseHandle (hObject=0x154) returned 1 [0121.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg", lpFilePart=0x0) returned 0x71 [0121.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.584] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbcl6s[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.585] GetFileType (hFile=0x154) returned 0x1 [0121.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.585] GetFileType (hFile=0x154) returned 0x1 [0121.585] WriteFile (in: hFile=0x154, lpBuffer=0x19eab1c*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19eab1c*, lpNumberOfBytesWritten=0x2ae270*=0x880, lpOverlapped=0x0) returned 1 [0121.587] CloseHandle (hObject=0x154) returned 1 [0121.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg", lpFilePart=0x0) returned 0x71 [0121.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbcl6s[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7ea0f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7ea0f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7689b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x880)) returned 1 [0121.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.587] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbcl6s[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBCl6S[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbcl6s[1].jpg.anonymous")) returned 1 [0121.588] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg", lpFilePart=0x0) returned 0x71 [0121.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.588] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.588] GetFileType (hFile=0x154) returned 0x1 [0121.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.588] GetFileType (hFile=0x154) returned 0x1 [0121.588] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xb76 [0121.588] ReadFile (in: hFile=0x154, lpBuffer=0x19ecb30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19ecb30*, lpNumberOfBytesRead=0x2ae2a8*=0xb76, lpOverlapped=0x0) returned 1 [0121.590] CloseHandle (hObject=0x154) returned 1 [0121.608] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg", lpFilePart=0x0) returned 0x71 [0121.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.609] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hf[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.610] GetFileType (hFile=0x154) returned 0x1 [0121.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.610] GetFileType (hFile=0x154) returned 0x1 [0121.610] WriteFile (in: hFile=0x154, lpBuffer=0x1a3e428*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a3e428*, lpNumberOfBytesWritten=0x2ae270*=0xb80, lpOverlapped=0x0) returned 1 [0121.612] CloseHandle (hObject=0x154) returned 1 [0121.612] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg", lpFilePart=0x0) returned 0x71 [0121.612] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hf[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8363b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8363b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe76d5e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb80)) returned 1 [0121.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.612] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hf[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6hf[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hf[1].jpg.anonymous")) returned 1 [0121.613] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg", lpFilePart=0x0) returned 0x71 [0121.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.613] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.613] GetFileType (hFile=0x154) returned 0x1 [0121.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.613] GetFileType (hFile=0x154) returned 0x1 [0121.613] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x970 [0121.614] ReadFile (in: hFile=0x154, lpBuffer=0x1a40234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a40234*, lpNumberOfBytesRead=0x2ae2a8*=0x970, lpOverlapped=0x0) returned 1 [0121.615] CloseHandle (hObject=0x154) returned 1 [0121.633] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg", lpFilePart=0x0) returned 0x71 [0121.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.633] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hy[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.635] GetFileType (hFile=0x154) returned 0x1 [0121.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.635] GetFileType (hFile=0x154) returned 0x1 [0121.635] WriteFile (in: hFile=0x154, lpBuffer=0x1a91130*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a91130*, lpNumberOfBytesWritten=0x2ae270*=0x980, lpOverlapped=0x0) returned 1 [0121.636] CloseHandle (hObject=0x154) returned 1 [0121.636] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg", lpFilePart=0x0) returned 0x71 [0121.636] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hy[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8ce930, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8ce930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe76fbfb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x980)) returned 1 [0121.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.637] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hy[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBD6Hy[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbd6hy[1].jpg.anonymous")) returned 1 [0121.637] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg", lpFilePart=0x0) returned 0x71 [0121.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.637] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfbso[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.638] GetFileType (hFile=0x154) returned 0x1 [0121.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.638] GetFileType (hFile=0x154) returned 0x1 [0121.638] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7fe [0121.638] ReadFile (in: hFile=0x154, lpBuffer=0x1a92dcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a92dcc*, lpNumberOfBytesRead=0x2ae2a8*=0x7fe, lpOverlapped=0x0) returned 1 [0121.640] CloseHandle (hObject=0x154) returned 1 [0121.658] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg", lpFilePart=0x0) returned 0x71 [0121.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.658] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfbso[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.660] GetFileType (hFile=0x154) returned 0x1 [0121.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.660] GetFileType (hFile=0x154) returned 0x1 [0121.660] WriteFile (in: hFile=0x154, lpBuffer=0x1ae353c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ae353c*, lpNumberOfBytesWritten=0x2ae270*=0x800, lpOverlapped=0x0) returned 1 [0121.661] CloseHandle (hObject=0x154) returned 1 [0121.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg", lpFilePart=0x0) returned 0x71 [0121.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfbso[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d85c510, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d85c510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7748270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1 [0121.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.662] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfbso[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFBSO[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfbso[1].jpg.anonymous")) returned 1 [0121.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg", lpFilePart=0x0) returned 0x71 [0121.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.663] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfgg0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.664] GetFileType (hFile=0x154) returned 0x1 [0121.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.664] GetFileType (hFile=0x154) returned 0x1 [0121.664] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xc22 [0121.664] ReadFile (in: hFile=0x154, lpBuffer=0x1ae55fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ae55fc*, lpNumberOfBytesRead=0x2ae2a8*=0xc22, lpOverlapped=0x0) returned 1 [0121.666] CloseHandle (hObject=0x154) returned 1 [0121.683] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg", lpFilePart=0x0) returned 0x71 [0121.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.683] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfgg0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.685] GetFileType (hFile=0x154) returned 0x1 [0121.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.685] GetFileType (hFile=0x154) returned 0x1 [0121.685] WriteFile (in: hFile=0x154, lpBuffer=0x1b37268*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b37268*, lpNumberOfBytesWritten=0x2ae270*=0xc30, lpOverlapped=0x0) returned 1 [0121.686] CloseHandle (hObject=0x154) returned 1 [0121.686] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg", lpFilePart=0x0) returned 0x71 [0121.686] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfgg0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d777cd0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d777cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7794530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc30)) returned 1 [0121.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.686] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfgg0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFGg0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfgg0[1].jpg.anonymous")) returned 1 [0121.687] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg", lpFilePart=0x0) returned 0x71 [0121.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.687] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbflrg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.687] GetFileType (hFile=0x154) returned 0x1 [0121.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.687] GetFileType (hFile=0x154) returned 0x1 [0121.687] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1bae [0121.688] ReadFile (in: hFile=0x154, lpBuffer=0x1b386f8, nNumberOfBytesToRead=0x1bae, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b386f8*, lpNumberOfBytesRead=0x2ae2a8*=0x1bae, lpOverlapped=0x0) returned 1 [0121.689] CloseHandle (hObject=0x154) returned 1 [0121.701] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg", lpFilePart=0x0) returned 0x71 [0121.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.701] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbflrg[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.703] GetFileType (hFile=0x154) returned 0x1 [0121.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.703] GetFileType (hFile=0x154) returned 0x1 [0121.703] WriteFile (in: hFile=0x154, lpBuffer=0x1b8df54*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b8df54*, lpNumberOfBytesWritten=0x2ae29c*=0x1bb0, lpOverlapped=0x0) returned 1 [0121.704] CloseHandle (hObject=0x154) returned 1 [0121.704] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg", lpFilePart=0x0) returned 0x71 [0121.704] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbflrg[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7c3f90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7c3f90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe77ba690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1bb0)) returned 1 [0121.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.705] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbflrg[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFLrg[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbflrg[1].jpg.anonymous")) returned 1 [0121.705] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg", lpFilePart=0x0) returned 0x71 [0121.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.705] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbftbc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.705] GetFileType (hFile=0x154) returned 0x1 [0121.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.705] GetFileType (hFile=0x154) returned 0x1 [0121.705] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x124b [0121.708] ReadFile (in: hFile=0x154, lpBuffer=0x198ae5c, nNumberOfBytesToRead=0x124b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x198ae5c*, lpNumberOfBytesRead=0x2ae2a8*=0x124b, lpOverlapped=0x0) returned 1 [0121.710] CloseHandle (hObject=0x154) returned 1 [0121.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg", lpFilePart=0x0) returned 0x71 [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.745] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbftbc[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.746] GetFileType (hFile=0x154) returned 0x1 [0121.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.746] GetFileType (hFile=0x154) returned 0x1 [0121.746] WriteFile (in: hFile=0x154, lpBuffer=0x19dd934*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19dd934*, lpNumberOfBytesWritten=0x2ae29c*=0x1250, lpOverlapped=0x0) returned 1 [0121.747] CloseHandle (hObject=0x154) returned 1 [0121.747] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg", lpFilePart=0x0) returned 0x71 [0121.748] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbftbc[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7ea0f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7ea0f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7806950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1250)) returned 1 [0121.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.748] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbftbc[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFTBc[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbftbc[1].jpg.anonymous")) returned 1 [0121.749] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg", lpFilePart=0x0) returned 0x71 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.749] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfzcv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.749] GetFileType (hFile=0x154) returned 0x1 [0121.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.749] GetFileType (hFile=0x154) returned 0x1 [0121.749] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x849 [0121.749] ReadFile (in: hFile=0x154, lpBuffer=0x19df9e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19df9e4*, lpNumberOfBytesRead=0x2ae2a8*=0x849, lpOverlapped=0x0) returned 1 [0121.750] CloseHandle (hObject=0x154) returned 1 [0121.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg", lpFilePart=0x0) returned 0x71 [0121.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.762] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfzcv[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.763] GetFileType (hFile=0x154) returned 0x1 [0121.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.763] GetFileType (hFile=0x154) returned 0x1 [0121.764] WriteFile (in: hFile=0x154, lpBuffer=0x1a302e8*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a302e8*, lpNumberOfBytesWritten=0x2ae270*=0x850, lpOverlapped=0x0) returned 1 [0121.765] CloseHandle (hObject=0x154) returned 1 [0121.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg", lpFilePart=0x0) returned 0x71 [0121.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfzcv[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d79de30, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d79de30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7852c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x850)) returned 1 [0121.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.765] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfzcv[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBFZcV[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbfzcv[1].jpg.anonymous")) returned 1 [0121.766] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg", lpFilePart=0x0) returned 0x71 [0121.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.766] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgefe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.766] GetFileType (hFile=0x154) returned 0x1 [0121.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.766] GetFileType (hFile=0x154) returned 0x1 [0121.766] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x999 [0121.766] ReadFile (in: hFile=0x154, lpBuffer=0x1a32120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a32120*, lpNumberOfBytesRead=0x2ae2a8*=0x999, lpOverlapped=0x0) returned 1 [0121.780] CloseHandle (hObject=0x154) returned 1 [0121.792] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg", lpFilePart=0x0) returned 0x71 [0121.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.793] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgefe[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.794] GetFileType (hFile=0x154) returned 0x1 [0121.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.794] GetFileType (hFile=0x154) returned 0x1 [0121.794] WriteFile (in: hFile=0x154, lpBuffer=0x1a830b4*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a830b4*, lpNumberOfBytesWritten=0x2ae270*=0x9a0, lpOverlapped=0x0) returned 1 [0121.795] CloseHandle (hObject=0x154) returned 1 [0121.795] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg", lpFilePart=0x0) returned 0x71 [0121.796] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgefe[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6df750, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6df750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe789eed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0121.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.796] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgefe[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGEfE[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgefe[1].jpg.anonymous")) returned 1 [0121.796] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg", lpFilePart=0x0) returned 0x71 [0121.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.796] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgutv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.797] GetFileType (hFile=0x154) returned 0x1 [0121.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.797] GetFileType (hFile=0x154) returned 0x1 [0121.797] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1b0a [0121.797] ReadFile (in: hFile=0x154, lpBuffer=0x1a84544, nNumberOfBytesToRead=0x1b0a, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a84544*, lpNumberOfBytesRead=0x2ae2a8*=0x1b0a, lpOverlapped=0x0) returned 1 [0121.808] CloseHandle (hObject=0x154) returned 1 [0121.821] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg", lpFilePart=0x0) returned 0x71 [0121.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.821] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgutv[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.823] GetFileType (hFile=0x154) returned 0x1 [0121.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.823] GetFileType (hFile=0x154) returned 0x1 [0121.823] WriteFile (in: hFile=0x154, lpBuffer=0x1ad9a80*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ad9a80*, lpNumberOfBytesWritten=0x2ae29c*=0x1b10, lpOverlapped=0x0) returned 1 [0121.824] CloseHandle (hObject=0x154) returned 1 [0121.824] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg", lpFilePart=0x0) returned 0x71 [0121.824] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgutv[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4a42b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d4a42b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe78c5030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b10)) returned 1 [0121.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.824] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgutv[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBGutV[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbgutv[1].jpg.anonymous")) returned 1 [0121.825] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg", lpFilePart=0x0) returned 0x71 [0121.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.825] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbibb5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.825] GetFileType (hFile=0x154) returned 0x1 [0121.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.825] GetFileType (hFile=0x154) returned 0x1 [0121.825] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xae3 [0121.825] ReadFile (in: hFile=0x154, lpBuffer=0x1adc688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1adc688*, lpNumberOfBytesRead=0x2ae2a8*=0xae3, lpOverlapped=0x0) returned 1 [0121.828] CloseHandle (hObject=0x154) returned 1 [0121.840] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg", lpFilePart=0x0) returned 0x71 [0121.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.840] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbibb5[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.841] GetFileType (hFile=0x154) returned 0x1 [0121.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.841] GetFileType (hFile=0x154) returned 0x1 [0121.841] WriteFile (in: hFile=0x154, lpBuffer=0x1b2dcb4*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b2dcb4*, lpNumberOfBytesWritten=0x2ae270*=0xaf0, lpOverlapped=0x0) returned 1 [0121.842] CloseHandle (hObject=0x154) returned 1 [0121.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg", lpFilePart=0x0) returned 0x71 [0121.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbibb5[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7058b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7058b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe79112f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaf0)) returned 1 [0121.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.843] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbibb5[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIBB5[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbibb5[1].jpg.anonymous")) returned 1 [0121.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg", lpFilePart=0x0) returned 0x71 [0121.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.843] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbicv4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.844] GetFileType (hFile=0x154) returned 0x1 [0121.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.844] GetFileType (hFile=0x154) returned 0x1 [0121.844] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7c9 [0121.844] ReadFile (in: hFile=0x154, lpBuffer=0x1b2f91c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b2f91c*, lpNumberOfBytesRead=0x2ae2a8*=0x7c9, lpOverlapped=0x0) returned 1 [0121.845] CloseHandle (hObject=0x154) returned 1 [0121.856] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg", lpFilePart=0x0) returned 0x71 [0121.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.856] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbicv4[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.858] GetFileType (hFile=0x154) returned 0x1 [0121.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.858] GetFileType (hFile=0x154) returned 0x1 [0121.858] WriteFile (in: hFile=0x154, lpBuffer=0x1b7ffa0*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b7ffa0*, lpNumberOfBytesWritten=0x2ae270*=0x7d0, lpOverlapped=0x0) returned 1 [0121.859] CloseHandle (hObject=0x154) returned 1 [0121.859] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg", lpFilePart=0x0) returned 0x71 [0121.859] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbicv4[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9ff430, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9ff430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7937450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0121.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.859] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbicv4[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBICv4[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbicv4[1].jpg.anonymous")) returned 1 [0121.860] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg", lpFilePart=0x0) returned 0x71 [0121.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.860] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbidzd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.860] GetFileType (hFile=0x154) returned 0x1 [0121.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.860] GetFileType (hFile=0x154) returned 0x1 [0121.860] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2244 [0121.860] ReadFile (in: hFile=0x154, lpBuffer=0x1b81430, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b81430*, lpNumberOfBytesRead=0x2ae2a8*=0x2244, lpOverlapped=0x0) returned 1 [0121.862] CloseHandle (hObject=0x154) returned 1 [0121.910] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg", lpFilePart=0x0) returned 0x71 [0121.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.911] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbidzd[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.912] GetFileType (hFile=0x154) returned 0x1 [0121.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.912] GetFileType (hFile=0x154) returned 0x1 [0121.912] WriteFile (in: hFile=0x154, lpBuffer=0x19db1cc*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19db1cc*, lpNumberOfBytesWritten=0x2ae29c*=0x2250, lpOverlapped=0x0) returned 1 [0121.913] CloseHandle (hObject=0x154) returned 1 [0121.913] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg", lpFilePart=0x0) returned 0x71 [0121.913] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.913] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbidzd[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d751b70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d751b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe79a9870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2250)) returned 1 [0121.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.914] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbidzd[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIDZd[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbidzd[1].jpg.anonymous")) returned 1 [0121.914] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg", lpFilePart=0x0) returned 0x71 [0121.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.914] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbiec9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.915] GetFileType (hFile=0x154) returned 0x1 [0121.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.915] GetFileType (hFile=0x154) returned 0x1 [0121.915] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24b6 [0121.915] ReadFile (in: hFile=0x154, lpBuffer=0x19dda24, nNumberOfBytesToRead=0x24b6, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19dda24*, lpNumberOfBytesRead=0x2ae2a8*=0x24b6, lpOverlapped=0x0) returned 1 [0121.921] CloseHandle (hObject=0x154) returned 1 [0121.933] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg", lpFilePart=0x0) returned 0x71 [0121.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.933] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbiec9[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.934] GetFileType (hFile=0x154) returned 0x1 [0121.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.935] GetFileType (hFile=0x154) returned 0x1 [0121.935] WriteFile (in: hFile=0x154, lpBuffer=0x1a3612c*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a3612c*, lpNumberOfBytesWritten=0x2ae29c*=0x24c0, lpOverlapped=0x0) returned 1 [0121.936] CloseHandle (hObject=0x154) returned 1 [0121.936] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg", lpFilePart=0x0) returned 0x71 [0121.936] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.936] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbiec9[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d91abf0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d91abf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe79f5b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24c0)) returned 1 [0121.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.936] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbiec9[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIeC9[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbiec9[1].jpg.anonymous")) returned 1 [0121.937] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg", lpFilePart=0x0) returned 0x71 [0121.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.937] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbilwu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.937] GetFileType (hFile=0x154) returned 0x1 [0121.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.937] GetFileType (hFile=0x154) returned 0x1 [0121.937] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1fd1 [0121.937] ReadFile (in: hFile=0x154, lpBuffer=0x1a38bf4, nNumberOfBytesToRead=0x1fd1, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a38bf4*, lpNumberOfBytesRead=0x2ae2a8*=0x1fd1, lpOverlapped=0x0) returned 1 [0121.939] CloseHandle (hObject=0x154) returned 1 [0121.951] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg", lpFilePart=0x0) returned 0x71 [0121.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.951] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbilwu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.953] GetFileType (hFile=0x154) returned 0x1 [0121.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.953] GetFileType (hFile=0x154) returned 0x1 [0121.953] WriteFile (in: hFile=0x154, lpBuffer=0x1a8f940*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a8f940*, lpNumberOfBytesWritten=0x2ae29c*=0x1fe0, lpOverlapped=0x0) returned 1 [0121.954] CloseHandle (hObject=0x154) returned 1 [0121.954] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg", lpFilePart=0x0) returned 0x71 [0121.954] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbilwu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d98d010, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d98d010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7a1bc90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1fe0)) returned 1 [0121.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.954] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbilwu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIlwU[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbilwu[1].jpg.anonymous")) returned 1 [0121.955] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg", lpFilePart=0x0) returned 0x71 [0121.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.955] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbio7f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.955] GetFileType (hFile=0x154) returned 0x1 [0121.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.955] GetFileType (hFile=0x154) returned 0x1 [0121.955] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x17f1 [0121.955] ReadFile (in: hFile=0x154, lpBuffer=0x1a91f28, nNumberOfBytesToRead=0x17f1, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a91f28*, lpNumberOfBytesRead=0x2ae2a8*=0x17f1, lpOverlapped=0x0) returned 1 [0121.958] CloseHandle (hObject=0x154) returned 1 [0121.969] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg", lpFilePart=0x0) returned 0x71 [0121.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.970] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbio7f[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.971] GetFileType (hFile=0x154) returned 0x1 [0121.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.971] GetFileType (hFile=0x154) returned 0x1 [0121.971] WriteFile (in: hFile=0x154, lpBuffer=0x1ae6514*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ae6514*, lpNumberOfBytesWritten=0x2ae29c*=0x1800, lpOverlapped=0x0) returned 1 [0121.972] CloseHandle (hObject=0x154) returned 1 [0121.972] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg", lpFilePart=0x0) returned 0x71 [0121.972] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbio7f[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bfa70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d3bfa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7a41df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1800)) returned 1 [0121.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.972] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbio7f[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIo7F[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbio7f[1].jpg.anonymous")) returned 1 [0121.973] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg", lpFilePart=0x0) returned 0x71 [0121.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.973] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbishn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.973] GetFileType (hFile=0x154) returned 0x1 [0121.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.973] GetFileType (hFile=0x154) returned 0x1 [0121.973] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x947 [0121.973] ReadFile (in: hFile=0x154, lpBuffer=0x1ae8c70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ae8c70*, lpNumberOfBytesRead=0x2ae2a8*=0x947, lpOverlapped=0x0) returned 1 [0121.975] CloseHandle (hObject=0x154) returned 1 [0121.987] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg", lpFilePart=0x0) returned 0x71 [0121.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0121.987] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbishn[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.988] GetFileType (hFile=0x154) returned 0x1 [0121.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0121.988] GetFileType (hFile=0x154) returned 0x1 [0121.988] WriteFile (in: hFile=0x154, lpBuffer=0x1b39a78*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b39a78*, lpNumberOfBytesWritten=0x2ae270*=0x950, lpOverlapped=0x0) returned 1 [0121.989] CloseHandle (hObject=0x154) returned 1 [0121.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg", lpFilePart=0x0) returned 0x71 [0121.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0121.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0121.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbishn[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d966eb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d966eb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7a67f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x950)) returned 1 [0121.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0121.989] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbishn[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIsHn[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbishn[1].jpg.anonymous")) returned 1 [0121.990] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg", lpFilePart=0x0) returned 0x71 [0121.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0121.990] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbivsz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0121.991] GetFileType (hFile=0x154) returned 0x1 [0121.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0121.991] GetFileType (hFile=0x154) returned 0x1 [0121.991] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x287c [0121.991] ReadFile (in: hFile=0x154, lpBuffer=0x1b3af08, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b3af08*, lpNumberOfBytesRead=0x2ae2a8*=0x287c, lpOverlapped=0x0) returned 1 [0121.997] CloseHandle (hObject=0x154) returned 1 [0122.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg", lpFilePart=0x0) returned 0x71 [0122.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.012] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbivsz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.013] GetFileType (hFile=0x154) returned 0x1 [0122.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.013] GetFileType (hFile=0x154) returned 0x1 [0122.013] WriteFile (in: hFile=0x154, lpBuffer=0x1997e54*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1997e54*, lpNumberOfBytesWritten=0x2ae29c*=0x2880, lpOverlapped=0x0) returned 1 [0122.015] CloseHandle (hObject=0x154) returned 1 [0122.015] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg", lpFilePart=0x0) returned 0x71 [0122.015] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.015] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbivsz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x773ca390, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x773ca390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7ab4210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2880)) returned 1 [0122.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.015] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbivsz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBIvSz[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbivsz[1].jpg.anonymous")) returned 1 [0122.016] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg", lpFilePart=0x0) returned 0x71 [0122.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.016] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbblj61[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.016] GetFileType (hFile=0x154) returned 0x1 [0122.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.016] GetFileType (hFile=0x154) returned 0x1 [0122.016] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x697 [0122.016] ReadFile (in: hFile=0x154, lpBuffer=0x199b380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199b380*, lpNumberOfBytesRead=0x2ae2a8*=0x697, lpOverlapped=0x0) returned 1 [0122.033] CloseHandle (hObject=0x154) returned 1 [0122.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg", lpFilePart=0x0) returned 0x71 [0122.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.068] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbblj61[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.069] GetFileType (hFile=0x154) returned 0x1 [0122.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.069] GetFileType (hFile=0x154) returned 0x1 [0122.069] WriteFile (in: hFile=0x154, lpBuffer=0x19eb574*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19eb574*, lpNumberOfBytesWritten=0x2ae270*=0x6a0, lpOverlapped=0x0) returned 1 [0122.070] CloseHandle (hObject=0x154) returned 1 [0122.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg", lpFilePart=0x0) returned 0x71 [0122.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbblj61[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc54160, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc54160, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7b26630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6a0)) returned 1 [0122.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.071] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbblj61[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBLj61[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbblj61[1].jpg.anonymous")) returned 1 [0122.072] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg", lpFilePart=0x0) returned 0x71 [0122.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.072] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbsemp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.072] GetFileType (hFile=0x154) returned 0x1 [0122.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.072] GetFileType (hFile=0x154) returned 0x1 [0122.072] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1963 [0122.072] ReadFile (in: hFile=0x154, lpBuffer=0x19eca04, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19eca04*, lpNumberOfBytesRead=0x2ae2a8*=0x1963, lpOverlapped=0x0) returned 1 [0122.079] CloseHandle (hObject=0x154) returned 1 [0122.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg", lpFilePart=0x0) returned 0x71 [0122.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.091] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbsemp[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.092] GetFileType (hFile=0x154) returned 0x1 [0122.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.092] GetFileType (hFile=0x154) returned 0x1 [0122.092] WriteFile (in: hFile=0x154, lpBuffer=0x1a41720*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a41720*, lpNumberOfBytesWritten=0x2ae29c*=0x1970, lpOverlapped=0x0) returned 1 [0122.094] CloseHandle (hObject=0x154) returned 1 [0122.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg", lpFilePart=0x0) returned 0x71 [0122.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbsemp[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5560c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5560c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7b728f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1970)) returned 1 [0122.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.094] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBseMP[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbsemp[1].jpg.anonymous")) returned 1 [0122.104] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg", lpFilePart=0x0) returned 0x71 [0122.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.104] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbwdxc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.104] GetFileType (hFile=0x154) returned 0x1 [0122.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.104] GetFileType (hFile=0x154) returned 0x1 [0122.104] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2129 [0122.104] ReadFile (in: hFile=0x154, lpBuffer=0x1a43698, nNumberOfBytesToRead=0x2129, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a43698*, lpNumberOfBytesRead=0x2ae2a8*=0x2129, lpOverlapped=0x0) returned 1 [0122.105] CloseHandle (hObject=0x154) returned 1 [0122.117] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg", lpFilePart=0x0) returned 0x71 [0122.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.117] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbwdxc[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.119] GetFileType (hFile=0x154) returned 0x1 [0122.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.119] GetFileType (hFile=0x154) returned 0x1 [0122.119] WriteFile (in: hFile=0x154, lpBuffer=0x1a9aa74*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a9aa74*, lpNumberOfBytesWritten=0x2ae29c*=0x2130, lpOverlapped=0x0) returned 1 [0122.120] CloseHandle (hObject=0x154) returned 1 [0122.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg", lpFilePart=0x0) returned 0x71 [0122.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbwdxc[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da4b6f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da4b6f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe7b98a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2130)) returned 1 [0122.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.120] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbwdxc[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBBwDXc[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbbwdxc[1].jpg.anonymous")) returned 1 [0122.121] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg", lpFilePart=0x0) returned 0x71 [0122.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.121] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbddve8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.122] GetFileType (hFile=0x154) returned 0x1 [0122.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.122] GetFileType (hFile=0x154) returned 0x1 [0122.122] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9bf [0122.122] ReadFile (in: hFile=0x154, lpBuffer=0x1a9db78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a9db78*, lpNumberOfBytesRead=0x2ae2a8*=0x9bf, lpOverlapped=0x0) returned 1 [0122.137] CloseHandle (hObject=0x154) returned 1 [0122.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg", lpFilePart=0x0) returned 0x71 [0122.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.148] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbddve8[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.150] GetFileType (hFile=0x154) returned 0x1 [0122.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.150] GetFileType (hFile=0x154) returned 0x1 [0122.150] WriteFile (in: hFile=0x154, lpBuffer=0x1aeeba8*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aeeba8*, lpNumberOfBytesWritten=0x2ae270*=0x9c0, lpOverlapped=0x0) returned 1 [0122.151] CloseHandle (hObject=0x154) returned 1 [0122.151] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg", lpFilePart=0x0) returned 0x71 [0122.151] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbddve8[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c95a5e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c95a5e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7be4d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0122.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.151] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbddve8[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDDVe8[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbddve8[1].jpg.anonymous")) returned 1 [0122.152] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.152] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdesv0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.152] GetFileType (hFile=0x154) returned 0x1 [0122.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.152] GetFileType (hFile=0x154) returned 0x1 [0122.152] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x21e9 [0122.153] ReadFile (in: hFile=0x154, lpBuffer=0x1af0038, nNumberOfBytesToRead=0x21e9, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af0038*, lpNumberOfBytesRead=0x2ae2a8*=0x21e9, lpOverlapped=0x0) returned 1 [0122.173] CloseHandle (hObject=0x154) returned 1 [0122.188] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.188] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdesv0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.189] GetFileType (hFile=0x154) returned 0x1 [0122.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.189] GetFileType (hFile=0x154) returned 0x1 [0122.190] WriteFile (in: hFile=0x154, lpBuffer=0x1b477d4*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b477d4*, lpNumberOfBytesWritten=0x2ae29c*=0x21f0, lpOverlapped=0x0) returned 1 [0122.191] CloseHandle (hObject=0x154) returned 1 [0122.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdesv0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5ee640, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5ee640, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7c57130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21f0)) returned 1 [0122.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.191] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdesv0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDEsv0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdesv0[1].jpg.anonymous")) returned 1 [0122.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg", lpFilePart=0x0) returned 0x71 [0122.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.192] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdfl8d[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.192] GetFileType (hFile=0x154) returned 0x1 [0122.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.192] GetFileType (hFile=0x154) returned 0x1 [0122.192] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4453 [0122.193] ReadFile (in: hFile=0x154, lpBuffer=0x1b49fcc, nNumberOfBytesToRead=0x4453, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b49fcc*, lpNumberOfBytesRead=0x2ae2a8*=0x4453, lpOverlapped=0x0) returned 1 [0122.214] CloseHandle (hObject=0x154) returned 1 [0122.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg", lpFilePart=0x0) returned 0x71 [0122.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.252] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdfl8d[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.253] GetFileType (hFile=0x154) returned 0x1 [0122.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.253] GetFileType (hFile=0x154) returned 0x1 [0122.253] WriteFile (in: hFile=0x154, lpBuffer=0x19ab39c*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19ab39c*, lpNumberOfBytesWritten=0x2ae29c*=0x4460, lpOverlapped=0x0) returned 1 [0122.254] CloseHandle (hObject=0x154) returned 1 [0122.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg", lpFilePart=0x0) returned 0x71 [0122.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdfl8d[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c25c540, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c25c540, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7cef6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4460)) returned 1 [0122.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.255] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdfl8d[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDFL8D[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdfl8d[1].jpg.anonymous")) returned 1 [0122.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg", lpFilePart=0x0) returned 0x71 [0122.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.256] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjkj6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.256] GetFileType (hFile=0x154) returned 0x1 [0122.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.256] GetFileType (hFile=0x154) returned 0x1 [0122.256] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa23 [0122.256] ReadFile (in: hFile=0x154, lpBuffer=0x19b0834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b0834*, lpNumberOfBytesRead=0x2ae2a8*=0xa23, lpOverlapped=0x0) returned 1 [0122.265] CloseHandle (hObject=0x154) returned 1 [0122.276] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg", lpFilePart=0x0) returned 0x71 [0122.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.276] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjkj6[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.278] GetFileType (hFile=0x154) returned 0x1 [0122.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.278] GetFileType (hFile=0x154) returned 0x1 [0122.278] WriteFile (in: hFile=0x154, lpBuffer=0x1a01bfc*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a01bfc*, lpNumberOfBytesWritten=0x2ae270*=0xa30, lpOverlapped=0x0) returned 1 [0122.279] CloseHandle (hObject=0x154) returned 1 [0122.279] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg", lpFilePart=0x0) returned 0x71 [0122.279] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjkj6[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4979e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4979e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7d3b970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa30)) returned 1 [0122.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.279] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjkj6[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJKj6[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjkj6[1].jpg.anonymous")) returned 1 [0122.280] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg", lpFilePart=0x0) returned 0x71 [0122.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.280] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjv7w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.281] GetFileType (hFile=0x154) returned 0x1 [0122.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.281] GetFileType (hFile=0x154) returned 0x1 [0122.281] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x12d2 [0122.281] ReadFile (in: hFile=0x154, lpBuffer=0x1a0308c, nNumberOfBytesToRead=0x12d2, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a0308c*, lpNumberOfBytesRead=0x2ae2a8*=0x12d2, lpOverlapped=0x0) returned 1 [0122.310] CloseHandle (hObject=0x154) returned 1 [0122.321] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg", lpFilePart=0x0) returned 0x71 [0122.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.322] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjv7w[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.323] GetFileType (hFile=0x154) returned 0x1 [0122.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.323] GetFileType (hFile=0x154) returned 0x1 [0122.323] WriteFile (in: hFile=0x154, lpBuffer=0x1a55cd8*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a55cd8*, lpNumberOfBytesWritten=0x2ae29c*=0x12e0, lpOverlapped=0x0) returned 1 [0122.324] CloseHandle (hObject=0x154) returned 1 [0122.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg", lpFilePart=0x0) returned 0x71 [0122.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjv7w[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2363e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2363e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7d87c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12e0)) returned 1 [0122.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.325] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjv7w[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDJV7W[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdjv7w[1].jpg.anonymous")) returned 1 [0122.325] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png", lpFilePart=0x0) returned 0x71 [0122.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.326] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdk44m[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.346] GetFileType (hFile=0x154) returned 0x1 [0122.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.346] GetFileType (hFile=0x154) returned 0x1 [0122.346] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x284 [0122.346] ReadFile (in: hFile=0x154, lpBuffer=0x1a57850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a57850*, lpNumberOfBytesRead=0x2ae2a8*=0x284, lpOverlapped=0x0) returned 1 [0122.375] CloseHandle (hObject=0x154) returned 1 [0122.387] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png", lpFilePart=0x0) returned 0x71 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.388] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdk44m[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.389] GetFileType (hFile=0x154) returned 0x1 [0122.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.389] GetFileType (hFile=0x154) returned 0x1 [0122.389] WriteFile (in: hFile=0x154, lpBuffer=0x1aa6498*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa6498*, lpNumberOfBytesWritten=0x2ae270*=0x290, lpOverlapped=0x0) returned 1 [0122.390] CloseHandle (hObject=0x154) returned 1 [0122.390] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png", lpFilePart=0x0) returned 0x71 [0122.390] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdk44m[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x793f1840, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0f4460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7e46310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1 [0122.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.391] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDk44m[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdk44m[1].png.anonymous")) returned 1 [0122.391] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.391] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdkcw0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.391] GetFileType (hFile=0x154) returned 0x1 [0122.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.392] GetFileType (hFile=0x154) returned 0x1 [0122.392] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1a70 [0122.392] ReadFile (in: hFile=0x154, lpBuffer=0x1aa7928, nNumberOfBytesToRead=0x1a70, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa7928*, lpNumberOfBytesRead=0x2ae2a8*=0x1a70, lpOverlapped=0x0) returned 1 [0122.417] CloseHandle (hObject=0x154) returned 1 [0122.428] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.429] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdkcw0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.430] GetFileType (hFile=0x154) returned 0x1 [0122.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.430] GetFileType (hFile=0x154) returned 0x1 [0122.430] WriteFile (in: hFile=0x154, lpBuffer=0x1afcb90*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1afcb90*, lpNumberOfBytesWritten=0x2ae29c*=0x1a80, lpOverlapped=0x0) returned 1 [0122.431] CloseHandle (hObject=0x154) returned 1 [0122.431] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.431] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdkcw0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc2e000, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc2e000, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7e925d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a80)) returned 1 [0122.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.431] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdkcw0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDKcw0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdkcw0[1].jpg.anonymous")) returned 1 [0122.432] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg", lpFilePart=0x0) returned 0x71 [0122.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.432] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdle8a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.433] GetFileType (hFile=0x154) returned 0x1 [0122.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.433] GetFileType (hFile=0x154) returned 0x1 [0122.433] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x642 [0122.433] ReadFile (in: hFile=0x154, lpBuffer=0x1aff268, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aff268*, lpNumberOfBytesRead=0x2ae2a8*=0x642, lpOverlapped=0x0) returned 1 [0122.446] CloseHandle (hObject=0x154) returned 1 [0122.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg", lpFilePart=0x0) returned 0x71 [0122.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.458] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdle8a[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.459] GetFileType (hFile=0x154) returned 0x1 [0122.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.459] GetFileType (hFile=0x154) returned 0x1 [0122.460] WriteFile (in: hFile=0x154, lpBuffer=0x1b4f174*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b4f174*, lpNumberOfBytesWritten=0x2ae270*=0x650, lpOverlapped=0x0) returned 1 [0122.461] CloseHandle (hObject=0x154) returned 1 [0122.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg", lpFilePart=0x0) returned 0x71 [0122.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdle8a[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c76b400, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c76b400, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7ede890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1 [0122.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.461] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdle8a[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLE8A[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdle8a[1].jpg.anonymous")) returned 1 [0122.462] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg", lpFilePart=0x0) returned 0x71 [0122.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.462] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdljvu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.468] GetFileType (hFile=0x154) returned 0x1 [0122.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.469] GetFileType (hFile=0x154) returned 0x1 [0122.469] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x77c [0122.469] ReadFile (in: hFile=0x154, lpBuffer=0x1b50d8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b50d8c*, lpNumberOfBytesRead=0x2ae2a8*=0x77c, lpOverlapped=0x0) returned 1 [0122.476] CloseHandle (hObject=0x154) returned 1 [0122.512] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg", lpFilePart=0x0) returned 0x71 [0122.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.512] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdljvu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.514] GetFileType (hFile=0x154) returned 0x1 [0122.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.514] GetFileType (hFile=0x154) returned 0x1 [0122.514] WriteFile (in: hFile=0x154, lpBuffer=0x199d590*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x199d590*, lpNumberOfBytesWritten=0x2ae270*=0x780, lpOverlapped=0x0) returned 1 [0122.515] CloseHandle (hObject=0x154) returned 1 [0122.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg", lpFilePart=0x0) returned 0x71 [0122.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdljvu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x793cb6e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c52ff60, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7f76e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x780)) returned 1 [0122.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.516] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdljvu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLJvu[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdljvu[1].jpg.anonymous")) returned 1 [0122.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg", lpFilePart=0x0) returned 0x71 [0122.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.516] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlmef[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.534] GetFileType (hFile=0x154) returned 0x1 [0122.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.534] GetFileType (hFile=0x154) returned 0x1 [0122.534] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xafa [0122.534] ReadFile (in: hFile=0x154, lpBuffer=0x199f528, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199f528*, lpNumberOfBytesRead=0x2ae2a8*=0xafa, lpOverlapped=0x0) returned 1 [0122.543] CloseHandle (hObject=0x154) returned 1 [0122.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg", lpFilePart=0x0) returned 0x71 [0122.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.560] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlmef[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.562] GetFileType (hFile=0x154) returned 0x1 [0122.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.562] GetFileType (hFile=0x154) returned 0x1 [0122.562] WriteFile (in: hFile=0x154, lpBuffer=0x19f0cf8*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19f0cf8*, lpNumberOfBytesWritten=0x2ae270*=0xb00, lpOverlapped=0x0) returned 1 [0122.564] CloseHandle (hObject=0x154) returned 1 [0122.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg", lpFilePart=0x0) returned 0x71 [0122.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlmef[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c3ff460, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c3ff460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe7fe9230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb00)) returned 1 [0122.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.564] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlmef[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLmEf[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlmef[1].jpg.anonymous")) returned 1 [0122.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg", lpFilePart=0x0) returned 0x71 [0122.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.565] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlntm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.566] GetFileType (hFile=0x154) returned 0x1 [0122.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.566] GetFileType (hFile=0x154) returned 0x1 [0122.566] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1d4e [0122.566] ReadFile (in: hFile=0x154, lpBuffer=0x19f2188, nNumberOfBytesToRead=0x1d4e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f2188*, lpNumberOfBytesRead=0x2ae2a8*=0x1d4e, lpOverlapped=0x0) returned 1 [0122.585] CloseHandle (hObject=0x154) returned 1 [0122.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg", lpFilePart=0x0) returned 0x71 [0122.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.598] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlntm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.599] GetFileType (hFile=0x154) returned 0x1 [0122.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.599] GetFileType (hFile=0x154) returned 0x1 [0122.599] WriteFile (in: hFile=0x154, lpBuffer=0x1a48204*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a48204*, lpNumberOfBytesWritten=0x2ae29c*=0x1d50, lpOverlapped=0x0) returned 1 [0122.600] CloseHandle (hObject=0x154) returned 1 [0122.600] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg", lpFilePart=0x0) returned 0x71 [0122.601] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlntm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c52ff60, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c52ff60, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe80354f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d50)) returned 1 [0122.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.601] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlntm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLNtm[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlntm[1].jpg.anonymous")) returned 1 [0122.601] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg", lpFilePart=0x0) returned 0x71 [0122.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.601] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlpck[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.602] GetFileType (hFile=0x154) returned 0x1 [0122.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.602] GetFileType (hFile=0x154) returned 0x1 [0122.602] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x25e5 [0122.602] ReadFile (in: hFile=0x154, lpBuffer=0x1a4a55c, nNumberOfBytesToRead=0x25e5, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4a55c*, lpNumberOfBytesRead=0x2ae2a8*=0x25e5, lpOverlapped=0x0) returned 1 [0122.603] CloseHandle (hObject=0x154) returned 1 [0122.615] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg", lpFilePart=0x0) returned 0x71 [0122.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.615] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlpck[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.616] GetFileType (hFile=0x154) returned 0x1 [0122.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.616] GetFileType (hFile=0x154) returned 0x1 [0122.617] WriteFile (in: hFile=0x154, lpBuffer=0x1aa30f8*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1aa30f8*, lpNumberOfBytesWritten=0x2ae29c*=0x25f0, lpOverlapped=0x0) returned 1 [0122.618] CloseHandle (hObject=0x154) returned 1 [0122.618] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg", lpFilePart=0x0) returned 0x71 [0122.618] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlpck[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5a2380, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5a2380, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe805b650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25f0)) returned 1 [0122.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.618] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlpck[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLpCk[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlpck[1].jpg.anonymous")) returned 1 [0122.619] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg", lpFilePart=0x0) returned 0x71 [0122.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.619] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlsak[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.620] GetFileType (hFile=0x154) returned 0x1 [0122.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.620] GetFileType (hFile=0x154) returned 0x1 [0122.620] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24ec [0122.620] ReadFile (in: hFile=0x154, lpBuffer=0x1aa5cf0, nNumberOfBytesToRead=0x24ec, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa5cf0*, lpNumberOfBytesRead=0x2ae2a8*=0x24ec, lpOverlapped=0x0) returned 1 [0122.629] CloseHandle (hObject=0x154) returned 1 [0122.641] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg", lpFilePart=0x0) returned 0x71 [0122.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.641] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlsak[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.642] GetFileType (hFile=0x154) returned 0x1 [0122.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.643] GetFileType (hFile=0x154) returned 0x1 [0122.643] WriteFile (in: hFile=0x154, lpBuffer=0x1afe388*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1afe388*, lpNumberOfBytesWritten=0x2ae29c*=0x24f0, lpOverlapped=0x0) returned 1 [0122.644] CloseHandle (hObject=0x154) returned 1 [0122.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg", lpFilePart=0x0) returned 0x71 [0122.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlsak[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7dd820, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c7dd820, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe80a7910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24f0)) returned 1 [0122.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.644] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlsak[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLsaK[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlsak[1].jpg.anonymous")) returned 1 [0122.645] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg", lpFilePart=0x0) returned 0x71 [0122.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.645] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlv5i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.646] GetFileType (hFile=0x154) returned 0x1 [0122.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.646] GetFileType (hFile=0x154) returned 0x1 [0122.646] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7cb [0122.646] ReadFile (in: hFile=0x154, lpBuffer=0x1b01658, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b01658*, lpNumberOfBytesRead=0x2ae2a8*=0x7cb, lpOverlapped=0x0) returned 1 [0122.676] CloseHandle (hObject=0x154) returned 1 [0122.687] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg", lpFilePart=0x0) returned 0x71 [0122.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.688] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlv5i[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.689] GetFileType (hFile=0x154) returned 0x1 [0122.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.689] GetFileType (hFile=0x154) returned 0x1 [0122.689] WriteFile (in: hFile=0x154, lpBuffer=0x1b51cdc*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b51cdc*, lpNumberOfBytesWritten=0x2ae270*=0x7d0, lpOverlapped=0x0) returned 1 [0122.690] CloseHandle (hObject=0x154) returned 1 [0122.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg", lpFilePart=0x0) returned 0x71 [0122.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlv5i[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x791b63a0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0ce300, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8119d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0122.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.691] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlv5i[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDLv5i[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdlv5i[1].jpg.anonymous")) returned 1 [0122.691] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.691] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm5h0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.692] GetFileType (hFile=0x154) returned 0x1 [0122.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.692] GetFileType (hFile=0x154) returned 0x1 [0122.692] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7b8 [0122.692] ReadFile (in: hFile=0x154, lpBuffer=0x1b53930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b53930*, lpNumberOfBytesRead=0x2ae2a8*=0x7b8, lpOverlapped=0x0) returned 1 [0122.698] CloseHandle (hObject=0x154) returned 1 [0122.735] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.735] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm5h0[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.737] GetFileType (hFile=0x154) returned 0x1 [0122.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.737] GetFileType (hFile=0x154) returned 0x1 [0122.737] WriteFile (in: hFile=0x154, lpBuffer=0x19a3f98*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a3f98*, lpNumberOfBytesWritten=0x2ae270*=0x7c0, lpOverlapped=0x0) returned 1 [0122.738] CloseHandle (hObject=0x154) returned 1 [0122.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg", lpFilePart=0x0) returned 0x71 [0122.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.738] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm5h0[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c509e00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c509e00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe818c150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7c0)) returned 1 [0122.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.738] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm5h0[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM5h0[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm5h0[1].jpg.anonymous")) returned 1 [0122.739] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg", lpFilePart=0x0) returned 0x71 [0122.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.739] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm8mj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.740] GetFileType (hFile=0x154) returned 0x1 [0122.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.740] GetFileType (hFile=0x154) returned 0x1 [0122.740] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2037 [0122.740] ReadFile (in: hFile=0x154, lpBuffer=0x19a5428, nNumberOfBytesToRead=0x2037, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a5428*, lpNumberOfBytesRead=0x2ae2a8*=0x2037, lpOverlapped=0x0) returned 1 [0122.748] CloseHandle (hObject=0x154) returned 1 [0122.759] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg", lpFilePart=0x0) returned 0x71 [0122.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.759] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm8mj[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.761] GetFileType (hFile=0x154) returned 0x1 [0122.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.761] GetFileType (hFile=0x154) returned 0x1 [0122.761] WriteFile (in: hFile=0x154, lpBuffer=0x19fc4b0*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19fc4b0*, lpNumberOfBytesWritten=0x2ae29c*=0x2040, lpOverlapped=0x0) returned 1 [0122.762] CloseHandle (hObject=0x154) returned 1 [0122.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg", lpFilePart=0x0) returned 0x71 [0122.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm8mj[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c95a5e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c95a5e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe81b22b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2040)) returned 1 [0122.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.763] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm8mj[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDM8Mj[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdm8mj[1].jpg.anonymous")) returned 1 [0122.763] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg", lpFilePart=0x0) returned 0x71 [0122.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.763] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmcxk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.764] GetFileType (hFile=0x154) returned 0x1 [0122.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.764] GetFileType (hFile=0x154) returned 0x1 [0122.764] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x215b [0122.764] ReadFile (in: hFile=0x154, lpBuffer=0x19feaf8, nNumberOfBytesToRead=0x215b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19feaf8*, lpNumberOfBytesRead=0x2ae2a8*=0x215b, lpOverlapped=0x0) returned 1 [0122.785] CloseHandle (hObject=0x154) returned 1 [0122.797] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg", lpFilePart=0x0) returned 0x71 [0122.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.797] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmcxk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.798] GetFileType (hFile=0x154) returned 0x1 [0122.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.799] GetFileType (hFile=0x154) returned 0x1 [0122.799] WriteFile (in: hFile=0x154, lpBuffer=0x1a55fc4*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a55fc4*, lpNumberOfBytesWritten=0x2ae29c*=0x2160, lpOverlapped=0x0) returned 1 [0122.800] CloseHandle (hObject=0x154) returned 1 [0122.800] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg", lpFilePart=0x0) returned 0x71 [0122.800] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmcxk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d88d90, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3d88d90, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xe82246d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2160)) returned 1 [0122.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.800] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmcxk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMcxK[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmcxk[1].jpg.anonymous")) returned 1 [0122.801] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg", lpFilePart=0x0) returned 0x71 [0122.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.801] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmopy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.801] GetFileType (hFile=0x154) returned 0x1 [0122.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.801] GetFileType (hFile=0x154) returned 0x1 [0122.801] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9d5 [0122.802] ReadFile (in: hFile=0x154, lpBuffer=0x1a59110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a59110*, lpNumberOfBytesRead=0x2ae2a8*=0x9d5, lpOverlapped=0x0) returned 1 [0122.817] CloseHandle (hObject=0x154) returned 1 [0122.829] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg", lpFilePart=0x0) returned 0x71 [0122.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.829] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmopy[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.830] GetFileType (hFile=0x154) returned 0x1 [0122.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.830] GetFileType (hFile=0x154) returned 0x1 [0122.830] WriteFile (in: hFile=0x154, lpBuffer=0x1aaa1e8*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aaa1e8*, lpNumberOfBytesWritten=0x2ae270*=0x9e0, lpOverlapped=0x0) returned 1 [0122.831] CloseHandle (hObject=0x154) returned 1 [0122.831] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg", lpFilePart=0x0) returned 0x71 [0122.832] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmopy[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2f4ac0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2f4ac0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8270990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1 [0122.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.832] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmopy[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMopy[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmopy[1].jpg.anonymous")) returned 1 [0122.832] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg", lpFilePart=0x0) returned 0x71 [0122.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.832] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmp3m[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.833] GetFileType (hFile=0x154) returned 0x1 [0122.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.833] GetFileType (hFile=0x154) returned 0x1 [0122.833] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x8c2 [0122.833] ReadFile (in: hFile=0x154, lpBuffer=0x1aabf48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aabf48*, lpNumberOfBytesRead=0x2ae2a8*=0x8c2, lpOverlapped=0x0) returned 1 [0122.845] CloseHandle (hObject=0x154) returned 1 [0122.860] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg", lpFilePart=0x0) returned 0x71 [0122.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.860] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmp3m[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.862] GetFileType (hFile=0x154) returned 0x1 [0122.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.862] GetFileType (hFile=0x154) returned 0x1 [0122.862] WriteFile (in: hFile=0x154, lpBuffer=0x1afcad4*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1afcad4*, lpNumberOfBytesWritten=0x2ae270*=0x8d0, lpOverlapped=0x0) returned 1 [0122.863] CloseHandle (hObject=0x154) returned 1 [0122.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg", lpFilePart=0x0) returned 0x71 [0122.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.863] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmp3m[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2f4ac0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2f4ac0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe82bcc50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8d0)) returned 1 [0122.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.863] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmp3m[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMp3M[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmp3m[1].jpg.anonymous")) returned 1 [0122.864] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg", lpFilePart=0x0) returned 0x71 [0122.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.864] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmv9z[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.865] GetFileType (hFile=0x154) returned 0x1 [0122.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.865] GetFileType (hFile=0x154) returned 0x1 [0122.865] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1570 [0122.865] ReadFile (in: hFile=0x154, lpBuffer=0x1afdf64, nNumberOfBytesToRead=0x1570, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1afdf64*, lpNumberOfBytesRead=0x2ae2a8*=0x1570, lpOverlapped=0x0) returned 1 [0122.888] CloseHandle (hObject=0x154) returned 1 [0122.900] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg", lpFilePart=0x0) returned 0x71 [0122.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0122.900] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmv9z[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.901] GetFileType (hFile=0x154) returned 0x1 [0122.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0122.901] GetFileType (hFile=0x154) returned 0x1 [0122.901] WriteFile (in: hFile=0x154, lpBuffer=0x1b518cc*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b518cc*, lpNumberOfBytesWritten=0x2ae29c*=0x1580, lpOverlapped=0x0) returned 1 [0122.903] CloseHandle (hObject=0x154) returned 1 [0122.903] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg", lpFilePart=0x0) returned 0x71 [0122.903] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0122.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0122.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmv9z[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c980740, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c980740, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe832f070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1580)) returned 1 [0122.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0122.903] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmv9z[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMv9Z[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmv9z[1].jpg.anonymous")) returned 1 [0122.904] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg", lpFilePart=0x0) returned 0x71 [0122.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0122.904] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmwsa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0122.904] GetFileType (hFile=0x154) returned 0x1 [0122.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0122.904] GetFileType (hFile=0x154) returned 0x1 [0122.904] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2d81 [0122.904] ReadFile (in: hFile=0x154, lpBuffer=0x1b53454, nNumberOfBytesToRead=0x2d81, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b53454*, lpNumberOfBytesRead=0x2ae2a8*=0x2d81, lpOverlapped=0x0) returned 1 [0122.957] CloseHandle (hObject=0x154) returned 1 [0123.040] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg", lpFilePart=0x0) returned 0x71 [0123.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.040] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmwsa[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.044] GetFileType (hFile=0x154) returned 0x1 [0123.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.044] GetFileType (hFile=0x154) returned 0x1 [0123.044] WriteFile (in: hFile=0x154, lpBuffer=0x19b0bc8*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19b0bc8*, lpNumberOfBytesWritten=0x2ae29c*=0x2d90, lpOverlapped=0x0) returned 1 [0123.045] CloseHandle (hObject=0x154) returned 1 [0123.045] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg", lpFilePart=0x0) returned 0x71 [0123.045] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0123.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.045] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmwsa[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cb95a80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cb95a80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8485cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d90)) returned 1 [0123.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.045] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmwsa[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDMwsa[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdmwsa[1].jpg.anonymous")) returned 1 [0123.047] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg", lpFilePart=0x0) returned 0x71 [0123.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.047] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdstfh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.047] GetFileType (hFile=0x154) returned 0x1 [0123.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.047] GetFileType (hFile=0x154) returned 0x1 [0123.047] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x900 [0123.048] ReadFile (in: hFile=0x154, lpBuffer=0x19b486c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b486c*, lpNumberOfBytesRead=0x2ae2a8*=0x900, lpOverlapped=0x0) returned 1 [0123.049] CloseHandle (hObject=0x154) returned 1 [0123.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg", lpFilePart=0x0) returned 0x71 [0123.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.067] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdstfh[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.068] GetFileType (hFile=0x154) returned 0x1 [0123.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.068] GetFileType (hFile=0x154) returned 0x1 [0123.068] WriteFile (in: hFile=0x154, lpBuffer=0x1a05694*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a05694*, lpNumberOfBytesWritten=0x2ae270*=0x910, lpOverlapped=0x0) returned 1 [0123.069] CloseHandle (hObject=0x154) returned 1 [0123.070] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg", lpFilePart=0x0) returned 0x71 [0123.070] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0123.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdstfh[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c509e00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c509e00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe84abe30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0123.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.070] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdstfh[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDstfh[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdstfh[1].jpg.anonymous")) returned 1 [0123.070] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg", lpFilePart=0x0) returned 0x71 [0123.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.071] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdxqhd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.071] GetFileType (hFile=0x154) returned 0x1 [0123.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.073] GetFileType (hFile=0x154) returned 0x1 [0123.073] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x8d4 [0123.073] ReadFile (in: hFile=0x154, lpBuffer=0x1a07404, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a07404*, lpNumberOfBytesRead=0x2ae2a8*=0x8d4, lpOverlapped=0x0) returned 1 [0123.129] CloseHandle (hObject=0x154) returned 1 [0123.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg", lpFilePart=0x0) returned 0x71 [0123.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.148] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdxqhd[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.149] GetFileType (hFile=0x154) returned 0x1 [0123.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.149] GetFileType (hFile=0x154) returned 0x1 [0123.149] WriteFile (in: hFile=0x154, lpBuffer=0x1a57fdc*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a57fdc*, lpNumberOfBytesWritten=0x2ae270*=0x8e0, lpOverlapped=0x0) returned 1 [0123.150] CloseHandle (hObject=0x154) returned 1 [0123.150] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg", lpFilePart=0x0) returned 0x71 [0123.150] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0123.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdxqhd[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c84fc40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c84fc40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe856a510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8e0)) returned 1 [0123.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.151] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdxqhd[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBDxqHd[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbdxqhd[1].jpg.anonymous")) returned 1 [0123.151] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png", lpFilePart=0x0) returned 0x71 [0123.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.151] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbg3odx[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.152] GetFileType (hFile=0x154) returned 0x1 [0123.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.152] GetFileType (hFile=0x154) returned 0x1 [0123.152] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xf3 [0123.152] ReadFile (in: hFile=0x154, lpBuffer=0x1a5956c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a5956c*, lpNumberOfBytesRead=0x2ae2a8*=0xf3, lpOverlapped=0x0) returned 1 [0123.163] CloseHandle (hObject=0x154) returned 1 [0123.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png", lpFilePart=0x0) returned 0x71 [0123.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.184] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbg3odx[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.185] GetFileType (hFile=0x154) returned 0x1 [0123.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.185] GetFileType (hFile=0x154) returned 0x1 [0123.185] WriteFile (in: hFile=0x154, lpBuffer=0x1aa780c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa780c*, lpNumberOfBytesWritten=0x2ae270*=0x100, lpOverlapped=0x0) returned 1 [0123.186] CloseHandle (hObject=0x154) returned 1 [0123.186] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png", lpFilePart=0x0) returned 0x71 [0123.186] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbg3odx[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b11a5c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b11a5c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe85dc930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0123.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.187] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbg3odx[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBg3ODX[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbg3odx[1].png.anonymous")) returned 1 [0123.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png", lpFilePart=0x0) returned 0x71 [0123.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.190] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bblbv0u[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.190] GetFileType (hFile=0x154) returned 0x1 [0123.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.190] GetFileType (hFile=0x154) returned 0x1 [0123.190] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x23b [0123.190] ReadFile (in: hFile=0x154, lpBuffer=0x1aa8ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa8ee4*, lpNumberOfBytesRead=0x2ae2a8*=0x23b, lpOverlapped=0x0) returned 1 [0123.197] CloseHandle (hObject=0x154) returned 1 [0123.210] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png", lpFilePart=0x0) returned 0x71 [0123.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.210] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bblbv0u[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.211] GetFileType (hFile=0x154) returned 0x1 [0123.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.211] GetFileType (hFile=0x154) returned 0x1 [0123.211] WriteFile (in: hFile=0x154, lpBuffer=0x1af7998*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1af7998*, lpNumberOfBytesWritten=0x2ae270*=0x240, lpOverlapped=0x0) returned 1 [0123.212] CloseHandle (hObject=0x154) returned 1 [0123.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png", lpFilePart=0x0) returned 0x71 [0123.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bblbv0u[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da25590, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da25590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8602a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0123.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.213] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBlBV0U[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bblbv0u[1].png.anonymous")) returned 1 [0123.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png", lpFilePart=0x0) returned 0x71 [0123.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.213] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbn4luu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.213] GetFileType (hFile=0x154) returned 0x1 [0123.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.214] GetFileType (hFile=0x154) returned 0x1 [0123.214] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x14d [0123.214] ReadFile (in: hFile=0x154, lpBuffer=0x1af8f84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af8f84*, lpNumberOfBytesRead=0x2ae2a8*=0x14d, lpOverlapped=0x0) returned 1 [0123.229] CloseHandle (hObject=0x154) returned 1 [0123.244] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png", lpFilePart=0x0) returned 0x71 [0123.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.244] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbn4luu[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.246] GetFileType (hFile=0x154) returned 0x1 [0123.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.247] GetFileType (hFile=0x154) returned 0x1 [0123.247] WriteFile (in: hFile=0x154, lpBuffer=0x1b47584*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b47584*, lpNumberOfBytesWritten=0x2ae270*=0x150, lpOverlapped=0x0) returned 1 [0123.248] CloseHandle (hObject=0x154) returned 1 [0123.248] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png", lpFilePart=0x0) returned 0x71 [0123.248] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbn4luu[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7794b670, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7794b670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8674eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0123.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.249] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBn4lUU[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbn4luu[1].png.anonymous")) returned 1 [0123.250] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png", lpFilePart=0x0) returned 0x71 [0123.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.250] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbnmken[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.250] GetFileType (hFile=0x154) returned 0x1 [0123.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.250] GetFileType (hFile=0x154) returned 0x1 [0123.250] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24b [0123.250] ReadFile (in: hFile=0x154, lpBuffer=0x1b48c6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b48c6c*, lpNumberOfBytesRead=0x2ae2a8*=0x24b, lpOverlapped=0x0) returned 1 [0123.264] CloseHandle (hObject=0x154) returned 1 [0123.313] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png", lpFilePart=0x0) returned 0x71 [0123.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.314] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbnmken[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.315] GetFileType (hFile=0x154) returned 0x1 [0123.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.315] GetFileType (hFile=0x154) returned 0x1 [0123.315] WriteFile (in: hFile=0x154, lpBuffer=0x1994c24*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1994c24*, lpNumberOfBytesWritten=0x2ae270*=0x250, lpOverlapped=0x0) returned 1 [0123.317] CloseHandle (hObject=0x154) returned 1 [0123.317] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png", lpFilePart=0x0) returned 0x71 [0123.317] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbnmken[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d98d010, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d98d010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe870d430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0123.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.317] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbnmken[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BBnMKeN[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbnmken[1].png.anonymous")) returned 1 [0123.321] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg", lpFilePart=0x0) returned 0x71 [0123.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.321] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbyazif[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.322] GetFileType (hFile=0x154) returned 0x1 [0123.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.322] GetFileType (hFile=0x154) returned 0x1 [0123.322] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x228c [0123.322] ReadFile (in: hFile=0x154, lpBuffer=0x19960b4, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19960b4*, lpNumberOfBytesRead=0x2ae2a8*=0x228c, lpOverlapped=0x0) returned 1 [0123.341] CloseHandle (hObject=0x154) returned 1 [0123.359] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg", lpFilePart=0x0) returned 0x71 [0123.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.359] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbyazif[2].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.361] GetFileType (hFile=0x154) returned 0x1 [0123.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.361] GetFileType (hFile=0x154) returned 0x1 [0123.361] WriteFile (in: hFile=0x154, lpBuffer=0x19edcc8*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19edcc8*, lpNumberOfBytesWritten=0x2ae29c*=0x2290, lpOverlapped=0x0) returned 1 [0123.362] CloseHandle (hObject=0x154) returned 1 [0123.363] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg", lpFilePart=0x0) returned 0x71 [0123.363] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0123.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbyazif[2].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c57c220, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c57c220, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe877f850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2290)) returned 1 [0123.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.363] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\BByazif[2].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\bbyazif[2].jpg.anonymous")) returned 1 [0123.364] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png", lpFilePart=0x0) returned 0x6e [0123.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.364] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\logo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.364] GetFileType (hFile=0x154) returned 0x1 [0123.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.364] GetFileType (hFile=0x154) returned 0x1 [0123.364] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1d3e [0123.364] ReadFile (in: hFile=0x154, lpBuffer=0x19f05d4, nNumberOfBytesToRead=0x1d3e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f05d4*, lpNumberOfBytesRead=0x2ae2a8*=0x1d3e, lpOverlapped=0x0) returned 1 [0123.372] CloseHandle (hObject=0x154) returned 1 [0123.390] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png", lpFilePart=0x0) returned 0x6e [0123.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.390] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\logo[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.392] GetFileType (hFile=0x154) returned 0x1 [0123.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.392] GetFileType (hFile=0x154) returned 0x1 [0123.392] WriteFile (in: hFile=0x154, lpBuffer=0x1a46600*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a46600*, lpNumberOfBytesWritten=0x2ae29c*=0x1d40, lpOverlapped=0x0) returned 1 [0123.393] CloseHandle (hObject=0x154) returned 1 [0123.393] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png", lpFilePart=0x0) returned 0x6e [0123.393] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png.anonymous", lpFilePart=0x0) returned 0x78 [0123.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\logo[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da979b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da979b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe87cbb10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d40)) returned 1 [0123.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.394] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\logo[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\BIEAO6H1\\logo[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\bieao6h1\\logo[1].png.anonymous")) returned 1 [0123.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0123.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L", lpFilePart=0x0) returned 0x62 [0123.395] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\", lpFilePart=0x0) returned 0x63 [0123.395] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbec18 [0123.443] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.501] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.501] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.501] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.502] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.503] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.504] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.505] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.505] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.505] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.505] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.505] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.505] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.508] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.509] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.510] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.511] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.511] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.511] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.511] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.511] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.512] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.512] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.512] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.512] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.512] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.513] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.514] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.515] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.516] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.516] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.516] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.516] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.516] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.516] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.517] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.517] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.517] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.517] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.518] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.518] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.518] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0123.518] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0123.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0123.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0123.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0123.520] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L", lpFilePart=0x0) returned 0x62 [0123.520] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\", lpFilePart=0x0) returned 0x63 [0123.520] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbec18 [0123.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.522] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.523] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.524] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.525] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.525] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.525] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.525] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.526] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.527] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.528] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.529] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.530] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.531] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.532] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0123.533] FindNextFileW (in: hFindFile=0xbec18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0123.533] FindClose (in: hFindFile=0xbec18 | out: hFindFile=0xbec18) returned 1 [0123.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0123.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0123.535] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0123.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.535] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\11-b6a7e6-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.545] GetFileType (hFile=0x154) returned 0x1 [0123.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.545] GetFileType (hFile=0x154) returned 0x1 [0123.546] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x253df [0123.547] ReadFile (in: hFile=0x154, lpBuffer=0x1c1e1ab0, nNumberOfBytesToRead=0x253df, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1c1e1ab0*, lpNumberOfBytesRead=0x2ae2a8*=0x253df, lpOverlapped=0x0) returned 1 [0123.566] CloseHandle (hObject=0x154) returned 1 [0123.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0123.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.597] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\11-b6a7e6-91cdfbc1[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.600] GetFileType (hFile=0x154) returned 0x1 [0123.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.600] GetFileType (hFile=0x154) returned 0x1 [0123.601] WriteFile (in: hFile=0x154, lpBuffer=0x1c29be50*, nNumberOfBytesToWrite=0x253e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1c29be50*, lpNumberOfBytesWritten=0x2ae29c*=0x253e0, lpOverlapped=0x0) returned 1 [0123.606] CloseHandle (hObject=0x154) returned 1 [0123.606] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0123.606] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt.anonymous", lpFilePart=0x0) returned 0x86 [0123.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\11-b6a7e6-91cdfbc1[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7aa42680, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7aa42680, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe89e0e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x253e0)) returned 1 [0123.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.607] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\11-b6a7e6-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\11-b6a7e6-91cdfbc1[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\11-b6a7e6-91cdfbc1[1].txt.anonymous")) returned 1 [0123.608] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif", lpFilePart=0x0) returned 0x88 [0123.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.608] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\170331_seat_leonst_cpc_300x250[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.610] GetFileType (hFile=0x154) returned 0x1 [0123.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.610] GetFileType (hFile=0x154) returned 0x1 [0123.610] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa7ec [0123.610] ReadFile (in: hFile=0x154, lpBuffer=0x1ab4a5c, nNumberOfBytesToRead=0xa7ec, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab4a5c*, lpNumberOfBytesRead=0x2ae2a8*=0xa7ec, lpOverlapped=0x0) returned 1 [0123.671] CloseHandle (hObject=0x154) returned 1 [0123.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif", lpFilePart=0x0) returned 0x88 [0123.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.684] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\170331_seat_leonst_cpc_300x250[1].gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.686] GetFileType (hFile=0x154) returned 0x1 [0123.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.686] GetFileType (hFile=0x154) returned 0x1 [0123.686] WriteFile (in: hFile=0x154, lpBuffer=0x1b21028*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b21028*, lpNumberOfBytesWritten=0x2ae29c*=0xa7f0, lpOverlapped=0x0) returned 1 [0123.688] CloseHandle (hObject=0x154) returned 1 [0123.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif", lpFilePart=0x0) returned 0x88 [0123.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif.anonymous", lpFilePart=0x0) returned 0x92 [0123.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\170331_seat_leonst_cpc_300x250[1].gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78eb7c70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x78eb7c70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8a9f530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0)) returned 1 [0123.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.688] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\170331_seat_leonst_cpc_300x250[1].gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\170331_SEAT_LeonST_CPC_300x250[1].gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\170331_seat_leonst_cpc_300x250[1].gif.anonymous")) returned 1 [0123.689] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png", lpFilePart=0x0) returned 0x71 [0123.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.689] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3dghw[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.689] GetFileType (hFile=0x154) returned 0x1 [0123.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.689] GetFileType (hFile=0x154) returned 0x1 [0123.689] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x14d [0123.689] ReadFile (in: hFile=0x154, lpBuffer=0x1b2c068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b2c068*, lpNumberOfBytesRead=0x2ae2a8*=0x14d, lpOverlapped=0x0) returned 1 [0123.691] CloseHandle (hObject=0x154) returned 1 [0123.705] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png", lpFilePart=0x0) returned 0x71 [0123.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.705] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3dghw[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.707] GetFileType (hFile=0x154) returned 0x1 [0123.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.707] GetFileType (hFile=0x154) returned 0x1 [0123.707] WriteFile (in: hFile=0x154, lpBuffer=0x1b7a668*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b7a668*, lpNumberOfBytesWritten=0x2ae270*=0x150, lpOverlapped=0x0) returned 1 [0123.708] CloseHandle (hObject=0x154) returned 1 [0123.709] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png", lpFilePart=0x0) returned 0x71 [0123.709] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3dghw[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d693490, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d693490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8ac5690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0123.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.709] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3DGHW[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3dghw[1].png.anonymous")) returned 1 [0123.710] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png", lpFilePart=0x0) returned 0x71 [0123.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.710] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3e6zi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.710] GetFileType (hFile=0x154) returned 0x1 [0123.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.710] GetFileType (hFile=0x154) returned 0x1 [0123.710] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x165 [0123.710] ReadFile (in: hFile=0x154, lpBuffer=0x1b7bc6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b7bc6c*, lpNumberOfBytesRead=0x2ae2a8*=0x165, lpOverlapped=0x0) returned 1 [0123.737] CloseHandle (hObject=0x154) returned 1 [0123.778] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png", lpFilePart=0x0) returned 0x71 [0123.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.778] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3e6zi[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.779] GetFileType (hFile=0x154) returned 0x1 [0123.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.779] GetFileType (hFile=0x154) returned 0x1 [0123.779] WriteFile (in: hFile=0x154, lpBuffer=0x19ca574*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19ca574*, lpNumberOfBytesWritten=0x2ae270*=0x170, lpOverlapped=0x0) returned 1 [0123.780] CloseHandle (hObject=0x154) returned 1 [0123.781] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png", lpFilePart=0x0) returned 0x71 [0123.781] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3e6zi[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c366ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c366ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8b83d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1 [0123.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.781] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3e6zi[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA3e6zI[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa3e6zi[1].png.anonymous")) returned 1 [0123.781] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png", lpFilePart=0x0) returned 0x71 [0123.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.781] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa429np[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.782] GetFileType (hFile=0x154) returned 0x1 [0123.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.782] GetFileType (hFile=0x154) returned 0x1 [0123.782] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x265 [0123.782] ReadFile (in: hFile=0x154, lpBuffer=0x19cbc78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19cbc78*, lpNumberOfBytesRead=0x2ae2a8*=0x265, lpOverlapped=0x0) returned 1 [0123.800] CloseHandle (hObject=0x154) returned 1 [0123.812] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png", lpFilePart=0x0) returned 0x71 [0123.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.812] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa429np[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.813] GetFileType (hFile=0x154) returned 0x1 [0123.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.813] GetFileType (hFile=0x154) returned 0x1 [0123.813] WriteFile (in: hFile=0x154, lpBuffer=0x1a1a97c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a1a97c*, lpNumberOfBytesWritten=0x2ae270*=0x270, lpOverlapped=0x0) returned 1 [0123.814] CloseHandle (hObject=0x154) returned 1 [0123.814] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png", lpFilePart=0x0) returned 0x71 [0123.815] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa429np[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc54160, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc54160, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8bd0030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0123.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.815] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa429np[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA429NP[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa429np[1].png.anonymous")) returned 1 [0123.815] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png", lpFilePart=0x0) returned 0x71 [0123.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.816] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa42pjy[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.816] GetFileType (hFile=0x154) returned 0x1 [0123.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.816] GetFileType (hFile=0x154) returned 0x1 [0123.816] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x252 [0123.816] ReadFile (in: hFile=0x154, lpBuffer=0x1a1c06c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a1c06c*, lpNumberOfBytesRead=0x2ae2a8*=0x252, lpOverlapped=0x0) returned 1 [0123.834] CloseHandle (hObject=0x154) returned 1 [0123.852] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png", lpFilePart=0x0) returned 0x71 [0123.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.852] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa42pjy[2].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.854] GetFileType (hFile=0x154) returned 0x1 [0123.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.854] GetFileType (hFile=0x154) returned 0x1 [0123.854] WriteFile (in: hFile=0x154, lpBuffer=0x1a6abc8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a6abc8*, lpNumberOfBytesWritten=0x2ae270*=0x260, lpOverlapped=0x0) returned 1 [0123.856] CloseHandle (hObject=0x154) returned 1 [0123.856] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png", lpFilePart=0x0) returned 0x71 [0123.856] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa42pjy[2].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7dd820, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c7dd820, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8c42450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1 [0123.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.856] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa42pjy[2].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA42pjY[2].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa42pjy[2].png.anonymous")) returned 1 [0123.857] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png", lpFilePart=0x0) returned 0x71 [0123.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.857] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa54rqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.857] GetFileType (hFile=0x154) returned 0x1 [0123.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.857] GetFileType (hFile=0x154) returned 0x1 [0123.857] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x191 [0123.857] ReadFile (in: hFile=0x154, lpBuffer=0x1a6c1f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a6c1f8*, lpNumberOfBytesRead=0x2ae2a8*=0x191, lpOverlapped=0x0) returned 1 [0123.887] CloseHandle (hObject=0x154) returned 1 [0123.898] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png", lpFilePart=0x0) returned 0x71 [0123.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.898] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa54rqj[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.900] GetFileType (hFile=0x154) returned 0x1 [0123.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.900] GetFileType (hFile=0x154) returned 0x1 [0123.900] WriteFile (in: hFile=0x154, lpBuffer=0x1aba994*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aba994*, lpNumberOfBytesWritten=0x2ae270*=0x1a0, lpOverlapped=0x0) returned 1 [0123.901] CloseHandle (hObject=0x154) returned 1 [0123.901] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png", lpFilePart=0x0) returned 0x71 [0123.901] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa54rqj[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbe1d40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbe1d40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8cb4870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0123.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.901] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA54rQj[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa54rqj[1].png.anonymous")) returned 1 [0123.902] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png", lpFilePart=0x0) returned 0x71 [0123.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.902] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa6jpt3[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.917] GetFileType (hFile=0x154) returned 0x1 [0123.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.917] GetFileType (hFile=0x154) returned 0x1 [0123.917] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2d4 [0123.917] ReadFile (in: hFile=0x154, lpBuffer=0x1abc104, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1abc104*, lpNumberOfBytesRead=0x2ae2a8*=0x2d4, lpOverlapped=0x0) returned 1 [0123.966] CloseHandle (hObject=0x154) returned 1 [0123.978] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png", lpFilePart=0x0) returned 0x71 [0123.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0123.978] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa6jpt3[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.980] GetFileType (hFile=0x154) returned 0x1 [0123.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0123.980] GetFileType (hFile=0x154) returned 0x1 [0123.980] WriteFile (in: hFile=0x154, lpBuffer=0x1b0aedc*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b0aedc*, lpNumberOfBytesWritten=0x2ae270*=0x2e0, lpOverlapped=0x0) returned 1 [0123.981] CloseHandle (hObject=0x154) returned 1 [0123.981] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png", lpFilePart=0x0) returned 0x71 [0123.981] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0123.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0123.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa6jpt3[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c340d80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c340d80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8d72f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1 [0123.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0123.981] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa6jpt3[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA6JPT3[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa6jpt3[1].png.anonymous")) returned 1 [0123.982] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png", lpFilePart=0x0) returned 0x71 [0123.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0123.982] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa8gdem[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0123.983] GetFileType (hFile=0x154) returned 0x1 [0123.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0123.983] GetFileType (hFile=0x154) returned 0x1 [0123.983] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x292 [0123.983] ReadFile (in: hFile=0x154, lpBuffer=0x1b0c60c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b0c60c*, lpNumberOfBytesRead=0x2ae2a8*=0x292, lpOverlapped=0x0) returned 1 [0123.996] CloseHandle (hObject=0x154) returned 1 [0124.008] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png", lpFilePart=0x0) returned 0x71 [0124.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.008] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa8gdem[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.009] GetFileType (hFile=0x154) returned 0x1 [0124.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.009] GetFileType (hFile=0x154) returned 0x1 [0124.009] WriteFile (in: hFile=0x154, lpBuffer=0x1b5b2a8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b5b2a8*, lpNumberOfBytesWritten=0x2ae270*=0x2a0, lpOverlapped=0x0) returned 1 [0124.010] CloseHandle (hObject=0x154) returned 1 [0124.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png", lpFilePart=0x0) returned 0x71 [0124.011] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0124.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa8gdem[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6df750, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6df750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8dbf210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2a0)) returned 1 [0124.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.011] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa8gdem[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AA8GDem[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aa8gdem[1].png.anonymous")) returned 1 [0124.011] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png", lpFilePart=0x0) returned 0x71 [0124.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.011] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aacf0nk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.012] GetFileType (hFile=0x154) returned 0x1 [0124.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.012] GetFileType (hFile=0x154) returned 0x1 [0124.012] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2bb [0124.012] ReadFile (in: hFile=0x154, lpBuffer=0x1b5ca00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b5ca00*, lpNumberOfBytesRead=0x2ae2a8*=0x2bb, lpOverlapped=0x0) returned 1 [0124.039] CloseHandle (hObject=0x154) returned 1 [0124.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png", lpFilePart=0x0) returned 0x71 [0124.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.091] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aacf0nk[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.092] GetFileType (hFile=0x154) returned 0x1 [0124.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.093] GetFileType (hFile=0x154) returned 0x1 [0124.093] WriteFile (in: hFile=0x154, lpBuffer=0x19ab864*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19ab864*, lpNumberOfBytesWritten=0x2ae270*=0x2c0, lpOverlapped=0x0) returned 1 [0124.094] CloseHandle (hObject=0x154) returned 1 [0124.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png", lpFilePart=0x0) returned 0x71 [0124.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0124.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aacf0nk[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da979b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da979b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8e7d8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1 [0124.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.095] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aacf0nk[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAcF0NK[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aacf0nk[1].png.anonymous")) returned 1 [0124.096] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png", lpFilePart=0x0) returned 0x71 [0124.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.096] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aafgqmv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.096] GetFileType (hFile=0x154) returned 0x1 [0124.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.096] GetFileType (hFile=0x154) returned 0x1 [0124.096] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2d6 [0124.096] ReadFile (in: hFile=0x154, lpBuffer=0x19acfd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19acfd8*, lpNumberOfBytesRead=0x2ae2a8*=0x2d6, lpOverlapped=0x0) returned 1 [0124.108] CloseHandle (hObject=0x154) returned 1 [0124.131] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png", lpFilePart=0x0) returned 0x71 [0124.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.131] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aafgqmv[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.133] GetFileType (hFile=0x154) returned 0x1 [0124.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.133] GetFileType (hFile=0x154) returned 0x1 [0124.133] WriteFile (in: hFile=0x154, lpBuffer=0x19fbf0c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19fbf0c*, lpNumberOfBytesWritten=0x2ae270*=0x2e0, lpOverlapped=0x0) returned 1 [0124.134] CloseHandle (hObject=0x154) returned 1 [0124.134] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png", lpFilePart=0x0) returned 0x71 [0124.134] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0124.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aafgqmv[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c980740, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c980740, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8ec9bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1 [0124.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.135] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aafgqmv[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\AAfGQmV[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\aafgqmv[1].png.anonymous")) returned 1 [0124.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png", lpFilePart=0x0) returned 0x71 [0124.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.136] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb56xto[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.152] GetFileType (hFile=0x154) returned 0x1 [0124.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.152] GetFileType (hFile=0x154) returned 0x1 [0124.152] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x145 [0124.152] ReadFile (in: hFile=0x154, lpBuffer=0x19fd548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19fd548*, lpNumberOfBytesRead=0x2ae2a8*=0x145, lpOverlapped=0x0) returned 1 [0124.162] CloseHandle (hObject=0x154) returned 1 [0124.179] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png", lpFilePart=0x0) returned 0x71 [0124.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.179] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb56xto[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.180] GetFileType (hFile=0x154) returned 0x1 [0124.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.181] GetFileType (hFile=0x154) returned 0x1 [0124.181] WriteFile (in: hFile=0x154, lpBuffer=0x1a4bb50*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a4bb50*, lpNumberOfBytesWritten=0x2ae270*=0x150, lpOverlapped=0x0) returned 1 [0124.182] CloseHandle (hObject=0x154) returned 1 [0124.182] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png", lpFilePart=0x0) returned 0x71 [0124.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0124.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb56xto[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4e3ca0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4e3ca0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8f62130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0124.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.183] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb56xto[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB56XTo[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb56xto[1].png.anonymous")) returned 1 [0124.184] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png", lpFilePart=0x0) returned 0x71 [0124.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.184] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb5zdwx[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.185] GetFileType (hFile=0x154) returned 0x1 [0124.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.185] GetFileType (hFile=0x154) returned 0x1 [0124.185] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2c0 [0124.185] ReadFile (in: hFile=0x154, lpBuffer=0x1a4d2ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4d2ac*, lpNumberOfBytesRead=0x2ae2a8*=0x2c0, lpOverlapped=0x0) returned 1 [0124.194] CloseHandle (hObject=0x154) returned 1 [0124.210] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png", lpFilePart=0x0) returned 0x71 [0124.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.210] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb5zdwx[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.212] GetFileType (hFile=0x154) returned 0x1 [0124.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.212] GetFileType (hFile=0x154) returned 0x1 [0124.212] WriteFile (in: hFile=0x154, lpBuffer=0x1a9c038*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a9c038*, lpNumberOfBytesWritten=0x2ae270*=0x2d0, lpOverlapped=0x0) returned 1 [0124.213] CloseHandle (hObject=0x154) returned 1 [0124.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png", lpFilePart=0x0) returned 0x71 [0124.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0124.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb5zdwx[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c90e320, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c90e320, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe8fae3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1 [0124.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.213] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BB5zDwX[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bb5zdwx[1].png.anonymous")) returned 1 [0124.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg", lpFilePart=0x0) returned 0x71 [0124.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.214] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcp9i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.214] GetFileType (hFile=0x154) returned 0x1 [0124.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.214] GetFileType (hFile=0x154) returned 0x1 [0124.215] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x763 [0124.215] ReadFile (in: hFile=0x154, lpBuffer=0x1a9dc38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a9dc38*, lpNumberOfBytesRead=0x2ae2a8*=0x763, lpOverlapped=0x0) returned 1 [0124.218] CloseHandle (hObject=0x154) returned 1 [0124.230] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg", lpFilePart=0x0) returned 0x71 [0124.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.230] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcp9i[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.231] GetFileType (hFile=0x154) returned 0x1 [0124.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.231] GetFileType (hFile=0x154) returned 0x1 [0124.231] WriteFile (in: hFile=0x154, lpBuffer=0x1aee0e4*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aee0e4*, lpNumberOfBytesWritten=0x2ae270*=0x770, lpOverlapped=0x0) returned 1 [0124.232] CloseHandle (hObject=0x154) returned 1 [0124.232] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg", lpFilePart=0x0) returned 0x71 [0124.232] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcp9i[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7c3f90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7c3f90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8fd4550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x770)) returned 1 [0124.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.233] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcp9i[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCP9I[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcp9i[1].jpg.anonymous")) returned 1 [0124.233] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg", lpFilePart=0x0) returned 0x71 [0124.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.234] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcy7x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.234] GetFileType (hFile=0x154) returned 0x1 [0124.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.234] GetFileType (hFile=0x154) returned 0x1 [0124.234] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x6bf [0124.234] ReadFile (in: hFile=0x154, lpBuffer=0x1aefc40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aefc40*, lpNumberOfBytesRead=0x2ae2a8*=0x6bf, lpOverlapped=0x0) returned 1 [0124.235] CloseHandle (hObject=0x154) returned 1 [0124.249] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg", lpFilePart=0x0) returned 0x71 [0124.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.249] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcy7x[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.251] GetFileType (hFile=0x154) returned 0x1 [0124.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.251] GetFileType (hFile=0x154) returned 0x1 [0124.251] WriteFile (in: hFile=0x154, lpBuffer=0x1b3fd70*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b3fd70*, lpNumberOfBytesWritten=0x2ae270*=0x6c0, lpOverlapped=0x0) returned 1 [0124.252] CloseHandle (hObject=0x154) returned 1 [0124.253] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg", lpFilePart=0x0) returned 0x71 [0124.253] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcy7x[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7c3f90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7c3f90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe8ffa6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c0)) returned 1 [0124.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.253] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcy7x[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBCY7x[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbcy7x[1].jpg.anonymous")) returned 1 [0124.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg", lpFilePart=0x0) returned 0x71 [0124.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.255] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbd4pm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.255] GetFileType (hFile=0x154) returned 0x1 [0124.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.255] GetFileType (hFile=0x154) returned 0x1 [0124.255] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2ac3 [0124.256] ReadFile (in: hFile=0x154, lpBuffer=0x1b41200, nNumberOfBytesToRead=0x2ac3, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b41200*, lpNumberOfBytesRead=0x2ae2a8*=0x2ac3, lpOverlapped=0x0) returned 1 [0124.267] CloseHandle (hObject=0x154) returned 1 [0124.306] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg", lpFilePart=0x0) returned 0x71 [0124.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.306] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbd4pm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.307] GetFileType (hFile=0x154) returned 0x1 [0124.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.307] GetFileType (hFile=0x154) returned 0x1 [0124.307] WriteFile (in: hFile=0x154, lpBuffer=0x199de44*, nNumberOfBytesToWrite=0x2ad0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x199de44*, lpNumberOfBytesWritten=0x2ae29c*=0x2ad0, lpOverlapped=0x0) returned 1 [0124.308] CloseHandle (hObject=0x154) returned 1 [0124.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg", lpFilePart=0x0) returned 0x71 [0124.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbd4pm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8363b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8363b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9092c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ad0)) returned 1 [0124.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.309] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbd4pm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBD4pm[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbd4pm[1].jpg.anonymous")) returned 1 [0124.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg", lpFilePart=0x0) returned 0x71 [0124.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.310] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtd2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.310] GetFileType (hFile=0x154) returned 0x1 [0124.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.310] GetFileType (hFile=0x154) returned 0x1 [0124.310] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x18f6 [0124.310] ReadFile (in: hFile=0x154, lpBuffer=0x19a0f1c, nNumberOfBytesToRead=0x18f6, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a0f1c*, lpNumberOfBytesRead=0x2ae2a8*=0x18f6, lpOverlapped=0x0) returned 1 [0124.313] CloseHandle (hObject=0x154) returned 1 [0124.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg", lpFilePart=0x0) returned 0x71 [0124.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.327] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtd2[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.328] GetFileType (hFile=0x154) returned 0x1 [0124.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.328] GetFileType (hFile=0x154) returned 0x1 [0124.328] WriteFile (in: hFile=0x154, lpBuffer=0x19f5b64*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19f5b64*, lpNumberOfBytesWritten=0x2ae29c*=0x1900, lpOverlapped=0x0) returned 1 [0124.329] CloseHandle (hObject=0x154) returned 1 [0124.329] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg", lpFilePart=0x0) returned 0x71 [0124.329] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtd2[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d98d010, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d98d010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe90b8d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1900)) returned 1 [0124.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.330] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtd2[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDtD2[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtd2[1].jpg.anonymous")) returned 1 [0124.330] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg", lpFilePart=0x0) returned 0x71 [0124.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.330] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtvs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.330] GetFileType (hFile=0x154) returned 0x1 [0124.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.330] GetFileType (hFile=0x154) returned 0x1 [0124.331] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x909 [0124.331] ReadFile (in: hFile=0x154, lpBuffer=0x19f8384, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f8384*, lpNumberOfBytesRead=0x2ae2a8*=0x909, lpOverlapped=0x0) returned 1 [0124.337] CloseHandle (hObject=0x154) returned 1 [0124.349] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg", lpFilePart=0x0) returned 0x71 [0124.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.349] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtvs[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.350] GetFileType (hFile=0x154) returned 0x1 [0124.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.350] GetFileType (hFile=0x154) returned 0x1 [0124.350] WriteFile (in: hFile=0x154, lpBuffer=0x1a49048*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a49048*, lpNumberOfBytesWritten=0x2ae270*=0x910, lpOverlapped=0x0) returned 1 [0124.351] CloseHandle (hObject=0x154) returned 1 [0124.352] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg", lpFilePart=0x0) returned 0x71 [0124.352] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtvs[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7794b670, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7794b670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe90deef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0124.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.352] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtvs[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBDTvS[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbdtvs[1].jpg.anonymous")) returned 1 [0124.353] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg", lpFilePart=0x0) returned 0x71 [0124.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.353] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfctc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.353] GetFileType (hFile=0x154) returned 0x1 [0124.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.353] GetFileType (hFile=0x154) returned 0x1 [0124.353] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x809 [0124.353] ReadFile (in: hFile=0x154, lpBuffer=0x1a4acf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4acf0*, lpNumberOfBytesRead=0x2ae2a8*=0x809, lpOverlapped=0x0) returned 1 [0124.355] CloseHandle (hObject=0x154) returned 1 [0124.367] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg", lpFilePart=0x0) returned 0x71 [0124.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.367] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfctc[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.369] GetFileType (hFile=0x154) returned 0x1 [0124.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.369] GetFileType (hFile=0x154) returned 0x1 [0124.369] WriteFile (in: hFile=0x154, lpBuffer=0x1a9b4b4*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a9b4b4*, lpNumberOfBytesWritten=0x2ae270*=0x810, lpOverlapped=0x0) returned 1 [0124.371] CloseHandle (hObject=0x154) returned 1 [0124.371] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg", lpFilePart=0x0) returned 0x71 [0124.371] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfctc[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d777cd0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d777cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe912b1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x810)) returned 1 [0124.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.371] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfctc[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFCTC[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfctc[1].jpg.anonymous")) returned 1 [0124.372] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg", lpFilePart=0x0) returned 0x71 [0124.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.372] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfoww[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.372] GetFileType (hFile=0x154) returned 0x1 [0124.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.373] GetFileType (hFile=0x154) returned 0x1 [0124.373] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x786 [0124.373] ReadFile (in: hFile=0x154, lpBuffer=0x1a9d0d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a9d0d8*, lpNumberOfBytesRead=0x2ae2a8*=0x786, lpOverlapped=0x0) returned 1 [0124.374] CloseHandle (hObject=0x154) returned 1 [0124.386] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg", lpFilePart=0x0) returned 0x71 [0124.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.386] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfoww[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.388] GetFileType (hFile=0x154) returned 0x1 [0124.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.388] GetFileType (hFile=0x154) returned 0x1 [0124.388] WriteFile (in: hFile=0x154, lpBuffer=0x1aed620*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aed620*, lpNumberOfBytesWritten=0x2ae270*=0x790, lpOverlapped=0x0) returned 1 [0124.389] CloseHandle (hObject=0x154) returned 1 [0124.389] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg", lpFilePart=0x0) returned 0x71 [0124.389] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfoww[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7794b670, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7794b670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9151310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x790)) returned 1 [0124.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.389] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfoww[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBFOWw[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbfoww[1].jpg.anonymous")) returned 1 [0124.390] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg", lpFilePart=0x0) returned 0x71 [0124.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.390] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgbet[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.391] GetFileType (hFile=0x154) returned 0x1 [0124.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.391] GetFileType (hFile=0x154) returned 0x1 [0124.391] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2170 [0124.391] ReadFile (in: hFile=0x154, lpBuffer=0x1aeeab0, nNumberOfBytesToRead=0x2170, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aeeab0*, lpNumberOfBytesRead=0x2ae2a8*=0x2170, lpOverlapped=0x0) returned 1 [0124.392] CloseHandle (hObject=0x154) returned 1 [0124.404] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg", lpFilePart=0x0) returned 0x71 [0124.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.405] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgbet[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.406] GetFileType (hFile=0x154) returned 0x1 [0124.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.406] GetFileType (hFile=0x154) returned 0x1 [0124.406] WriteFile (in: hFile=0x154, lpBuffer=0x1b46018*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b46018*, lpNumberOfBytesWritten=0x2ae29c*=0x2180, lpOverlapped=0x0) returned 1 [0124.407] CloseHandle (hObject=0x154) returned 1 [0124.407] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg", lpFilePart=0x0) returned 0x71 [0124.407] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.408] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgbet[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7dae3c70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7dae3c70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9177470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2180)) returned 1 [0124.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.408] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgbet[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGbET[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgbet[1].jpg.anonymous")) returned 1 [0124.408] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg", lpFilePart=0x0) returned 0x71 [0124.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.408] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.409] GetFileType (hFile=0x154) returned 0x1 [0124.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.409] GetFileType (hFile=0x154) returned 0x1 [0124.409] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2ccc [0124.409] ReadFile (in: hFile=0x154, lpBuffer=0x1b487a0, nNumberOfBytesToRead=0x2ccc, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b487a0*, lpNumberOfBytesRead=0x2ae2a8*=0x2ccc, lpOverlapped=0x0) returned 1 [0124.410] CloseHandle (hObject=0x154) returned 1 [0124.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg", lpFilePart=0x0) returned 0x71 [0124.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.458] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.459] GetFileType (hFile=0x154) returned 0x1 [0124.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.459] GetFileType (hFile=0x154) returned 0x1 [0124.460] WriteFile (in: hFile=0x154, lpBuffer=0x19a378c*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19a378c*, lpNumberOfBytesWritten=0x2ae29c*=0x2cd0, lpOverlapped=0x0) returned 1 [0124.461] CloseHandle (hObject=0x154) returned 1 [0124.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg", lpFilePart=0x0) returned 0x71 [0124.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4a42b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d4a42b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe91e9890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2cd0)) returned 1 [0124.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.461] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[1].jpg.anonymous")) returned 1 [0124.462] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg", lpFilePart=0x0) returned 0x71 [0124.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.462] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.462] GetFileType (hFile=0x154) returned 0x1 [0124.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.462] GetFileType (hFile=0x154) returned 0x1 [0124.462] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9a3 [0124.462] ReadFile (in: hFile=0x154, lpBuffer=0x19a7414, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a7414*, lpNumberOfBytesRead=0x2ae2a8*=0x9a3, lpOverlapped=0x0) returned 1 [0124.464] CloseHandle (hObject=0x154) returned 1 [0124.482] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg", lpFilePart=0x0) returned 0x71 [0124.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.482] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[2].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.484] GetFileType (hFile=0x154) returned 0x1 [0124.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.484] GetFileType (hFile=0x154) returned 0x1 [0124.484] WriteFile (in: hFile=0x154, lpBuffer=0x19f855c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19f855c*, lpNumberOfBytesWritten=0x2ae270*=0x9b0, lpOverlapped=0x0) returned 1 [0124.486] CloseHandle (hObject=0x154) returned 1 [0124.486] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg", lpFilePart=0x0) returned 0x71 [0124.486] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[2].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d751b70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d751b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9235b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0124.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.486] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[2].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGlfk[2].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbglfk[2].jpg.anonymous")) returned 1 [0124.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png", lpFilePart=0x0) returned 0x71 [0124.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.487] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgxqk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.488] GetFileType (hFile=0x154) returned 0x1 [0124.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.488] GetFileType (hFile=0x154) returned 0x1 [0124.488] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x40bc [0124.488] ReadFile (in: hFile=0x154, lpBuffer=0x19f99ec, nNumberOfBytesToRead=0x40bc, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f99ec*, lpNumberOfBytesRead=0x2ae2a8*=0x40bc, lpOverlapped=0x0) returned 1 [0124.505] CloseHandle (hObject=0x154) returned 1 [0124.518] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png", lpFilePart=0x0) returned 0x71 [0124.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.518] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgxqk[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.520] GetFileType (hFile=0x154) returned 0x1 [0124.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.520] GetFileType (hFile=0x154) returned 0x1 [0124.520] WriteFile (in: hFile=0x154, lpBuffer=0x1a5ab94*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a5ab94*, lpNumberOfBytesWritten=0x2ae29c*=0x40c0, lpOverlapped=0x0) returned 1 [0124.522] CloseHandle (hObject=0x154) returned 1 [0124.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png", lpFilePart=0x0) returned 0x71 [0124.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0124.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgxqk[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d91abf0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d91abf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9281e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40c0)) returned 1 [0124.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.522] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgxqk[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBGXQk[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbgxqk[1].png.anonymous")) returned 1 [0124.523] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg", lpFilePart=0x0) returned 0x71 [0124.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.523] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbhqjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.523] GetFileType (hFile=0x154) returned 0x1 [0124.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.523] GetFileType (hFile=0x154) returned 0x1 [0124.523] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x625 [0124.523] ReadFile (in: hFile=0x154, lpBuffer=0x1a5f890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a5f890*, lpNumberOfBytesRead=0x2ae2a8*=0x625, lpOverlapped=0x0) returned 1 [0124.535] CloseHandle (hObject=0x154) returned 1 [0124.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg", lpFilePart=0x0) returned 0x71 [0124.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.548] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbhqjo[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.550] GetFileType (hFile=0x154) returned 0x1 [0124.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.550] GetFileType (hFile=0x154) returned 0x1 [0124.550] WriteFile (in: hFile=0x154, lpBuffer=0x1aaf6f8*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aaf6f8*, lpNumberOfBytesWritten=0x2ae270*=0x630, lpOverlapped=0x0) returned 1 [0124.551] CloseHandle (hObject=0x154) returned 1 [0124.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg", lpFilePart=0x0) returned 0x71 [0124.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.551] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbhqjo[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7788cf90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7788cf90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe92ce0d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x630)) returned 1 [0124.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.552] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbhqjo[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBHqjo[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbhqjo[1].jpg.anonymous")) returned 1 [0124.552] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg", lpFilePart=0x0) returned 0x71 [0124.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.552] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbia72[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.552] GetFileType (hFile=0x154) returned 0x1 [0124.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.553] GetFileType (hFile=0x154) returned 0x1 [0124.553] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4d04 [0124.553] ReadFile (in: hFile=0x154, lpBuffer=0x1ab0b88, nNumberOfBytesToRead=0x4d04, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab0b88*, lpNumberOfBytesRead=0x2ae2a8*=0x4d04, lpOverlapped=0x0) returned 1 [0124.566] CloseHandle (hObject=0x154) returned 1 [0124.579] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg", lpFilePart=0x0) returned 0x71 [0124.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.579] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbia72[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.580] GetFileType (hFile=0x154) returned 0x1 [0124.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.580] GetFileType (hFile=0x154) returned 0x1 [0124.580] WriteFile (in: hFile=0x154, lpBuffer=0x1b15ac0*, nNumberOfBytesToWrite=0x4d10, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b15ac0*, lpNumberOfBytesWritten=0x2ae29c*=0x4d10, lpOverlapped=0x0) returned 1 [0124.582] CloseHandle (hObject=0x154) returned 1 [0124.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg", lpFilePart=0x0) returned 0x71 [0124.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbia72[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bfa70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d3bfa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe931a390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d10)) returned 1 [0124.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.582] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbia72[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIa72[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbia72[1].jpg.anonymous")) returned 1 [0124.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg", lpFilePart=0x0) returned 0x71 [0124.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.583] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiath[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.583] GetFileType (hFile=0x154) returned 0x1 [0124.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.583] GetFileType (hFile=0x154) returned 0x1 [0124.583] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2734 [0124.583] ReadFile (in: hFile=0x154, lpBuffer=0x1b1add8, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b1add8*, lpNumberOfBytesRead=0x2ae2a8*=0x2734, lpOverlapped=0x0) returned 1 [0124.585] CloseHandle (hObject=0x154) returned 1 [0124.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg", lpFilePart=0x0) returned 0x71 [0124.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.598] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiath[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.599] GetFileType (hFile=0x154) returned 0x1 [0124.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.600] GetFileType (hFile=0x154) returned 0x1 [0124.600] WriteFile (in: hFile=0x154, lpBuffer=0x1b74000*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b74000*, lpNumberOfBytesWritten=0x2ae29c*=0x2740, lpOverlapped=0x0) returned 1 [0124.601] CloseHandle (hObject=0x154) returned 1 [0124.601] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg", lpFilePart=0x0) returned 0x71 [0124.601] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiath[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x778d9250, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x778d9250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe93404f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2740)) returned 1 [0124.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.601] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiath[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIath[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiath[1].jpg.anonymous")) returned 1 [0124.602] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg", lpFilePart=0x0) returned 0x71 [0124.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.602] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiekh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.602] GetFileType (hFile=0x154) returned 0x1 [0124.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.602] GetFileType (hFile=0x154) returned 0x1 [0124.602] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1a0b [0124.602] ReadFile (in: hFile=0x154, lpBuffer=0x1b76d48, nNumberOfBytesToRead=0x1a0b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b76d48*, lpNumberOfBytesRead=0x2ae2a8*=0x1a0b, lpOverlapped=0x0) returned 1 [0124.611] CloseHandle (hObject=0x154) returned 1 [0124.649] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg", lpFilePart=0x0) returned 0x71 [0124.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.649] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiekh[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.651] GetFileType (hFile=0x154) returned 0x1 [0124.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.651] GetFileType (hFile=0x154) returned 0x1 [0124.651] WriteFile (in: hFile=0x154, lpBuffer=0x19caa5c*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19caa5c*, lpNumberOfBytesWritten=0x2ae29c*=0x1a10, lpOverlapped=0x0) returned 1 [0124.652] CloseHandle (hObject=0x154) returned 1 [0124.652] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg", lpFilePart=0x0) returned 0x71 [0124.652] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiekh[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bfa70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d3bfa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe93d8a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a10)) returned 1 [0124.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.652] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiekh[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIEkH[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiekh[1].jpg.anonymous")) returned 1 [0124.653] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg", lpFilePart=0x0) returned 0x71 [0124.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.653] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbienj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.653] GetFileType (hFile=0x154) returned 0x1 [0124.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.653] GetFileType (hFile=0x154) returned 0x1 [0124.654] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1f19 [0124.654] ReadFile (in: hFile=0x154, lpBuffer=0x19cca74, nNumberOfBytesToRead=0x1f19, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19cca74*, lpNumberOfBytesRead=0x2ae2a8*=0x1f19, lpOverlapped=0x0) returned 1 [0124.655] CloseHandle (hObject=0x154) returned 1 [0124.667] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg", lpFilePart=0x0) returned 0x71 [0124.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.667] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbienj[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.669] GetFileType (hFile=0x154) returned 0x1 [0124.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.669] GetFileType (hFile=0x154) returned 0x1 [0124.669] WriteFile (in: hFile=0x154, lpBuffer=0x1a2355c*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a2355c*, lpNumberOfBytesWritten=0x2ae29c*=0x1f20, lpOverlapped=0x0) returned 1 [0124.672] CloseHandle (hObject=0x154) returned 1 [0124.672] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg", lpFilePart=0x0) returned 0x71 [0124.673] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.673] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbienj[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da71850, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da71850, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe93febd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f20)) returned 1 [0124.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.673] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIeNJ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbienj[1].jpg.anonymous")) returned 1 [0124.674] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg", lpFilePart=0x0) returned 0x71 [0124.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.674] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbifdw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.674] GetFileType (hFile=0x154) returned 0x1 [0124.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.674] GetFileType (hFile=0x154) returned 0x1 [0124.674] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x795 [0124.674] ReadFile (in: hFile=0x154, lpBuffer=0x1a26228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a26228*, lpNumberOfBytesRead=0x2ae2a8*=0x795, lpOverlapped=0x0) returned 1 [0124.676] CloseHandle (hObject=0x154) returned 1 [0124.687] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg", lpFilePart=0x0) returned 0x71 [0124.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.687] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbifdw[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.689] GetFileType (hFile=0x154) returned 0x1 [0124.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.689] GetFileType (hFile=0x154) returned 0x1 [0124.689] WriteFile (in: hFile=0x154, lpBuffer=0x1a767c0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a767c0*, lpNumberOfBytesWritten=0x2ae270*=0x7a0, lpOverlapped=0x0) returned 1 [0124.690] CloseHandle (hObject=0x154) returned 1 [0124.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg", lpFilePart=0x0) returned 0x71 [0124.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbifdw[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7dabdb10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7dabdb10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9424d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7a0)) returned 1 [0124.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.690] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbifdw[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIFdW[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbifdw[1].jpg.anonymous")) returned 1 [0124.691] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg", lpFilePart=0x0) returned 0x71 [0124.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.691] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbijmg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.691] GetFileType (hFile=0x154) returned 0x1 [0124.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.691] GetFileType (hFile=0x154) returned 0x1 [0124.691] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2239 [0124.691] ReadFile (in: hFile=0x154, lpBuffer=0x1a77c50, nNumberOfBytesToRead=0x2239, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a77c50*, lpNumberOfBytesRead=0x2ae2a8*=0x2239, lpOverlapped=0x0) returned 1 [0124.706] CloseHandle (hObject=0x154) returned 1 [0124.719] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg", lpFilePart=0x0) returned 0x71 [0124.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.719] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbijmg[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.720] GetFileType (hFile=0x154) returned 0x1 [0124.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.720] GetFileType (hFile=0x154) returned 0x1 [0124.721] WriteFile (in: hFile=0x154, lpBuffer=0x1acf57c*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1acf57c*, lpNumberOfBytesWritten=0x2ae29c*=0x2240, lpOverlapped=0x0) returned 1 [0124.722] CloseHandle (hObject=0x154) returned 1 [0124.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg", lpFilePart=0x0) returned 0x71 [0124.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbijmg[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x773ca390, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x773ca390, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9470ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2240)) returned 1 [0124.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.722] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbijmg[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIJMg[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbijmg[1].jpg.anonymous")) returned 1 [0124.723] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg", lpFilePart=0x0) returned 0x71 [0124.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.723] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbilqq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.723] GetFileType (hFile=0x154) returned 0x1 [0124.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.723] GetFileType (hFile=0x154) returned 0x1 [0124.723] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2f33 [0124.724] ReadFile (in: hFile=0x154, lpBuffer=0x1ad1dc4, nNumberOfBytesToRead=0x2f33, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ad1dc4*, lpNumberOfBytesRead=0x2ae2a8*=0x2f33, lpOverlapped=0x0) returned 1 [0124.725] CloseHandle (hObject=0x154) returned 1 [0124.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg", lpFilePart=0x0) returned 0x71 [0124.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.738] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbilqq[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.739] GetFileType (hFile=0x154) returned 0x1 [0124.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.739] GetFileType (hFile=0x154) returned 0x1 [0124.739] WriteFile (in: hFile=0x154, lpBuffer=0x1b2d7f0*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b2d7f0*, lpNumberOfBytesWritten=0x2ae29c*=0x2f40, lpOverlapped=0x0) returned 1 [0124.740] CloseHandle (hObject=0x154) returned 1 [0124.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg", lpFilePart=0x0) returned 0x71 [0124.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbilqq[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da4b6f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da4b6f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9497150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f40)) returned 1 [0124.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.741] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbilqq[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBILqQ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbilqq[1].jpg.anonymous")) returned 1 [0124.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg", lpFilePart=0x0) returned 0x71 [0124.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.741] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbinmp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.742] GetFileType (hFile=0x154) returned 0x1 [0124.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.742] GetFileType (hFile=0x154) returned 0x1 [0124.742] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x315b [0124.742] ReadFile (in: hFile=0x154, lpBuffer=0x1b30d38, nNumberOfBytesToRead=0x315b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b30d38*, lpNumberOfBytesRead=0x2ae2a8*=0x315b, lpOverlapped=0x0) returned 1 [0124.750] CloseHandle (hObject=0x154) returned 1 [0124.768] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg", lpFilePart=0x0) returned 0x71 [0124.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.769] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbinmp[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.770] GetFileType (hFile=0x154) returned 0x1 [0124.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.770] GetFileType (hFile=0x154) returned 0x1 [0124.770] WriteFile (in: hFile=0x154, lpBuffer=0x1994b1c*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1994b1c*, lpNumberOfBytesWritten=0x2ae29c*=0x3160, lpOverlapped=0x0) returned 1 [0124.772] CloseHandle (hObject=0x154) returned 1 [0124.772] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg", lpFilePart=0x0) returned 0x71 [0124.772] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbinmp[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9d92d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9d92d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe94e3410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3160)) returned 1 [0124.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.772] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbinmp[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBInmp[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbinmp[1].jpg.anonymous")) returned 1 [0124.773] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg", lpFilePart=0x0) returned 0x71 [0124.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.773] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio0d[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.773] GetFileType (hFile=0x154) returned 0x1 [0124.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.773] GetFileType (hFile=0x154) returned 0x1 [0124.773] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x74a [0124.773] ReadFile (in: hFile=0x154, lpBuffer=0x19989dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19989dc*, lpNumberOfBytesRead=0x2ae2a8*=0x74a, lpOverlapped=0x0) returned 1 [0124.805] CloseHandle (hObject=0x154) returned 1 [0124.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg", lpFilePart=0x0) returned 0x71 [0124.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.843] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio0d[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.844] GetFileType (hFile=0x154) returned 0x1 [0124.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.844] GetFileType (hFile=0x154) returned 0x1 [0124.844] WriteFile (in: hFile=0x154, lpBuffer=0x19e8f3c*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19e8f3c*, lpNumberOfBytesWritten=0x2ae270*=0x750, lpOverlapped=0x0) returned 1 [0124.845] CloseHandle (hObject=0x154) returned 1 [0124.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg", lpFilePart=0x0) returned 0x71 [0124.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio0d[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6b95f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6b95f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe95a1af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0124.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.846] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio0d[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo0d[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio0d[1].jpg.anonymous")) returned 1 [0124.847] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg", lpFilePart=0x0) returned 0x71 [0124.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.847] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio7f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.847] GetFileType (hFile=0x154) returned 0x1 [0124.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.847] GetFileType (hFile=0x154) returned 0x1 [0124.847] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x722 [0124.847] ReadFile (in: hFile=0x154, lpBuffer=0x19eaafc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19eaafc*, lpNumberOfBytesRead=0x2ae2a8*=0x722, lpOverlapped=0x0) returned 1 [0124.863] CloseHandle (hObject=0x154) returned 1 [0124.898] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg", lpFilePart=0x0) returned 0x71 [0124.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.898] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio7f[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.904] GetFileType (hFile=0x154) returned 0x1 [0124.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.904] GetFileType (hFile=0x154) returned 0x1 [0124.905] WriteFile (in: hFile=0x154, lpBuffer=0x1a3ae68*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a3ae68*, lpNumberOfBytesWritten=0x2ae270*=0x730, lpOverlapped=0x0) returned 1 [0124.906] CloseHandle (hObject=0x154) returned 1 [0124.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg", lpFilePart=0x0) returned 0x71 [0124.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio7f[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d966eb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d966eb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe963a070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x730)) returned 1 [0124.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.906] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio7f[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIo7F[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbio7f[1].jpg.anonymous")) returned 1 [0124.907] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg", lpFilePart=0x0) returned 0x71 [0124.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.907] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiply[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.907] GetFileType (hFile=0x154) returned 0x1 [0124.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.907] GetFileType (hFile=0x154) returned 0x1 [0124.907] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa97 [0124.907] ReadFile (in: hFile=0x154, lpBuffer=0x1a3cd9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a3cd9c*, lpNumberOfBytesRead=0x2ae2a8*=0xa97, lpOverlapped=0x0) returned 1 [0124.947] CloseHandle (hObject=0x154) returned 1 [0124.979] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg", lpFilePart=0x0) returned 0x71 [0124.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0124.979] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiply[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.982] GetFileType (hFile=0x154) returned 0x1 [0124.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0124.982] GetFileType (hFile=0x154) returned 0x1 [0124.982] WriteFile (in: hFile=0x154, lpBuffer=0x1a8e234*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a8e234*, lpNumberOfBytesWritten=0x2ae270*=0xaa0, lpOverlapped=0x0) returned 1 [0124.987] CloseHandle (hObject=0x154) returned 1 [0124.987] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg", lpFilePart=0x0) returned 0x71 [0124.987] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0124.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0124.987] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiply[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d72ba10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d72ba10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe96f8750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaa0)) returned 1 [0124.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0124.987] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiply[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIplY[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiply[1].jpg.anonymous")) returned 1 [0124.988] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg", lpFilePart=0x0) returned 0x71 [0124.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0124.988] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiqsn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0124.988] GetFileType (hFile=0x154) returned 0x1 [0124.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0124.988] GetFileType (hFile=0x154) returned 0x1 [0124.989] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x27a9 [0124.989] ReadFile (in: hFile=0x154, lpBuffer=0x1a8f6c4, nNumberOfBytesToRead=0x27a9, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a8f6c4*, lpNumberOfBytesRead=0x2ae2a8*=0x27a9, lpOverlapped=0x0) returned 1 [0124.996] CloseHandle (hObject=0x154) returned 1 [0125.015] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg", lpFilePart=0x0) returned 0x71 [0125.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.015] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiqsn[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.017] GetFileType (hFile=0x154) returned 0x1 [0125.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.017] GetFileType (hFile=0x154) returned 0x1 [0125.018] WriteFile (in: hFile=0x154, lpBuffer=0x1ae8b20*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ae8b20*, lpNumberOfBytesWritten=0x2ae29c*=0x27b0, lpOverlapped=0x0) returned 1 [0125.019] CloseHandle (hObject=0x154) returned 1 [0125.019] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg", lpFilePart=0x0) returned 0x71 [0125.019] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiqsn[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6df750, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6df750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9744a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27b0)) returned 1 [0125.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.019] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiqsn[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIqSn[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiqsn[1].jpg.anonymous")) returned 1 [0125.020] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg", lpFilePart=0x0) returned 0x71 [0125.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.020] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbishe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.020] GetFileType (hFile=0x154) returned 0x1 [0125.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.020] GetFileType (hFile=0x154) returned 0x1 [0125.020] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x11d8 [0125.020] ReadFile (in: hFile=0x154, lpBuffer=0x1aeb8d8, nNumberOfBytesToRead=0x11d8, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aeb8d8*, lpNumberOfBytesRead=0x2ae2a8*=0x11d8, lpOverlapped=0x0) returned 1 [0125.034] CloseHandle (hObject=0x154) returned 1 [0125.054] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg", lpFilePart=0x0) returned 0x71 [0125.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.054] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbishe[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.055] GetFileType (hFile=0x154) returned 0x1 [0125.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.055] GetFileType (hFile=0x154) returned 0x1 [0125.055] WriteFile (in: hFile=0x154, lpBuffer=0x1b3e020*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b3e020*, lpNumberOfBytesWritten=0x2ae29c*=0x11e0, lpOverlapped=0x0) returned 1 [0125.066] CloseHandle (hObject=0x154) returned 1 [0125.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg", lpFilePart=0x0) returned 0x71 [0125.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbishe[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9ff430, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9ff430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe97b6e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11e0)) returned 1 [0125.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.067] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbishe[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIsHe[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbishe[1].jpg.anonymous")) returned 1 [0125.068] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg", lpFilePart=0x0) returned 0x71 [0125.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.068] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiswa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.068] GetFileType (hFile=0x154) returned 0x1 [0125.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.068] GetFileType (hFile=0x154) returned 0x1 [0125.068] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2630 [0125.068] ReadFile (in: hFile=0x154, lpBuffer=0x1b3f808, nNumberOfBytesToRead=0x2630, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b3f808*, lpNumberOfBytesRead=0x2ae2a8*=0x2630, lpOverlapped=0x0) returned 1 [0125.080] CloseHandle (hObject=0x154) returned 1 [0125.106] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg", lpFilePart=0x0) returned 0x71 [0125.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.106] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiswa[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.108] GetFileType (hFile=0x154) returned 0x1 [0125.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.108] GetFileType (hFile=0x154) returned 0x1 [0125.108] WriteFile (in: hFile=0x154, lpBuffer=0x19929d8*, nNumberOfBytesToWrite=0x2640, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19929d8*, lpNumberOfBytesWritten=0x2ae29c*=0x2640, lpOverlapped=0x0) returned 1 [0125.109] CloseHandle (hObject=0x154) returned 1 [0125.109] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg", lpFilePart=0x0) returned 0x71 [0125.109] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.109] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiswa[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d751b70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d751b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9829250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2640)) returned 1 [0125.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.109] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiswa[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBISwA[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiswa[1].jpg.anonymous")) returned 1 [0125.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg", lpFilePart=0x0) returned 0x71 [0125.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.110] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiwgr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.110] GetFileType (hFile=0x154) returned 0x1 [0125.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.110] GetFileType (hFile=0x154) returned 0x1 [0125.110] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9de [0125.110] ReadFile (in: hFile=0x154, lpBuffer=0x199600c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199600c*, lpNumberOfBytesRead=0x2ae2a8*=0x9de, lpOverlapped=0x0) returned 1 [0125.121] CloseHandle (hObject=0x154) returned 1 [0125.161] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg", lpFilePart=0x0) returned 0x71 [0125.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.161] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiwgr[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.163] GetFileType (hFile=0x154) returned 0x1 [0125.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.163] GetFileType (hFile=0x154) returned 0x1 [0125.163] WriteFile (in: hFile=0x154, lpBuffer=0x19e7238*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19e7238*, lpNumberOfBytesWritten=0x2ae270*=0x9e0, lpOverlapped=0x0) returned 1 [0125.165] CloseHandle (hObject=0x154) returned 1 [0125.165] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg", lpFilePart=0x0) returned 0x71 [0125.166] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiwgr[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d966eb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d966eb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe98c17d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1 [0125.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.166] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiwgr[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBIwGr[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbiwgr[1].jpg.anonymous")) returned 1 [0125.167] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg", lpFilePart=0x0) returned 0x71 [0125.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.167] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbl4r9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.168] GetFileType (hFile=0x154) returned 0x1 [0125.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.168] GetFileType (hFile=0x154) returned 0x1 [0125.168] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2569 [0125.168] ReadFile (in: hFile=0x154, lpBuffer=0x19e86c8, nNumberOfBytesToRead=0x2569, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19e86c8*, lpNumberOfBytesRead=0x2ae2a8*=0x2569, lpOverlapped=0x0) returned 1 [0125.184] CloseHandle (hObject=0x154) returned 1 [0125.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg", lpFilePart=0x0) returned 0x71 [0125.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.200] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbl4r9[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.202] GetFileType (hFile=0x154) returned 0x1 [0125.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.202] GetFileType (hFile=0x154) returned 0x1 [0125.202] WriteFile (in: hFile=0x154, lpBuffer=0x1a40fe4*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a40fe4*, lpNumberOfBytesWritten=0x2ae29c*=0x2570, lpOverlapped=0x0) returned 1 [0125.203] CloseHandle (hObject=0x154) returned 1 [0125.203] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg", lpFilePart=0x0) returned 0x71 [0125.203] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbl4r9[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5560c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5560c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe990da90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2570)) returned 1 [0125.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.204] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBL4R9[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbl4r9[1].jpg.anonymous")) returned 1 [0125.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg", lpFilePart=0x0) returned 0x71 [0125.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.205] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbsqnl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.205] GetFileType (hFile=0x154) returned 0x1 [0125.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.205] GetFileType (hFile=0x154) returned 0x1 [0125.205] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x16d6 [0125.205] ReadFile (in: hFile=0x154, lpBuffer=0x1a43b5c, nNumberOfBytesToRead=0x16d6, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a43b5c*, lpNumberOfBytesRead=0x2ae2a8*=0x16d6, lpOverlapped=0x0) returned 1 [0125.229] CloseHandle (hObject=0x154) returned 1 [0125.248] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg", lpFilePart=0x0) returned 0x71 [0125.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.248] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbsqnl[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.249] GetFileType (hFile=0x154) returned 0x1 [0125.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.249] GetFileType (hFile=0x154) returned 0x1 [0125.249] WriteFile (in: hFile=0x154, lpBuffer=0x1a97ba8*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a97ba8*, lpNumberOfBytesWritten=0x2ae29c*=0x16e0, lpOverlapped=0x0) returned 1 [0125.251] CloseHandle (hObject=0x154) returned 1 [0125.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg", lpFilePart=0x0) returned 0x71 [0125.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbsqnl[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8f4a90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8f4a90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe997feb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16e0)) returned 1 [0125.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.251] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBsqNL[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbsqnl[1].jpg.anonymous")) returned 1 [0125.252] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg", lpFilePart=0x0) returned 0x71 [0125.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.252] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbypef[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.252] GetFileType (hFile=0x154) returned 0x1 [0125.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.252] GetFileType (hFile=0x154) returned 0x1 [0125.252] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2d4e [0125.252] ReadFile (in: hFile=0x154, lpBuffer=0x1a99890, nNumberOfBytesToRead=0x2d4e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a99890*, lpNumberOfBytesRead=0x2ae2a8*=0x2d4e, lpOverlapped=0x0) returned 1 [0125.365] CloseHandle (hObject=0x154) returned 1 [0125.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg", lpFilePart=0x0) returned 0x71 [0125.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.377] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbypef[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.379] GetFileType (hFile=0x154) returned 0x1 [0125.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.379] GetFileType (hFile=0x154) returned 0x1 [0125.379] WriteFile (in: hFile=0x154, lpBuffer=0x1af490c*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1af490c*, lpNumberOfBytesWritten=0x2ae29c*=0x2d50, lpOverlapped=0x0) returned 1 [0125.380] CloseHandle (hObject=0x154) returned 1 [0125.380] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg", lpFilePart=0x0) returned 0x71 [0125.380] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbypef[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7ea0f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7ea0f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9ab09b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d50)) returned 1 [0125.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.381] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbypef[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBypEf[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbypef[1].jpg.anonymous")) returned 1 [0125.381] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg", lpFilePart=0x0) returned 0x71 [0125.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.381] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbzdsd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.382] GetFileType (hFile=0x154) returned 0x1 [0125.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.382] GetFileType (hFile=0x154) returned 0x1 [0125.382] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x995 [0125.382] ReadFile (in: hFile=0x154, lpBuffer=0x1af8608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af8608*, lpNumberOfBytesRead=0x2ae2a8*=0x995, lpOverlapped=0x0) returned 1 [0125.384] CloseHandle (hObject=0x154) returned 1 [0125.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg", lpFilePart=0x0) returned 0x71 [0125.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.395] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbzdsd[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.397] GetFileType (hFile=0x154) returned 0x1 [0125.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.397] GetFileType (hFile=0x154) returned 0x1 [0125.397] WriteFile (in: hFile=0x154, lpBuffer=0x1b495a0*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b495a0*, lpNumberOfBytesWritten=0x2ae270*=0x9a0, lpOverlapped=0x0) returned 1 [0125.398] CloseHandle (hObject=0x154) returned 1 [0125.398] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg", lpFilePart=0x0) returned 0x71 [0125.398] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbzdsd[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8ce930, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8ce930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xe9ad6b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0125.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.398] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbzdsd[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBBzdsD[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbbzdsd[1].jpg.anonymous")) returned 1 [0125.399] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg", lpFilePart=0x0) returned 0x71 [0125.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.399] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdaukm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.400] GetFileType (hFile=0x154) returned 0x1 [0125.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.400] GetFileType (hFile=0x154) returned 0x1 [0125.400] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1d34 [0125.400] ReadFile (in: hFile=0x154, lpBuffer=0x1b4aa30, nNumberOfBytesToRead=0x1d34, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b4aa30*, lpNumberOfBytesRead=0x2ae2a8*=0x1d34, lpOverlapped=0x0) returned 1 [0125.462] CloseHandle (hObject=0x154) returned 1 [0125.513] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg", lpFilePart=0x0) returned 0x71 [0125.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.513] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdaukm[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.515] GetFileType (hFile=0x154) returned 0x1 [0125.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.515] GetFileType (hFile=0x154) returned 0x1 [0125.515] WriteFile (in: hFile=0x154, lpBuffer=0x199b1ac*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x199b1ac*, lpNumberOfBytesWritten=0x2ae29c*=0x1d40, lpOverlapped=0x0) returned 1 [0125.516] CloseHandle (hObject=0x154) returned 1 [0125.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg", lpFilePart=0x0) returned 0x71 [0125.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdaukm[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5c84e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5c84e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9c07610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d40)) returned 1 [0125.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.517] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdaukm[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDAUkm[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdaukm[1].jpg.anonymous")) returned 1 [0125.518] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg", lpFilePart=0x0) returned 0x71 [0125.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.518] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjemt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.520] GetFileType (hFile=0x154) returned 0x1 [0125.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.520] GetFileType (hFile=0x154) returned 0x1 [0125.520] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x19f3 [0125.520] ReadFile (in: hFile=0x154, lpBuffer=0x199d4f4, nNumberOfBytesToRead=0x19f3, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199d4f4*, lpNumberOfBytesRead=0x2ae2a8*=0x19f3, lpOverlapped=0x0) returned 1 [0125.533] CloseHandle (hObject=0x154) returned 1 [0125.552] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg", lpFilePart=0x0) returned 0x71 [0125.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.552] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjemt[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.554] GetFileType (hFile=0x154) returned 0x1 [0125.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.554] GetFileType (hFile=0x154) returned 0x1 [0125.554] WriteFile (in: hFile=0x154, lpBuffer=0x19f263c*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19f263c*, lpNumberOfBytesWritten=0x2ae29c*=0x1a00, lpOverlapped=0x0) returned 1 [0125.556] CloseHandle (hObject=0x154) returned 1 [0125.556] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg", lpFilePart=0x0) returned 0x71 [0125.556] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjemt[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1c3fc0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c1c3fc0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9c79a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1 [0125.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.556] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjemt[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEMT[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjemt[1].jpg.anonymous")) returned 1 [0125.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg", lpFilePart=0x0) returned 0x71 [0125.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.557] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjeon[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.558] GetFileType (hFile=0x154) returned 0x1 [0125.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.558] GetFileType (hFile=0x154) returned 0x1 [0125.558] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa1e [0125.558] ReadFile (in: hFile=0x154, lpBuffer=0x19f5070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f5070*, lpNumberOfBytesRead=0x2ae2a8*=0xa1e, lpOverlapped=0x0) returned 1 [0125.576] CloseHandle (hObject=0x154) returned 1 [0125.591] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg", lpFilePart=0x0) returned 0x71 [0125.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.592] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjeon[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.593] GetFileType (hFile=0x154) returned 0x1 [0125.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.593] GetFileType (hFile=0x154) returned 0x1 [0125.593] WriteFile (in: hFile=0x154, lpBuffer=0x1a46280*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a46280*, lpNumberOfBytesWritten=0x2ae270*=0xa20, lpOverlapped=0x0) returned 1 [0125.594] CloseHandle (hObject=0x154) returned 1 [0125.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg", lpFilePart=0x0) returned 0x71 [0125.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjeon[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7943db00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b140720, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9cc5cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa20)) returned 1 [0125.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.594] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjeon[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJEON[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjeon[1].jpg.anonymous")) returned 1 [0125.595] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg", lpFilePart=0x0) returned 0x71 [0125.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.595] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjgug[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.596] GetFileType (hFile=0x154) returned 0x1 [0125.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.596] GetFileType (hFile=0x154) returned 0x1 [0125.596] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1bff [0125.596] ReadFile (in: hFile=0x154, lpBuffer=0x1a47710, nNumberOfBytesToRead=0x1bff, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a47710*, lpNumberOfBytesRead=0x2ae2a8*=0x1bff, lpOverlapped=0x0) returned 1 [0125.601] CloseHandle (hObject=0x154) returned 1 [0125.614] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg", lpFilePart=0x0) returned 0x71 [0125.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.614] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjgug[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.616] GetFileType (hFile=0x154) returned 0x1 [0125.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.616] GetFileType (hFile=0x154) returned 0x1 [0125.616] WriteFile (in: hFile=0x154, lpBuffer=0x1a9d0fc*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a9d0fc*, lpNumberOfBytesWritten=0x2ae29c*=0x1c00, lpOverlapped=0x0) returned 1 [0125.617] CloseHandle (hObject=0x154) returned 1 [0125.617] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg", lpFilePart=0x0) returned 0x71 [0125.617] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjgug[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5c84e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5c84e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9cebe50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0125.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.618] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjgug[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJGUg[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjgug[1].jpg.anonymous")) returned 1 [0125.619] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg", lpFilePart=0x0) returned 0x71 [0125.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.619] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjjsj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.619] GetFileType (hFile=0x154) returned 0x1 [0125.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.620] GetFileType (hFile=0x154) returned 0x1 [0125.620] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x8ee [0125.620] ReadFile (in: hFile=0x154, lpBuffer=0x1a9fc00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a9fc00*, lpNumberOfBytesRead=0x2ae2a8*=0x8ee, lpOverlapped=0x0) returned 1 [0125.621] CloseHandle (hObject=0x154) returned 1 [0125.634] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg", lpFilePart=0x0) returned 0x71 [0125.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.635] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjjsj[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.636] GetFileType (hFile=0x154) returned 0x1 [0125.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.636] GetFileType (hFile=0x154) returned 0x1 [0125.636] WriteFile (in: hFile=0x154, lpBuffer=0x1af0820*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1af0820*, lpNumberOfBytesWritten=0x2ae270*=0x8f0, lpOverlapped=0x0) returned 1 [0125.637] CloseHandle (hObject=0x154) returned 1 [0125.637] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg", lpFilePart=0x0) returned 0x71 [0125.637] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjjsj[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b140720, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b140720, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9d38110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8f0)) returned 1 [0125.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.638] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjjsj[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJJsJ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjjsj[1].jpg.anonymous")) returned 1 [0125.638] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg", lpFilePart=0x0) returned 0x71 [0125.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.638] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjzwe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.639] GetFileType (hFile=0x154) returned 0x1 [0125.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.639] GetFileType (hFile=0x154) returned 0x1 [0125.639] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2309 [0125.639] ReadFile (in: hFile=0x154, lpBuffer=0x1af1cb0, nNumberOfBytesToRead=0x2309, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af1cb0*, lpNumberOfBytesRead=0x2ae2a8*=0x2309, lpOverlapped=0x0) returned 1 [0125.645] CloseHandle (hObject=0x154) returned 1 [0125.659] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg", lpFilePart=0x0) returned 0x71 [0125.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.659] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjzwe[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.661] GetFileType (hFile=0x154) returned 0x1 [0125.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.661] GetFileType (hFile=0x154) returned 0x1 [0125.661] WriteFile (in: hFile=0x154, lpBuffer=0x1b499ec*, nNumberOfBytesToWrite=0x2310, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b499ec*, lpNumberOfBytesWritten=0x2ae29c*=0x2310, lpOverlapped=0x0) returned 1 [0125.662] CloseHandle (hObject=0x154) returned 1 [0125.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg", lpFilePart=0x0) returned 0x71 [0125.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjzwe[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c84fc40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c84fc40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9d5e270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2310)) returned 1 [0125.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.662] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjzwe[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDJZwE[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdjzwe[1].jpg.anonymous")) returned 1 [0125.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg", lpFilePart=0x0) returned 0x71 [0125.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.663] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk1po[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.664] GetFileType (hFile=0x154) returned 0x1 [0125.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.664] GetFileType (hFile=0x154) returned 0x1 [0125.664] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x827 [0125.664] ReadFile (in: hFile=0x154, lpBuffer=0x1b4cb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b4cb38*, lpNumberOfBytesRead=0x2ae2a8*=0x827, lpOverlapped=0x0) returned 1 [0125.671] CloseHandle (hObject=0x154) returned 1 [0125.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg", lpFilePart=0x0) returned 0x71 [0125.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.722] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk1po[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.724] GetFileType (hFile=0x154) returned 0x1 [0125.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.724] GetFileType (hFile=0x154) returned 0x1 [0125.724] WriteFile (in: hFile=0x154, lpBuffer=0x199be8c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x199be8c*, lpNumberOfBytesWritten=0x2ae270*=0x830, lpOverlapped=0x0) returned 1 [0125.726] CloseHandle (hObject=0x154) returned 1 [0125.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg", lpFilePart=0x0) returned 0x71 [0125.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk1po[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cb95a80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cb95a80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9df67f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x830)) returned 1 [0125.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.727] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk1po[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK1Po[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk1po[1].jpg.anonymous")) returned 1 [0125.727] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg", lpFilePart=0x0) returned 0x71 [0125.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.728] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk305[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.728] GetFileType (hFile=0x154) returned 0x1 [0125.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.728] GetFileType (hFile=0x154) returned 0x1 [0125.728] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x662 [0125.728] ReadFile (in: hFile=0x154, lpBuffer=0x199d98c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199d98c*, lpNumberOfBytesRead=0x2ae2a8*=0x662, lpOverlapped=0x0) returned 1 [0125.765] CloseHandle (hObject=0x154) returned 1 [0125.783] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg", lpFilePart=0x0) returned 0x71 [0125.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.783] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk305[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.785] GetFileType (hFile=0x154) returned 0x1 [0125.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.785] GetFileType (hFile=0x154) returned 0x1 [0125.785] WriteFile (in: hFile=0x154, lpBuffer=0x19eda94*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19eda94*, lpNumberOfBytesWritten=0x2ae270*=0x670, lpOverlapped=0x0) returned 1 [0125.787] CloseHandle (hObject=0x154) returned 1 [0125.787] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg", lpFilePart=0x0) returned 0x71 [0125.787] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk305[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4979e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4979e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9e8ed70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x670)) returned 1 [0125.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.787] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk305[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDK305[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdk305[1].jpg.anonymous")) returned 1 [0125.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg", lpFilePart=0x0) returned 0x71 [0125.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.788] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdljft[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.788] GetFileType (hFile=0x154) returned 0x1 [0125.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.789] GetFileType (hFile=0x154) returned 0x1 [0125.789] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x26ac [0125.789] ReadFile (in: hFile=0x154, lpBuffer=0x19eef24, nNumberOfBytesToRead=0x26ac, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19eef24*, lpNumberOfBytesRead=0x2ae2a8*=0x26ac, lpOverlapped=0x0) returned 1 [0125.798] CloseHandle (hObject=0x154) returned 1 [0125.810] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg", lpFilePart=0x0) returned 0x71 [0125.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.810] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdljft[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.812] GetFileType (hFile=0x154) returned 0x1 [0125.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.812] GetFileType (hFile=0x154) returned 0x1 [0125.812] WriteFile (in: hFile=0x154, lpBuffer=0x1a47e7c*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a47e7c*, lpNumberOfBytesWritten=0x2ae29c*=0x26b0, lpOverlapped=0x0) returned 1 [0125.814] CloseHandle (hObject=0x154) returned 1 [0125.814] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg", lpFilePart=0x0) returned 0x71 [0125.814] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdljft[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1c3fc0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c1c3fc0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9edb030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26b0)) returned 1 [0125.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.814] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdljft[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLjFT[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdljft[1].jpg.anonymous")) returned 1 [0125.815] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg", lpFilePart=0x0) returned 0x71 [0125.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.815] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdll8d[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.818] GetFileType (hFile=0x154) returned 0x1 [0125.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.818] GetFileType (hFile=0x154) returned 0x1 [0125.818] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7a0 [0125.818] ReadFile (in: hFile=0x154, lpBuffer=0x1a4b2e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4b2e0*, lpNumberOfBytesRead=0x2ae2a8*=0x7a0, lpOverlapped=0x0) returned 1 [0125.826] CloseHandle (hObject=0x154) returned 1 [0125.842] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg", lpFilePart=0x0) returned 0x71 [0125.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.843] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdll8d[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.844] GetFileType (hFile=0x154) returned 0x1 [0125.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.844] GetFileType (hFile=0x154) returned 0x1 [0125.844] WriteFile (in: hFile=0x154, lpBuffer=0x1a9b8cc*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a9b8cc*, lpNumberOfBytesWritten=0x2ae270*=0x7b0, lpOverlapped=0x0) returned 1 [0125.846] CloseHandle (hObject=0x154) returned 1 [0125.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg", lpFilePart=0x0) returned 0x71 [0125.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdll8d[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c44b720, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c44b720, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9f272f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7b0)) returned 1 [0125.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.846] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdll8d[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLl8d[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdll8d[1].jpg.anonymous")) returned 1 [0125.847] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg", lpFilePart=0x0) returned 0x71 [0125.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.847] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlnhe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.847] GetFileType (hFile=0x154) returned 0x1 [0125.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.847] GetFileType (hFile=0x154) returned 0x1 [0125.847] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x21ec [0125.847] ReadFile (in: hFile=0x154, lpBuffer=0x1a9cd5c, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a9cd5c*, lpNumberOfBytesRead=0x2ae2a8*=0x21ec, lpOverlapped=0x0) returned 1 [0125.869] CloseHandle (hObject=0x154) returned 1 [0125.899] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg", lpFilePart=0x0) returned 0x71 [0125.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.899] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlnhe[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.901] GetFileType (hFile=0x154) returned 0x1 [0125.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.901] GetFileType (hFile=0x154) returned 0x1 [0125.901] WriteFile (in: hFile=0x154, lpBuffer=0x1af44f4*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1af44f4*, lpNumberOfBytesWritten=0x2ae29c*=0x21f0, lpOverlapped=0x0) returned 1 [0125.902] CloseHandle (hObject=0x154) returned 1 [0125.902] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg", lpFilePart=0x0) returned 0x71 [0125.902] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlnhe[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ab992e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7ab992e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xe9fbf870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21f0)) returned 1 [0125.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.903] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlnhe[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLNHE[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlnhe[1].jpg.anonymous")) returned 1 [0125.904] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg", lpFilePart=0x0) returned 0x71 [0125.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.904] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlqdv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.904] GetFileType (hFile=0x154) returned 0x1 [0125.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.905] GetFileType (hFile=0x154) returned 0x1 [0125.905] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x886 [0125.905] ReadFile (in: hFile=0x154, lpBuffer=0x1af7580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af7580*, lpNumberOfBytesRead=0x2ae2a8*=0x886, lpOverlapped=0x0) returned 1 [0125.921] CloseHandle (hObject=0x154) returned 1 [0125.937] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg", lpFilePart=0x0) returned 0x71 [0125.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0125.938] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlqdv[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.939] GetFileType (hFile=0x154) returned 0x1 [0125.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0125.940] GetFileType (hFile=0x154) returned 0x1 [0125.940] WriteFile (in: hFile=0x154, lpBuffer=0x1b47fc8*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b47fc8*, lpNumberOfBytesWritten=0x2ae270*=0x890, lpOverlapped=0x0) returned 1 [0125.943] CloseHandle (hObject=0x154) returned 1 [0125.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg", lpFilePart=0x0) returned 0x71 [0125.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0125.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0125.943] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlqdv[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4bdb40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4bdb40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea00bb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x890)) returned 1 [0125.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0125.944] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlqdv[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLqdv[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlqdv[1].jpg.anonymous")) returned 1 [0125.945] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg", lpFilePart=0x0) returned 0x71 [0125.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0125.945] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlv5i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0125.959] GetFileType (hFile=0x154) returned 0x1 [0125.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0125.959] GetFileType (hFile=0x154) returned 0x1 [0125.959] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7cb [0125.959] ReadFile (in: hFile=0x154, lpBuffer=0x1b49c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b49c30*, lpNumberOfBytesRead=0x2ae2a8*=0x7cb, lpOverlapped=0x0) returned 1 [0125.968] CloseHandle (hObject=0x154) returned 1 [0126.014] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg", lpFilePart=0x0) returned 0x71 [0126.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.014] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlv5i[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.016] GetFileType (hFile=0x154) returned 0x1 [0126.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.016] GetFileType (hFile=0x154) returned 0x1 [0126.016] WriteFile (in: hFile=0x154, lpBuffer=0x199a238*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x199a238*, lpNumberOfBytesWritten=0x2ae270*=0x7d0, lpOverlapped=0x0) returned 1 [0126.017] CloseHandle (hObject=0x154) returned 1 [0126.017] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg", lpFilePart=0x0) returned 0x71 [0126.017] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlv5i[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2f4ac0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2f4ac0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea0ca210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0126.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.018] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlv5i[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLv5i[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlv5i[1].jpg.anonymous")) returned 1 [0126.023] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg", lpFilePart=0x0) returned 0x71 [0126.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.023] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlwpx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.023] GetFileType (hFile=0x154) returned 0x1 [0126.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.023] GetFileType (hFile=0x154) returned 0x1 [0126.023] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x30dd [0126.023] ReadFile (in: hFile=0x154, lpBuffer=0x199b6c8, nNumberOfBytesToRead=0x30dd, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199b6c8*, lpNumberOfBytesRead=0x2ae2a8*=0x30dd, lpOverlapped=0x0) returned 1 [0126.026] CloseHandle (hObject=0x154) returned 1 [0126.045] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg", lpFilePart=0x0) returned 0x71 [0126.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.046] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlwpx[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.048] GetFileType (hFile=0x154) returned 0x1 [0126.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.048] GetFileType (hFile=0x154) returned 0x1 [0126.048] WriteFile (in: hFile=0x154, lpBuffer=0x19f7a70*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19f7a70*, lpNumberOfBytesWritten=0x2ae29c*=0x30e0, lpOverlapped=0x0) returned 1 [0126.049] CloseHandle (hObject=0x154) returned 1 [0126.050] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg", lpFilePart=0x0) returned 0x71 [0126.050] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlwpx[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc2e000, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc2e000, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea1164d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30e0)) returned 1 [0126.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.050] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlwpx[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDLwpx[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdlwpx[1].jpg.anonymous")) returned 1 [0126.051] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg", lpFilePart=0x0) returned 0x71 [0126.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.051] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8gk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.052] GetFileType (hFile=0x154) returned 0x1 [0126.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.052] GetFileType (hFile=0x154) returned 0x1 [0126.052] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2f62 [0126.052] ReadFile (in: hFile=0x154, lpBuffer=0x19fb158, nNumberOfBytesToRead=0x2f62, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19fb158*, lpNumberOfBytesRead=0x2ae2a8*=0x2f62, lpOverlapped=0x0) returned 1 [0126.072] CloseHandle (hObject=0x154) returned 1 [0126.088] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg", lpFilePart=0x0) returned 0x71 [0126.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.088] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8gk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.089] GetFileType (hFile=0x154) returned 0x1 [0126.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.089] GetFileType (hFile=0x154) returned 0x1 [0126.089] WriteFile (in: hFile=0x154, lpBuffer=0x1a56c74*, nNumberOfBytesToWrite=0x2f70, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a56c74*, lpNumberOfBytesWritten=0x2ae29c*=0x2f70, lpOverlapped=0x0) returned 1 [0126.091] CloseHandle (hObject=0x154) returned 1 [0126.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg", lpFilePart=0x0) returned 0x71 [0126.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8gk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d86680, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3d86680, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xea1888f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f70)) returned 1 [0126.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.092] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8gk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8gk[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8gk[1].jpg.anonymous")) returned 1 [0126.092] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg", lpFilePart=0x0) returned 0x71 [0126.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.092] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8ks[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.093] GetFileType (hFile=0x154) returned 0x1 [0126.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.093] GetFileType (hFile=0x154) returned 0x1 [0126.093] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x684 [0126.093] ReadFile (in: hFile=0x154, lpBuffer=0x1a5a87c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a5a87c*, lpNumberOfBytesRead=0x2ae2a8*=0x684, lpOverlapped=0x0) returned 1 [0126.104] CloseHandle (hObject=0x154) returned 1 [0126.117] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg", lpFilePart=0x0) returned 0x71 [0126.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.117] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8ks[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.118] GetFileType (hFile=0x154) returned 0x1 [0126.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.118] GetFileType (hFile=0x154) returned 0x1 [0126.118] WriteFile (in: hFile=0x154, lpBuffer=0x1aaa8c4*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aaa8c4*, lpNumberOfBytesWritten=0x2ae270*=0x690, lpOverlapped=0x0) returned 1 [0126.119] CloseHandle (hObject=0x154) returned 1 [0126.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg", lpFilePart=0x0) returned 0x71 [0126.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8ks[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbbbbe0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbbbbe0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea1d4bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x690)) returned 1 [0126.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.120] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8ks[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDM8ks[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdm8ks[1].jpg.anonymous")) returned 1 [0126.121] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg", lpFilePart=0x0) returned 0x71 [0126.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.121] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmbgi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.122] GetFileType (hFile=0x154) returned 0x1 [0126.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.122] GetFileType (hFile=0x154) returned 0x1 [0126.122] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3148 [0126.122] ReadFile (in: hFile=0x154, lpBuffer=0x1aabd54, nNumberOfBytesToRead=0x3148, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aabd54*, lpNumberOfBytesRead=0x2ae2a8*=0x3148, lpOverlapped=0x0) returned 1 [0126.123] CloseHandle (hObject=0x154) returned 1 [0126.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg", lpFilePart=0x0) returned 0x71 [0126.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.136] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmbgi[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.138] GetFileType (hFile=0x154) returned 0x1 [0126.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.138] GetFileType (hFile=0x154) returned 0x1 [0126.138] WriteFile (in: hFile=0x154, lpBuffer=0x1b081cc*, nNumberOfBytesToWrite=0x3150, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b081cc*, lpNumberOfBytesWritten=0x2ae29c*=0x3150, lpOverlapped=0x0) returned 1 [0126.140] CloseHandle (hObject=0x154) returned 1 [0126.140] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg", lpFilePart=0x0) returned 0x71 [0126.140] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmbgi[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ab26ec0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7ab26ec0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea1fad10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3150)) returned 1 [0126.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.140] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmbgi[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMBGI[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmbgi[1].jpg.anonymous")) returned 1 [0126.141] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg", lpFilePart=0x0) returned 0x71 [0126.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.141] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmlhy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.142] GetFileType (hFile=0x154) returned 0x1 [0126.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.142] GetFileType (hFile=0x154) returned 0x1 [0126.143] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9b8 [0126.143] ReadFile (in: hFile=0x154, lpBuffer=0x1b0c2e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b0c2e8*, lpNumberOfBytesRead=0x2ae2a8*=0x9b8, lpOverlapped=0x0) returned 1 [0126.151] CloseHandle (hObject=0x154) returned 1 [0126.164] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg", lpFilePart=0x0) returned 0x71 [0126.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.164] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmlhy[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.166] GetFileType (hFile=0x154) returned 0x1 [0126.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.166] GetFileType (hFile=0x154) returned 0x1 [0126.166] WriteFile (in: hFile=0x154, lpBuffer=0x1b5d31c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b5d31c*, lpNumberOfBytesWritten=0x2ae270*=0x9c0, lpOverlapped=0x0) returned 1 [0126.167] CloseHandle (hObject=0x154) returned 1 [0126.168] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg", lpFilePart=0x0) returned 0x71 [0126.168] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmlhy[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7dd820, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c7dd820, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea246fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0126.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.168] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmlhy[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMlhy[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmlhy[1].jpg.anonymous")) returned 1 [0126.169] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg", lpFilePart=0x0) returned 0x71 [0126.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.169] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmptj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.170] GetFileType (hFile=0x154) returned 0x1 [0126.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.170] GetFileType (hFile=0x154) returned 0x1 [0126.170] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1502 [0126.170] ReadFile (in: hFile=0x154, lpBuffer=0x1b5e7ac, nNumberOfBytesToRead=0x1502, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b5e7ac*, lpNumberOfBytesRead=0x2ae2a8*=0x1502, lpOverlapped=0x0) returned 1 [0126.179] CloseHandle (hObject=0x154) returned 1 [0126.215] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg", lpFilePart=0x0) returned 0x71 [0126.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.216] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmptj[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.217] GetFileType (hFile=0x154) returned 0x1 [0126.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.217] GetFileType (hFile=0x154) returned 0x1 [0126.217] WriteFile (in: hFile=0x154, lpBuffer=0x19b2bb8*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19b2bb8*, lpNumberOfBytesWritten=0x2ae29c*=0x1510, lpOverlapped=0x0) returned 1 [0126.218] CloseHandle (hObject=0x154) returned 1 [0126.218] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg", lpFilePart=0x0) returned 0x71 [0126.218] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmptj[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d698040, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7d698040, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea2b93f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1510)) returned 1 [0126.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.219] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmptj[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMptJ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmptj[1].jpg.anonymous")) returned 1 [0126.219] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg", lpFilePart=0x0) returned 0x71 [0126.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.219] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqqr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.220] GetFileType (hFile=0x154) returned 0x1 [0126.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.220] GetFileType (hFile=0x154) returned 0x1 [0126.220] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa4e [0126.220] ReadFile (in: hFile=0x154, lpBuffer=0x19b512c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b512c*, lpNumberOfBytesRead=0x2ae2a8*=0xa4e, lpOverlapped=0x0) returned 1 [0126.225] CloseHandle (hObject=0x154) returned 1 [0126.237] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg", lpFilePart=0x0) returned 0x71 [0126.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.237] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqqr[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.239] GetFileType (hFile=0x154) returned 0x1 [0126.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.239] GetFileType (hFile=0x154) returned 0x1 [0126.239] WriteFile (in: hFile=0x154, lpBuffer=0x1a06588*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a06588*, lpNumberOfBytesWritten=0x2ae270*=0xa50, lpOverlapped=0x0) returned 1 [0126.240] CloseHandle (hObject=0x154) returned 1 [0126.240] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg", lpFilePart=0x0) returned 0x71 [0126.240] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqqr[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c31ac20, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c31ac20, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea2df550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa50)) returned 1 [0126.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.240] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqqr[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqQr[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqqr[1].jpg.anonymous")) returned 1 [0126.253] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg", lpFilePart=0x0) returned 0x71 [0126.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.253] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqs4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.253] GetFileType (hFile=0x154) returned 0x1 [0126.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.253] GetFileType (hFile=0x154) returned 0x1 [0126.253] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1428 [0126.253] ReadFile (in: hFile=0x154, lpBuffer=0x1a07a18, nNumberOfBytesToRead=0x1428, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a07a18*, lpNumberOfBytesRead=0x2ae2a8*=0x1428, lpOverlapped=0x0) returned 1 [0126.262] CloseHandle (hObject=0x154) returned 1 [0126.275] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg", lpFilePart=0x0) returned 0x71 [0126.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.275] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqs4[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.276] GetFileType (hFile=0x154) returned 0x1 [0126.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.276] GetFileType (hFile=0x154) returned 0x1 [0126.276] WriteFile (in: hFile=0x154, lpBuffer=0x1a5acf0*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a5acf0*, lpNumberOfBytesWritten=0x2ae29c*=0x1430, lpOverlapped=0x0) returned 1 [0126.278] CloseHandle (hObject=0x154) returned 1 [0126.278] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg", lpFilePart=0x0) returned 0x71 [0126.278] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqs4[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ab26ec0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7ab26ec0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea351970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1430)) returned 1 [0126.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.278] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqs4[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMqs4[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmqs4[1].jpg.anonymous")) returned 1 [0126.279] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg", lpFilePart=0x0) returned 0x71 [0126.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.279] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdms2x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.279] GetFileType (hFile=0x154) returned 0x1 [0126.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.279] GetFileType (hFile=0x154) returned 0x1 [0126.279] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1de3 [0126.279] ReadFile (in: hFile=0x154, lpBuffer=0x1a5c728, nNumberOfBytesToRead=0x1de3, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a5c728*, lpNumberOfBytesRead=0x2ae2a8*=0x1de3, lpOverlapped=0x0) returned 1 [0126.290] CloseHandle (hObject=0x154) returned 1 [0126.302] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg", lpFilePart=0x0) returned 0x71 [0126.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.302] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdms2x[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.303] GetFileType (hFile=0x154) returned 0x1 [0126.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.303] GetFileType (hFile=0x154) returned 0x1 [0126.304] WriteFile (in: hFile=0x154, lpBuffer=0x1ab2ac4*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ab2ac4*, lpNumberOfBytesWritten=0x2ae29c*=0x1df0, lpOverlapped=0x0) returned 1 [0126.305] CloseHandle (hObject=0x154) returned 1 [0126.305] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg", lpFilePart=0x0) returned 0x71 [0126.305] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdms2x[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1c3fc0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c1c3fc0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea39dc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1df0)) returned 1 [0126.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.305] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdms2x[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMs2x[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdms2x[1].jpg.anonymous")) returned 1 [0126.306] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg", lpFilePart=0x0) returned 0x71 [0126.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.306] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmuu5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.307] GetFileType (hFile=0x154) returned 0x1 [0126.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.307] GetFileType (hFile=0x154) returned 0x1 [0126.307] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x20c2 [0126.307] ReadFile (in: hFile=0x154, lpBuffer=0x1ab4ebc, nNumberOfBytesToRead=0x20c2, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab4ebc*, lpNumberOfBytesRead=0x2ae2a8*=0x20c2, lpOverlapped=0x0) returned 1 [0126.318] CloseHandle (hObject=0x154) returned 1 [0126.332] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg", lpFilePart=0x0) returned 0x71 [0126.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.332] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmuu5[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.334] GetFileType (hFile=0x154) returned 0x1 [0126.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.334] GetFileType (hFile=0x154) returned 0x1 [0126.334] WriteFile (in: hFile=0x154, lpBuffer=0x1b0c0b8*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b0c0b8*, lpNumberOfBytesWritten=0x2ae29c*=0x20d0, lpOverlapped=0x0) returned 1 [0126.336] CloseHandle (hObject=0x154) returned 1 [0126.336] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg", lpFilePart=0x0) returned 0x71 [0126.336] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.336] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmuu5[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c509e00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c509e00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea3e9ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20d0)) returned 1 [0126.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.336] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmuu5[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMuu5[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmuu5[1].jpg.anonymous")) returned 1 [0126.337] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg", lpFilePart=0x0) returned 0x71 [0126.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.337] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmxja[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.338] GetFileType (hFile=0x154) returned 0x1 [0126.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.338] GetFileType (hFile=0x154) returned 0x1 [0126.338] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1732 [0126.338] ReadFile (in: hFile=0x154, lpBuffer=0x1b0e790, nNumberOfBytesToRead=0x1732, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b0e790*, lpNumberOfBytesRead=0x2ae2a8*=0x1732, lpOverlapped=0x0) returned 1 [0126.359] CloseHandle (hObject=0x154) returned 1 [0126.378] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg", lpFilePart=0x0) returned 0x71 [0126.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.378] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmxja[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.380] GetFileType (hFile=0x154) returned 0x1 [0126.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.380] GetFileType (hFile=0x154) returned 0x1 [0126.380] WriteFile (in: hFile=0x154, lpBuffer=0x1b629bc*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b629bc*, lpNumberOfBytesWritten=0x2ae29c*=0x1740, lpOverlapped=0x0) returned 1 [0126.382] CloseHandle (hObject=0x154) returned 1 [0126.382] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg", lpFilePart=0x0) returned 0x71 [0126.382] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmxja[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5a2380, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5a2380, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea45c310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1740)) returned 1 [0126.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.382] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmxja[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDMxjA[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdmxja[1].jpg.anonymous")) returned 1 [0126.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg", lpFilePart=0x0) returned 0x71 [0126.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.383] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdrj2v[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.384] GetFileType (hFile=0x154) returned 0x1 [0126.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.384] GetFileType (hFile=0x154) returned 0x1 [0126.384] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x8ef [0126.384] ReadFile (in: hFile=0x154, lpBuffer=0x1b65000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b65000*, lpNumberOfBytesRead=0x2ae2a8*=0x8ef, lpOverlapped=0x0) returned 1 [0126.391] CloseHandle (hObject=0x154) returned 1 [0126.438] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg", lpFilePart=0x0) returned 0x71 [0126.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.439] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdrj2v[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.440] GetFileType (hFile=0x154) returned 0x1 [0126.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.440] GetFileType (hFile=0x154) returned 0x1 [0126.441] WriteFile (in: hFile=0x154, lpBuffer=0x19b5000*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19b5000*, lpNumberOfBytesWritten=0x2ae270*=0x8f0, lpOverlapped=0x0) returned 1 [0126.442] CloseHandle (hObject=0x154) returned 1 [0126.442] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg", lpFilePart=0x0) returned 0x71 [0126.442] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdrj2v[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c509e00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c509e00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea4ce730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8f0)) returned 1 [0126.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.442] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdrj2v[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDrJ2v[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdrj2v[1].jpg.anonymous")) returned 1 [0126.443] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg", lpFilePart=0x0) returned 0x71 [0126.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.443] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdvm89[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.452] GetFileType (hFile=0x154) returned 0x1 [0126.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.452] GetFileType (hFile=0x154) returned 0x1 [0126.452] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9b6 [0126.452] ReadFile (in: hFile=0x154, lpBuffer=0x19b6e54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b6e54*, lpNumberOfBytesRead=0x2ae2a8*=0x9b6, lpOverlapped=0x0) returned 1 [0126.461] CloseHandle (hObject=0x154) returned 1 [0126.475] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg", lpFilePart=0x0) returned 0x71 [0126.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.475] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdvm89[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.477] GetFileType (hFile=0x154) returned 0x1 [0126.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.477] GetFileType (hFile=0x154) returned 0x1 [0126.477] WriteFile (in: hFile=0x154, lpBuffer=0x1a07fe8*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a07fe8*, lpNumberOfBytesWritten=0x2ae270*=0x9c0, lpOverlapped=0x0) returned 1 [0126.478] CloseHandle (hObject=0x154) returned 1 [0126.478] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg", lpFilePart=0x0) returned 0x71 [0126.478] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdvm89[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c95a5e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c95a5e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea540b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0126.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.478] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdvm89[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDvM89[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdvm89[1].jpg.anonymous")) returned 1 [0126.479] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg", lpFilePart=0x0) returned 0x71 [0126.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.479] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdw280[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.480] GetFileType (hFile=0x154) returned 0x1 [0126.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.480] GetFileType (hFile=0x154) returned 0x1 [0126.480] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x323b [0126.480] ReadFile (in: hFile=0x154, lpBuffer=0x1a09478, nNumberOfBytesToRead=0x323b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a09478*, lpNumberOfBytesRead=0x2ae2a8*=0x323b, lpOverlapped=0x0) returned 1 [0126.482] CloseHandle (hObject=0x154) returned 1 [0126.494] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg", lpFilePart=0x0) returned 0x71 [0126.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.494] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdw280[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.495] GetFileType (hFile=0x154) returned 0x1 [0126.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.495] GetFileType (hFile=0x154) returned 0x1 [0126.495] WriteFile (in: hFile=0x154, lpBuffer=0x1a65da4*, nNumberOfBytesToWrite=0x3240, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a65da4*, lpNumberOfBytesWritten=0x2ae29c*=0x3240, lpOverlapped=0x0) returned 1 [0126.497] CloseHandle (hObject=0x154) returned 1 [0126.497] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg", lpFilePart=0x0) returned 0x71 [0126.497] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.497] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdw280[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc7a2c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc7a2c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea566cb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3240)) returned 1 [0126.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.497] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdw280[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBDw280[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbdw280[1].jpg.anonymous")) returned 1 [0126.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png", lpFilePart=0x0) returned 0x71 [0126.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.498] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bboqf0j[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.499] GetFileType (hFile=0x154) returned 0x1 [0126.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.499] GetFileType (hFile=0x154) returned 0x1 [0126.499] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x230 [0126.499] ReadFile (in: hFile=0x154, lpBuffer=0x1a69828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a69828*, lpNumberOfBytesRead=0x2ae2a8*=0x230, lpOverlapped=0x0) returned 1 [0126.511] CloseHandle (hObject=0x154) returned 1 [0126.523] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png", lpFilePart=0x0) returned 0x71 [0126.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.523] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bboqf0j[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.525] GetFileType (hFile=0x154) returned 0x1 [0126.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.525] GetFileType (hFile=0x154) returned 0x1 [0126.525] WriteFile (in: hFile=0x154, lpBuffer=0x1ab82e4*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ab82e4*, lpNumberOfBytesWritten=0x2ae270*=0x240, lpOverlapped=0x0) returned 1 [0126.526] CloseHandle (hObject=0x154) returned 1 [0126.526] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png", lpFilePart=0x0) returned 0x71 [0126.526] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0126.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bboqf0j[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c3ff460, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c3ff460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea5b2f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0126.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.526] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBoqF0J[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bboqf0j[1].png.anonymous")) returned 1 [0126.527] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg", lpFilePart=0x0) returned 0x71 [0126.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.527] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbqpknq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.531] GetFileType (hFile=0x154) returned 0x1 [0126.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.532] GetFileType (hFile=0x154) returned 0x1 [0126.532] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x214d [0126.532] ReadFile (in: hFile=0x154, lpBuffer=0x1ab9774, nNumberOfBytesToRead=0x214d, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ab9774*, lpNumberOfBytesRead=0x2ae2a8*=0x214d, lpOverlapped=0x0) returned 1 [0126.543] CloseHandle (hObject=0x154) returned 1 [0126.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg", lpFilePart=0x0) returned 0x71 [0126.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.561] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbqpknq[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.563] GetFileType (hFile=0x154) returned 0x1 [0126.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.563] GetFileType (hFile=0x154) returned 0x1 [0126.563] WriteFile (in: hFile=0x154, lpBuffer=0x1b10bf0*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b10bf0*, lpNumberOfBytesWritten=0x2ae29c*=0x2150, lpOverlapped=0x0) returned 1 [0126.565] CloseHandle (hObject=0x154) returned 1 [0126.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg", lpFilePart=0x0) returned 0x71 [0126.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0126.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbqpknq[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c57c220, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c57c220, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea5ff230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2150)) returned 1 [0126.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.565] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbqpknq[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBqPKnQ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbqpknq[1].jpg.anonymous")) returned 1 [0126.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png", lpFilePart=0x0) returned 0x71 [0126.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.566] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbzn6d2[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.566] GetFileType (hFile=0x154) returned 0x1 [0126.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.566] GetFileType (hFile=0x154) returned 0x1 [0126.566] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x210 [0126.567] ReadFile (in: hFile=0x154, lpBuffer=0x1b13564, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b13564*, lpNumberOfBytesRead=0x2ae2a8*=0x210, lpOverlapped=0x0) returned 1 [0126.575] CloseHandle (hObject=0x154) returned 1 [0126.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png", lpFilePart=0x0) returned 0x71 [0126.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.587] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbzn6d2[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.589] GetFileType (hFile=0x154) returned 0x1 [0126.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.589] GetFileType (hFile=0x154) returned 0x1 [0126.589] WriteFile (in: hFile=0x154, lpBuffer=0x1b61f80*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b61f80*, lpNumberOfBytesWritten=0x2ae270*=0x220, lpOverlapped=0x0) returned 1 [0126.590] CloseHandle (hObject=0x154) returned 1 [0126.590] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png", lpFilePart=0x0) returned 0x71 [0126.590] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0126.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbzn6d2[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d85c510, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d85c510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xea64b4f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0126.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.590] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbzn6d2[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\BBzn6D2[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\bbzn6d2[1].png.anonymous")) returned 1 [0126.591] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0126.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.591] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\cd-4706e1-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.591] GetFileType (hFile=0x154) returned 0x1 [0126.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.591] GetFileType (hFile=0x154) returned 0x1 [0126.591] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x24e29 [0126.592] ReadFile (in: hFile=0x154, lpBuffer=0x1c2d6230, nNumberOfBytesToRead=0x24e29, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1c2d6230*, lpNumberOfBytesRead=0x2ae2a8*=0x24e29, lpOverlapped=0x0) returned 1 [0126.609] CloseHandle (hObject=0x154) returned 1 [0126.670] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0126.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.670] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\cd-4706e1-91cdfbc1[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.673] GetFileType (hFile=0x154) returned 0x1 [0126.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.673] GetFileType (hFile=0x154) returned 0x1 [0126.673] WriteFile (in: hFile=0x154, lpBuffer=0x1c38e958*, nNumberOfBytesToWrite=0x24e30, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1c38e958*, lpNumberOfBytesWritten=0x2ae29c*=0x24e30, lpOverlapped=0x0) returned 1 [0126.676] CloseHandle (hObject=0x154) returned 1 [0126.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0126.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt.anonymous", lpFilePart=0x0) returned 0x86 [0126.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\cd-4706e1-91cdfbc1[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x770aa6b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x770aa6b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xea709bd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24e30)) returned 1 [0126.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.677] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\cd-4706e1-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RI4PT91L\\cd-4706e1-91cdfbc1[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ri4pt91l\\cd-4706e1-91cdfbc1[1].txt.anonymous")) returned 1 [0126.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0126.678] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392", lpFilePart=0x0) returned 0x62 [0126.678] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\", lpFilePart=0x0) returned 0x63 [0126.678] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf058 [0126.698] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.699] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.699] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.699] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.700] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.701] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.702] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.703] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.703] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.703] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.704] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.704] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.705] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.706] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.707] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.708] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.708] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.709] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.709] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.709] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.709] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.709] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.710] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.711] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.712] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.712] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.712] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.712] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.712] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0126.712] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0126.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0126.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0126.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0126.713] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392", lpFilePart=0x0) returned 0x62 [0126.713] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\", lpFilePart=0x0) returned 0x63 [0126.713] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf058 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.715] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.716] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.716] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.716] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.716] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.716] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.716] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.717] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.717] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.717] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.717] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.717] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.718] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.718] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.718] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.718] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.718] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.718] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.719] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.719] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.719] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.719] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.719] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.720] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.721] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.722] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.723] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0126.724] FindNextFileW (in: hFindFile=0xbf058, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0126.724] FindClose (in: hFindFile=0xbf058 | out: hFindFile=0xbf058) returned 1 [0126.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0126.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0126.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif", lpFilePart=0x0) returned 0x76 [0126.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.726] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\000000929064[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.739] GetFileType (hFile=0x154) returned 0x1 [0126.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.739] GetFileType (hFile=0x154) returned 0x1 [0126.739] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xf4a3 [0126.739] ReadFile (in: hFile=0x154, lpBuffer=0x19b3c60, nNumberOfBytesToRead=0xf4a3, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19b3c60*, lpNumberOfBytesRead=0x2ae2a8*=0xf4a3, lpOverlapped=0x0) returned 1 [0126.749] CloseHandle (hObject=0x154) returned 1 [0126.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif", lpFilePart=0x0) returned 0x76 [0126.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.765] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\000000929064[1].gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.767] GetFileType (hFile=0x154) returned 0x1 [0126.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.767] GetFileType (hFile=0x154) returned 0x1 [0126.767] WriteFile (in: hFile=0x154, lpBuffer=0x1a2e9cc*, nNumberOfBytesToWrite=0xf4b0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a2e9cc*, lpNumberOfBytesWritten=0x2ae29c*=0xf4b0, lpOverlapped=0x0) returned 1 [0126.769] CloseHandle (hObject=0x154) returned 1 [0126.769] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif", lpFilePart=0x0) returned 0x76 [0126.769] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif.anonymous", lpFilePart=0x0) returned 0x80 [0126.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\000000929064[1].gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7be7e180, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7be7e180, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea7ee410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf4b0)) returned 1 [0126.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.769] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\000000929064[1].gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\000000929064[1].gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\000000929064[1].gif.anonymous")) returned 1 [0126.770] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0126.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.770] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\11-b6a7e6-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.770] GetFileType (hFile=0x154) returned 0x1 [0126.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.770] GetFileType (hFile=0x154) returned 0x1 [0126.770] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x253df [0126.771] ReadFile (in: hFile=0x154, lpBuffer=0x1c3d2108, nNumberOfBytesToRead=0x253df, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1c3d2108*, lpNumberOfBytesRead=0x2ae2a8*=0x253df, lpOverlapped=0x0) returned 1 [0126.808] CloseHandle (hObject=0x154) returned 1 [0126.832] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0126.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.833] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\11-b6a7e6-91cdfbc1[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.836] GetFileType (hFile=0x154) returned 0x1 [0126.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.836] GetFileType (hFile=0x154) returned 0x1 [0126.836] WriteFile (in: hFile=0x154, lpBuffer=0x1c48c4a8*, nNumberOfBytesToWrite=0x253e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1c48c4a8*, lpNumberOfBytesWritten=0x2ae29c*=0x253e0, lpOverlapped=0x0) returned 1 [0126.839] CloseHandle (hObject=0x154) returned 1 [0126.839] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x7c [0126.839] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt.anonymous", lpFilePart=0x0) returned 0x86 [0126.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\11-b6a7e6-91cdfbc1[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a921a0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x78a921a0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xea8acaf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x253e0)) returned 1 [0126.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.840] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\11-b6a7e6-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\11-b6a7e6-91cdfbc1[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\11-b6a7e6-91cdfbc1[1].txt.anonymous")) returned 1 [0126.841] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg", lpFilePart=0x0) returned 0x76 [0126.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.841] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\800x250_surf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.841] GetFileType (hFile=0x154) returned 0x1 [0126.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.841] GetFileType (hFile=0x154) returned 0x1 [0126.841] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x21735 [0126.842] ReadFile (in: hFile=0x154, lpBuffer=0x1c4b18a8, nNumberOfBytesToRead=0x21735, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1c4b18a8*, lpNumberOfBytesRead=0x2ae2a8*=0x21735, lpOverlapped=0x0) returned 1 [0126.896] CloseHandle (hObject=0x154) returned 1 [0126.919] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg", lpFilePart=0x0) returned 0x76 [0126.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.919] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\800x250_surf[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.923] GetFileType (hFile=0x154) returned 0x1 [0126.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.923] GetFileType (hFile=0x154) returned 0x1 [0126.923] WriteFile (in: hFile=0x154, lpBuffer=0x1c558d20*, nNumberOfBytesToWrite=0x21740, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1c558d20*, lpNumberOfBytesWritten=0x2ae29c*=0x21740, lpOverlapped=0x0) returned 1 [0126.926] CloseHandle (hObject=0x154) returned 1 [0126.926] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg", lpFilePart=0x0) returned 0x76 [0126.926] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg.anonymous", lpFilePart=0x0) returned 0x80 [0126.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\800x250_surf[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7db2ff30, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7db2ff30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xea96b1d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21740)) returned 1 [0126.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.927] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\800x250_surf[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\800x250_surf[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\800x250_surf[1].jpg.anonymous")) returned 1 [0126.930] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png", lpFilePart=0x0) returned 0x71 [0126.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.931] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3hahv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.931] GetFileType (hFile=0x154) returned 0x1 [0126.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.931] GetFileType (hFile=0x154) returned 0x1 [0126.931] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1eb [0126.931] ReadFile (in: hFile=0x154, lpBuffer=0x1ad8f98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ad8f98*, lpNumberOfBytesRead=0x2ae2a8*=0x1eb, lpOverlapped=0x0) returned 1 [0126.933] CloseHandle (hObject=0x154) returned 1 [0126.951] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png", lpFilePart=0x0) returned 0x71 [0126.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0126.951] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3hahv[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.952] GetFileType (hFile=0x154) returned 0x1 [0126.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0126.952] GetFileType (hFile=0x154) returned 0x1 [0126.952] WriteFile (in: hFile=0x154, lpBuffer=0x1b278bc*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b278bc*, lpNumberOfBytesWritten=0x2ae270*=0x1f0, lpOverlapped=0x0) returned 1 [0126.953] CloseHandle (hObject=0x154) returned 1 [0126.954] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png", lpFilePart=0x0) returned 0x71 [0126.954] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0126.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0126.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3hahv[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8ce930, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8ce930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xea9b7490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1 [0126.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0126.954] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3hahv[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3HAHV[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3hahv[1].png.anonymous")) returned 1 [0126.955] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png", lpFilePart=0x0) returned 0x71 [0126.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0126.955] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3vova[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0126.955] GetFileType (hFile=0x154) returned 0x1 [0126.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0126.955] GetFileType (hFile=0x154) returned 0x1 [0126.955] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x28e [0126.955] ReadFile (in: hFile=0x154, lpBuffer=0x1b28fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b28fe8*, lpNumberOfBytesRead=0x2ae2a8*=0x28e, lpOverlapped=0x0) returned 1 [0126.969] CloseHandle (hObject=0x154) returned 1 [0127.036] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png", lpFilePart=0x0) returned 0x71 [0127.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.036] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3vova[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.037] GetFileType (hFile=0x154) returned 0x1 [0127.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.037] GetFileType (hFile=0x154) returned 0x1 [0127.037] WriteFile (in: hFile=0x154, lpBuffer=0x1978258*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1978258*, lpNumberOfBytesWritten=0x2ae270*=0x290, lpOverlapped=0x0) returned 1 [0127.041] CloseHandle (hObject=0x154) returned 1 [0127.041] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png", lpFilePart=0x0) returned 0x71 [0127.041] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.041] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3vova[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c95a5e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c95a5e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeaa9bcd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x290)) returned 1 [0127.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.041] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3vova[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA3vOVA[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa3vova[1].png.anonymous")) returned 1 [0127.042] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png", lpFilePart=0x0) returned 0x71 [0127.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.042] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6kizp[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.042] GetFileType (hFile=0x154) returned 0x1 [0127.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.042] GetFileType (hFile=0x154) returned 0x1 [0127.042] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x21b [0127.042] ReadFile (in: hFile=0x154, lpBuffer=0x1979910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1979910*, lpNumberOfBytesRead=0x2ae2a8*=0x21b, lpOverlapped=0x0) returned 1 [0127.044] CloseHandle (hObject=0x154) returned 1 [0127.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png", lpFilePart=0x0) returned 0x71 [0127.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.077] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6kizp[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.078] GetFileType (hFile=0x154) returned 0x1 [0127.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.078] GetFileType (hFile=0x154) returned 0x1 [0127.078] WriteFile (in: hFile=0x154, lpBuffer=0x19c8480*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19c8480*, lpNumberOfBytesWritten=0x2ae270*=0x220, lpOverlapped=0x0) returned 1 [0127.079] CloseHandle (hObject=0x154) returned 1 [0127.079] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png", lpFilePart=0x0) returned 0x71 [0127.079] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6kizp[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d3bfa70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d3bfa70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeaae7f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0127.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.079] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6kizp[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6KizP[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6kizp[1].png.anonymous")) returned 1 [0127.080] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png", lpFilePart=0x0) returned 0x71 [0127.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.080] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6sfrq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.080] GetFileType (hFile=0x154) returned 0x1 [0127.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.080] GetFileType (hFile=0x154) returned 0x1 [0127.080] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2ed [0127.081] ReadFile (in: hFile=0x154, lpBuffer=0x19c9c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19c9c0c*, lpNumberOfBytesRead=0x2ae2a8*=0x2ed, lpOverlapped=0x0) returned 1 [0127.097] CloseHandle (hObject=0x154) returned 1 [0127.112] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png", lpFilePart=0x0) returned 0x71 [0127.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.112] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6sfrq[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.113] GetFileType (hFile=0x154) returned 0x1 [0127.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.113] GetFileType (hFile=0x154) returned 0x1 [0127.113] WriteFile (in: hFile=0x154, lpBuffer=0x1a18a2c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a18a2c*, lpNumberOfBytesWritten=0x2ae270*=0x2f0, lpOverlapped=0x0) returned 1 [0127.115] CloseHandle (hObject=0x154) returned 1 [0127.115] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png", lpFilePart=0x0) returned 0x71 [0127.115] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6sfrq[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cb95a80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cb95a80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeab34250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0127.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.115] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6sfrq[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA6SFRQ[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa6sfrq[1].png.anonymous")) returned 1 [0127.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png", lpFilePart=0x0) returned 0x71 [0127.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.116] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa8tave[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.117] GetFileType (hFile=0x154) returned 0x1 [0127.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.117] GetFileType (hFile=0x154) returned 0x1 [0127.117] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x268 [0127.117] ReadFile (in: hFile=0x154, lpBuffer=0x1a1a130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a1a130*, lpNumberOfBytesRead=0x2ae2a8*=0x268, lpOverlapped=0x0) returned 1 [0127.132] CloseHandle (hObject=0x154) returned 1 [0127.153] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png", lpFilePart=0x0) returned 0x71 [0127.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.153] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa8tave[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.155] GetFileType (hFile=0x154) returned 0x1 [0127.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.155] GetFileType (hFile=0x154) returned 0x1 [0127.155] WriteFile (in: hFile=0x154, lpBuffer=0x1a68cd4*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a68cd4*, lpNumberOfBytesWritten=0x2ae270*=0x270, lpOverlapped=0x0) returned 1 [0127.156] CloseHandle (hObject=0x154) returned 1 [0127.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png", lpFilePart=0x0) returned 0x71 [0127.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa8tave[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c25c540, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c25c540, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeaba6670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0127.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.156] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa8tave[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA8Tave[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa8tave[1].png.anonymous")) returned 1 [0127.157] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png", lpFilePart=0x0) returned 0x71 [0127.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.157] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa9gnjr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.157] GetFileType (hFile=0x154) returned 0x1 [0127.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.157] GetFileType (hFile=0x154) returned 0x1 [0127.157] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x17f [0127.158] ReadFile (in: hFile=0x154, lpBuffer=0x1a6a2f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a6a2f0*, lpNumberOfBytesRead=0x2ae2a8*=0x17f, lpOverlapped=0x0) returned 1 [0127.163] CloseHandle (hObject=0x154) returned 1 [0127.175] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png", lpFilePart=0x0) returned 0x71 [0127.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.175] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa9gnjr[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.176] GetFileType (hFile=0x154) returned 0x1 [0127.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.176] GetFileType (hFile=0x154) returned 0x1 [0127.176] WriteFile (in: hFile=0x154, lpBuffer=0x1ab89e0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ab89e0*, lpNumberOfBytesWritten=0x2ae270*=0x180, lpOverlapped=0x0) returned 1 [0127.178] CloseHandle (hObject=0x154) returned 1 [0127.178] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png", lpFilePart=0x0) returned 0x71 [0127.178] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa9gnjr[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d940d50, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d940d50, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeabf2930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0127.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.178] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa9gnjr[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AA9GNjr[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aa9gnjr[1].png.anonymous")) returned 1 [0127.179] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png", lpFilePart=0x0) returned 0x71 [0127.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.179] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aafoidq[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.179] GetFileType (hFile=0x154) returned 0x1 [0127.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.179] GetFileType (hFile=0x154) returned 0x1 [0127.179] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x21e [0127.179] ReadFile (in: hFile=0x154, lpBuffer=0x1aba09c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aba09c*, lpNumberOfBytesRead=0x2ae2a8*=0x21e, lpOverlapped=0x0) returned 1 [0127.201] CloseHandle (hObject=0x154) returned 1 [0127.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png", lpFilePart=0x0) returned 0x71 [0127.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.213] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aafoidq[2].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.214] GetFileType (hFile=0x154) returned 0x1 [0127.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.214] GetFileType (hFile=0x154) returned 0x1 [0127.214] WriteFile (in: hFile=0x154, lpBuffer=0x1b08aac*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b08aac*, lpNumberOfBytesWritten=0x2ae270*=0x220, lpOverlapped=0x0) returned 1 [0127.216] CloseHandle (hObject=0x154) returned 1 [0127.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png", lpFilePart=0x0) returned 0x71 [0127.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aafoidq[2].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1ea120, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c1ea120, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeac3ebf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0127.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.216] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aafoidq[2].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAfOIDq[2].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aafoidq[2].png.anonymous")) returned 1 [0127.217] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png", lpFilePart=0x0) returned 0x71 [0127.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.217] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakhmz9[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.217] GetFileType (hFile=0x154) returned 0x1 [0127.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.217] GetFileType (hFile=0x154) returned 0x1 [0127.217] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2e3 [0127.217] ReadFile (in: hFile=0x154, lpBuffer=0x1b0a22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b0a22c*, lpNumberOfBytesRead=0x2ae2a8*=0x2e3, lpOverlapped=0x0) returned 1 [0127.228] CloseHandle (hObject=0x154) returned 1 [0127.240] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png", lpFilePart=0x0) returned 0x71 [0127.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.240] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakhmz9[2].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.241] GetFileType (hFile=0x154) returned 0x1 [0127.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.241] GetFileType (hFile=0x154) returned 0x1 [0127.241] WriteFile (in: hFile=0x154, lpBuffer=0x1b59058*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b59058*, lpNumberOfBytesWritten=0x2ae270*=0x2f0, lpOverlapped=0x0) returned 1 [0127.242] CloseHandle (hObject=0x154) returned 1 [0127.242] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png", lpFilePart=0x0) returned 0x71 [0127.242] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakhmz9[2].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbe1d40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbe1d40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeac8aeb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0127.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.243] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkhMz9[2].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakhmz9[2].png.anonymous")) returned 1 [0127.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png", lpFilePart=0x0) returned 0x71 [0127.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.255] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakqhif[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.256] GetFileType (hFile=0x154) returned 0x1 [0127.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.256] GetFileType (hFile=0x154) returned 0x1 [0127.256] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x35c [0127.256] ReadFile (in: hFile=0x154, lpBuffer=0x1b5a850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b5a850*, lpNumberOfBytesRead=0x2ae2a8*=0x35c, lpOverlapped=0x0) returned 1 [0127.270] CloseHandle (hObject=0x154) returned 1 [0127.320] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png", lpFilePart=0x0) returned 0x71 [0127.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.320] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakqhif[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.322] GetFileType (hFile=0x154) returned 0x1 [0127.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.322] GetFileType (hFile=0x154) returned 0x1 [0127.322] WriteFile (in: hFile=0x154, lpBuffer=0x19aa5d8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19aa5d8*, lpNumberOfBytesWritten=0x2ae270*=0x360, lpOverlapped=0x0) returned 1 [0127.324] CloseHandle (hObject=0x154) returned 1 [0127.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png", lpFilePart=0x0) returned 0x71 [0127.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakqhif[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c52ff60, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c52ff60, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xead49590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0127.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.325] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakqhif[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAkqhIf[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aakqhif[1].png.anonymous")) returned 1 [0127.325] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png", lpFilePart=0x0) returned 0x71 [0127.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.326] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamin0z[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.326] GetFileType (hFile=0x154) returned 0x1 [0127.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.326] GetFileType (hFile=0x154) returned 0x1 [0127.326] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x157 [0127.326] ReadFile (in: hFile=0x154, lpBuffer=0x19abbcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19abbcc*, lpNumberOfBytesRead=0x2ae2a8*=0x157, lpOverlapped=0x0) returned 1 [0127.350] CloseHandle (hObject=0x154) returned 1 [0127.368] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png", lpFilePart=0x0) returned 0x71 [0127.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.368] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamin0z[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.370] GetFileType (hFile=0x154) returned 0x1 [0127.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.370] GetFileType (hFile=0x154) returned 0x1 [0127.370] WriteFile (in: hFile=0x154, lpBuffer=0x19fa380*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19fa380*, lpNumberOfBytesWritten=0x2ae270*=0x160, lpOverlapped=0x0) returned 1 [0127.372] CloseHandle (hObject=0x154) returned 1 [0127.372] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png", lpFilePart=0x0) returned 0x71 [0127.372] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamin0z[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2363e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2363e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeadbb9b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1 [0127.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.372] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamin0z[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmin0Z[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamin0z[1].png.anonymous")) returned 1 [0127.373] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg", lpFilePart=0x0) returned 0x71 [0127.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.373] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamo09p[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.374] GetFileType (hFile=0x154) returned 0x1 [0127.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.374] GetFileType (hFile=0x154) returned 0x1 [0127.374] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x278e [0127.374] ReadFile (in: hFile=0x154, lpBuffer=0x19fb810, nNumberOfBytesToRead=0x278e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19fb810*, lpNumberOfBytesRead=0x2ae2a8*=0x278e, lpOverlapped=0x0) returned 1 [0127.396] CloseHandle (hObject=0x154) returned 1 [0127.415] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg", lpFilePart=0x0) returned 0x71 [0127.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.415] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamo09p[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.417] GetFileType (hFile=0x154) returned 0x1 [0127.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.417] GetFileType (hFile=0x154) returned 0x1 [0127.417] WriteFile (in: hFile=0x154, lpBuffer=0x1a54bcc*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a54bcc*, lpNumberOfBytesWritten=0x2ae29c*=0x2790, lpOverlapped=0x0) returned 1 [0127.419] CloseHandle (hObject=0x154) returned 1 [0127.419] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg", lpFilePart=0x0) returned 0x71 [0127.419] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.419] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamo09p[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbbbbe0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbbbbe0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeae2ddd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2790)) returned 1 [0127.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.419] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\AAmo09p[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\aamo09p[1].jpg.anonymous")) returned 1 [0127.420] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png", lpFilePart=0x0) returned 0x71 [0127.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.420] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bb46jmn[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.421] GetFileType (hFile=0x154) returned 0x1 [0127.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.421] GetFileType (hFile=0x154) returned 0x1 [0127.421] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x310 [0127.421] ReadFile (in: hFile=0x154, lpBuffer=0x1a57c94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a57c94*, lpNumberOfBytesRead=0x2ae2a8*=0x310, lpOverlapped=0x0) returned 1 [0127.433] CloseHandle (hObject=0x154) returned 1 [0127.453] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png", lpFilePart=0x0) returned 0x71 [0127.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.453] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bb46jmn[2].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.455] GetFileType (hFile=0x154) returned 0x1 [0127.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.455] GetFileType (hFile=0x154) returned 0x1 [0127.456] WriteFile (in: hFile=0x154, lpBuffer=0x1aa6bb0*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa6bb0*, lpNumberOfBytesWritten=0x2ae270*=0x320, lpOverlapped=0x0) returned 1 [0127.457] CloseHandle (hObject=0x154) returned 1 [0127.457] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png", lpFilePart=0x0) returned 0x71 [0127.457] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bb46jmn[2].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b0ce300, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0ce300, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeae7a090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1 [0127.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.458] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bb46jmn[2].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BB46JmN[2].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bb46jmn[2].png.anonymous")) returned 1 [0127.459] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png", lpFilePart=0x0) returned 0x71 [0127.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.459] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbak3nm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.459] GetFileType (hFile=0x154) returned 0x1 [0127.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.459] GetFileType (hFile=0x154) returned 0x1 [0127.459] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x227 [0127.459] ReadFile (in: hFile=0x154, lpBuffer=0x1aa8274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa8274*, lpNumberOfBytesRead=0x2ae2a8*=0x227, lpOverlapped=0x0) returned 1 [0127.485] CloseHandle (hObject=0x154) returned 1 [0127.506] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png", lpFilePart=0x0) returned 0x71 [0127.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.506] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbak3nm[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.508] GetFileType (hFile=0x154) returned 0x1 [0127.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.508] GetFileType (hFile=0x154) returned 0x1 [0127.508] WriteFile (in: hFile=0x154, lpBuffer=0x1af6cdc*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1af6cdc*, lpNumberOfBytesWritten=0x2ae270*=0x230, lpOverlapped=0x0) returned 1 [0127.509] CloseHandle (hObject=0x154) returned 1 [0127.510] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png", lpFilePart=0x0) returned 0x71 [0127.510] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0127.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.510] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbak3nm[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5a2380, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5a2380, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeaf12610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0127.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.510] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBaK3Nm[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbak3nm[1].png.anonymous")) returned 1 [0127.511] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg", lpFilePart=0x0) returned 0x71 [0127.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.511] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbalzyp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.512] GetFileType (hFile=0x154) returned 0x1 [0127.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.512] GetFileType (hFile=0x154) returned 0x1 [0127.512] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x152c [0127.512] ReadFile (in: hFile=0x154, lpBuffer=0x1af816c, nNumberOfBytesToRead=0x152c, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1af816c*, lpNumberOfBytesRead=0x2ae2a8*=0x152c, lpOverlapped=0x0) returned 1 [0127.516] CloseHandle (hObject=0x154) returned 1 [0127.534] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg", lpFilePart=0x0) returned 0x71 [0127.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.534] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbalzyp[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.537] GetFileType (hFile=0x154) returned 0x1 [0127.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.537] GetFileType (hFile=0x154) returned 0x1 [0127.537] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b944*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b4b944*, lpNumberOfBytesWritten=0x2ae29c*=0x1530, lpOverlapped=0x0) returned 1 [0127.538] CloseHandle (hObject=0x154) returned 1 [0127.539] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg", lpFilePart=0x0) returned 0x71 [0127.539] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbalzyp[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5560c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5560c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeaf5e8d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1530)) returned 1 [0127.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.539] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBALZyp[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbalzyp[1].jpg.anonymous")) returned 1 [0127.540] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg", lpFilePart=0x0) returned 0x71 [0127.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.540] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbb3bbs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.540] GetFileType (hFile=0x154) returned 0x1 [0127.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.540] GetFileType (hFile=0x154) returned 0x1 [0127.540] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xaed [0127.541] ReadFile (in: hFile=0x154, lpBuffer=0x1b4df78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b4df78*, lpNumberOfBytesRead=0x2ae2a8*=0xaed, lpOverlapped=0x0) returned 1 [0127.559] CloseHandle (hObject=0x154) returned 1 [0127.605] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg", lpFilePart=0x0) returned 0x71 [0127.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.606] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbb3bbs[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.607] GetFileType (hFile=0x154) returned 0x1 [0127.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.607] GetFileType (hFile=0x154) returned 0x1 [0127.607] WriteFile (in: hFile=0x154, lpBuffer=0x19a0be8*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a0be8*, lpNumberOfBytesWritten=0x2ae270*=0xaf0, lpOverlapped=0x0) returned 1 [0127.608] CloseHandle (hObject=0x154) returned 1 [0127.608] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg", lpFilePart=0x0) returned 0x71 [0127.608] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbb3bbs[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8ce930, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8ce930, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeaff6e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaf0)) returned 1 [0127.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.609] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbb3bbs[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBB3BBs[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbb3bbs[1].jpg.anonymous")) returned 1 [0127.609] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg", lpFilePart=0x0) returned 0x71 [0127.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.609] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbakfw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.610] GetFileType (hFile=0x154) returned 0x1 [0127.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.610] GetFileType (hFile=0x154) returned 0x1 [0127.610] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x756 [0127.610] ReadFile (in: hFile=0x154, lpBuffer=0x19a27dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a27dc*, lpNumberOfBytesRead=0x2ae2a8*=0x756, lpOverlapped=0x0) returned 1 [0127.611] CloseHandle (hObject=0x154) returned 1 [0127.623] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg", lpFilePart=0x0) returned 0x71 [0127.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.623] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbakfw[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.625] GetFileType (hFile=0x154) returned 0x1 [0127.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.625] GetFileType (hFile=0x154) returned 0x1 [0127.625] WriteFile (in: hFile=0x154, lpBuffer=0x19f2d90*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19f2d90*, lpNumberOfBytesWritten=0x2ae270*=0x760, lpOverlapped=0x0) returned 1 [0127.626] CloseHandle (hObject=0x154) returned 1 [0127.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg", lpFilePart=0x0) returned 0x71 [0127.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbakfw[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7ea0f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7ea0f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb01cfb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0127.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.627] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbakfw[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBAKFw[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbakfw[1].jpg.anonymous")) returned 1 [0127.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg", lpFilePart=0x0) returned 0x71 [0127.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.627] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfbud[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.627] GetFileType (hFile=0x154) returned 0x1 [0127.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.627] GetFileType (hFile=0x154) returned 0x1 [0127.628] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa92 [0127.628] ReadFile (in: hFile=0x154, lpBuffer=0x19f4cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f4cc0*, lpNumberOfBytesRead=0x2ae2a8*=0xa92, lpOverlapped=0x0) returned 1 [0127.629] CloseHandle (hObject=0x154) returned 1 [0127.643] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg", lpFilePart=0x0) returned 0x71 [0127.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.643] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfbud[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.645] GetFileType (hFile=0x154) returned 0x1 [0127.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.645] GetFileType (hFile=0x154) returned 0x1 [0127.645] WriteFile (in: hFile=0x154, lpBuffer=0x1a4615c*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a4615c*, lpNumberOfBytesWritten=0x2ae270*=0xaa0, lpOverlapped=0x0) returned 1 [0127.647] CloseHandle (hObject=0x154) returned 1 [0127.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg", lpFilePart=0x0) returned 0x71 [0127.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfbud[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8a87d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8a87d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb069270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaa0)) returned 1 [0127.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.647] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfbud[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFBud[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfbud[1].jpg.anonymous")) returned 1 [0127.648] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg", lpFilePart=0x0) returned 0x71 [0127.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.648] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfkja[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.648] GetFileType (hFile=0x154) returned 0x1 [0127.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.648] GetFileType (hFile=0x154) returned 0x1 [0127.648] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2264 [0127.649] ReadFile (in: hFile=0x154, lpBuffer=0x1a475ec, nNumberOfBytesToRead=0x2264, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a475ec*, lpNumberOfBytesRead=0x2ae2a8*=0x2264, lpOverlapped=0x0) returned 1 [0127.672] CloseHandle (hObject=0x154) returned 1 [0127.691] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg", lpFilePart=0x0) returned 0x71 [0127.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.692] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfkja[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.694] GetFileType (hFile=0x154) returned 0x1 [0127.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.694] GetFileType (hFile=0x154) returned 0x1 [0127.694] WriteFile (in: hFile=0x154, lpBuffer=0x1a9f004*, nNumberOfBytesToWrite=0x2270, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a9f004*, lpNumberOfBytesWritten=0x2ae29c*=0x2270, lpOverlapped=0x0) returned 1 [0127.696] CloseHandle (hObject=0x154) returned 1 [0127.696] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg", lpFilePart=0x0) returned 0x71 [0127.696] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfkja[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d98d010, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d98d010, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb0db690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2270)) returned 1 [0127.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.696] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfkja[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFKja[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfkja[1].jpg.anonymous")) returned 1 [0127.697] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg", lpFilePart=0x0) returned 0x71 [0127.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.697] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfn7j[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.698] GetFileType (hFile=0x154) returned 0x1 [0127.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.698] GetFileType (hFile=0x154) returned 0x1 [0127.698] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2793 [0127.698] ReadFile (in: hFile=0x154, lpBuffer=0x1aa187c, nNumberOfBytesToRead=0x2793, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa187c*, lpNumberOfBytesRead=0x2ae2a8*=0x2793, lpOverlapped=0x0) returned 1 [0127.700] CloseHandle (hObject=0x154) returned 1 [0127.717] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg", lpFilePart=0x0) returned 0x71 [0127.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.717] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfn7j[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.719] GetFileType (hFile=0x154) returned 0x1 [0127.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.719] GetFileType (hFile=0x154) returned 0x1 [0127.719] WriteFile (in: hFile=0x154, lpBuffer=0x1afac88*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1afac88*, lpNumberOfBytesWritten=0x2ae29c*=0x27a0, lpOverlapped=0x0) returned 1 [0127.720] CloseHandle (hObject=0x154) returned 1 [0127.721] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg", lpFilePart=0x0) returned 0x71 [0127.721] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfn7j[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d882670, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d882670, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb1017f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1 [0127.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.721] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfn7j[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBFn7J[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbfn7j[1].jpg.anonymous")) returned 1 [0127.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg", lpFilePart=0x0) returned 0x71 [0127.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.722] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgeqk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.722] GetFileType (hFile=0x154) returned 0x1 [0127.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.722] GetFileType (hFile=0x154) returned 0x1 [0127.722] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x80d [0127.722] ReadFile (in: hFile=0x154, lpBuffer=0x1afe24c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1afe24c*, lpNumberOfBytesRead=0x2ae2a8*=0x80d, lpOverlapped=0x0) returned 1 [0127.725] CloseHandle (hObject=0x154) returned 1 [0127.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg", lpFilePart=0x0) returned 0x71 [0127.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.741] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgeqk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.743] GetFileType (hFile=0x154) returned 0x1 [0127.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.743] GetFileType (hFile=0x154) returned 0x1 [0127.743] WriteFile (in: hFile=0x154, lpBuffer=0x1b4ea0c*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b4ea0c*, lpNumberOfBytesWritten=0x2ae270*=0x810, lpOverlapped=0x0) returned 1 [0127.744] CloseHandle (hObject=0x154) returned 1 [0127.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg", lpFilePart=0x0) returned 0x71 [0127.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgeqk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d85c510, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d85c510, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb14dab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x810)) returned 1 [0127.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.744] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgeqk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGeQk[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgeqk[1].jpg.anonymous")) returned 1 [0127.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg", lpFilePart=0x0) returned 0x71 [0127.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.745] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgh24[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.745] GetFileType (hFile=0x154) returned 0x1 [0127.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.745] GetFileType (hFile=0x154) returned 0x1 [0127.745] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x593 [0127.746] ReadFile (in: hFile=0x154, lpBuffer=0x1b5043c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b5043c*, lpNumberOfBytesRead=0x2ae2a8*=0x593, lpOverlapped=0x0) returned 1 [0127.771] CloseHandle (hObject=0x154) returned 1 [0127.810] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg", lpFilePart=0x0) returned 0x71 [0127.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.810] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgh24[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.811] GetFileType (hFile=0x154) returned 0x1 [0127.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.811] GetFileType (hFile=0x154) returned 0x1 [0127.811] WriteFile (in: hFile=0x154, lpBuffer=0x19a1fe8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a1fe8*, lpNumberOfBytesWritten=0x2ae270*=0x5a0, lpOverlapped=0x0) returned 1 [0127.813] CloseHandle (hObject=0x154) returned 1 [0127.813] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg", lpFilePart=0x0) returned 0x71 [0127.813] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgh24[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6b95f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6b95f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb1e6030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5a0)) returned 1 [0127.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.813] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgh24[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGH24[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgh24[1].jpg.anonymous")) returned 1 [0127.814] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg", lpFilePart=0x0) returned 0x71 [0127.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.814] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgquf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.814] GetFileType (hFile=0x154) returned 0x1 [0127.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.814] GetFileType (hFile=0x154) returned 0x1 [0127.814] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x276b [0127.814] ReadFile (in: hFile=0x154, lpBuffer=0x19a3478, nNumberOfBytesToRead=0x276b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a3478*, lpNumberOfBytesRead=0x2ae2a8*=0x276b, lpOverlapped=0x0) returned 1 [0127.816] CloseHandle (hObject=0x154) returned 1 [0127.829] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg", lpFilePart=0x0) returned 0x71 [0127.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.829] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgquf[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.831] GetFileType (hFile=0x154) returned 0x1 [0127.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.831] GetFileType (hFile=0x154) returned 0x1 [0127.831] WriteFile (in: hFile=0x154, lpBuffer=0x19fc8f0*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19fc8f0*, lpNumberOfBytesWritten=0x2ae29c*=0x2770, lpOverlapped=0x0) returned 1 [0127.832] CloseHandle (hObject=0x154) returned 1 [0127.832] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg", lpFilePart=0x0) returned 0x71 [0127.832] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgquf[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7dabdb10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7dabdb10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb20c190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2770)) returned 1 [0127.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.833] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgquf[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGQUf[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgquf[1].jpg.anonymous")) returned 1 [0127.833] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg", lpFilePart=0x0) returned 0x71 [0127.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.833] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgxqk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.834] GetFileType (hFile=0x154) returned 0x1 [0127.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.834] GetFileType (hFile=0x154) returned 0x1 [0127.834] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x867 [0127.834] ReadFile (in: hFile=0x154, lpBuffer=0x19ffedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19ffedc*, lpNumberOfBytesRead=0x2ae2a8*=0x867, lpOverlapped=0x0) returned 1 [0127.848] CloseHandle (hObject=0x154) returned 1 [0127.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg", lpFilePart=0x0) returned 0x71 [0127.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.863] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgxqk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.865] GetFileType (hFile=0x154) returned 0x1 [0127.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.865] GetFileType (hFile=0x154) returned 0x1 [0127.866] WriteFile (in: hFile=0x154, lpBuffer=0x1a50884*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a50884*, lpNumberOfBytesWritten=0x2ae270*=0x870, lpOverlapped=0x0) returned 1 [0127.867] CloseHandle (hObject=0x154) returned 1 [0127.867] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg", lpFilePart=0x0) returned 0x71 [0127.867] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgxqk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x778b30f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x778b30f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb27e5b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x870)) returned 1 [0127.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.868] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgxqk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBGXQk[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbgxqk[1].jpg.anonymous")) returned 1 [0127.868] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg", lpFilePart=0x0) returned 0x71 [0127.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.868] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbhpjz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.869] GetFileType (hFile=0x154) returned 0x1 [0127.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.869] GetFileType (hFile=0x154) returned 0x1 [0127.869] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x998 [0127.869] ReadFile (in: hFile=0x154, lpBuffer=0x1a526b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a526b8*, lpNumberOfBytesRead=0x2ae2a8*=0x998, lpOverlapped=0x0) returned 1 [0127.893] CloseHandle (hObject=0x154) returned 1 [0127.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg", lpFilePart=0x0) returned 0x71 [0127.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.906] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbhpjz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.908] GetFileType (hFile=0x154) returned 0x1 [0127.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.908] GetFileType (hFile=0x154) returned 0x1 [0127.909] WriteFile (in: hFile=0x154, lpBuffer=0x1aa364c*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa364c*, lpNumberOfBytesWritten=0x2ae270*=0x9a0, lpOverlapped=0x0) returned 1 [0127.910] CloseHandle (hObject=0x154) returned 1 [0127.910] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg", lpFilePart=0x0) returned 0x71 [0127.910] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbhpjz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da4b6f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da4b6f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb2f09d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0127.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.911] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbhpjz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBHPjZ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbhpjz[1].jpg.anonymous")) returned 1 [0127.912] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg", lpFilePart=0x0) returned 0x71 [0127.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.912] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbia72[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.912] GetFileType (hFile=0x154) returned 0x1 [0127.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.912] GetFileType (hFile=0x154) returned 0x1 [0127.912] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3095 [0127.912] ReadFile (in: hFile=0x154, lpBuffer=0x1aa4adc, nNumberOfBytesToRead=0x3095, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aa4adc*, lpNumberOfBytesRead=0x2ae2a8*=0x3095, lpOverlapped=0x0) returned 1 [0127.915] CloseHandle (hObject=0x154) returned 1 [0127.930] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg", lpFilePart=0x0) returned 0x71 [0127.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.931] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbia72[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.932] GetFileType (hFile=0x154) returned 0x1 [0127.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.932] GetFileType (hFile=0x154) returned 0x1 [0127.932] WriteFile (in: hFile=0x154, lpBuffer=0x1b00be8*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b00be8*, lpNumberOfBytesWritten=0x2ae29c*=0x30a0, lpOverlapped=0x0) returned 1 [0127.934] CloseHandle (hObject=0x154) returned 1 [0127.934] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg", lpFilePart=0x0) returned 0x71 [0127.934] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbia72[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da4b6f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da4b6f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb316b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x30a0)) returned 1 [0127.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.934] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbia72[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIa72[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbia72[1].jpg.anonymous")) returned 1 [0127.935] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg", lpFilePart=0x0) returned 0x71 [0127.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.935] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbibyz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.935] GetFileType (hFile=0x154) returned 0x1 [0127.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.935] GetFileType (hFile=0x154) returned 0x1 [0127.935] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1b70 [0127.935] ReadFile (in: hFile=0x154, lpBuffer=0x1b04290, nNumberOfBytesToRead=0x1b70, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b04290*, lpNumberOfBytesRead=0x2ae2a8*=0x1b70, lpOverlapped=0x0) returned 1 [0127.937] CloseHandle (hObject=0x154) returned 1 [0127.949] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg", lpFilePart=0x0) returned 0x71 [0127.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0127.949] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbibyz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.951] GetFileType (hFile=0x154) returned 0x1 [0127.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0127.951] GetFileType (hFile=0x154) returned 0x1 [0127.951] WriteFile (in: hFile=0x154, lpBuffer=0x1b599f8*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b599f8*, lpNumberOfBytesWritten=0x2ae29c*=0x1b80, lpOverlapped=0x0) returned 1 [0127.952] CloseHandle (hObject=0x154) returned 1 [0127.952] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg", lpFilePart=0x0) returned 0x71 [0127.952] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0127.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0127.952] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbibyz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d72ba10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d72ba10, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb33cc90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b80)) returned 1 [0127.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0127.952] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbibyz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIbYz[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbibyz[1].jpg.anonymous")) returned 1 [0127.953] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg", lpFilePart=0x0) returned 0x71 [0127.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0127.953] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbicmp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0127.953] GetFileType (hFile=0x154) returned 0x1 [0127.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0127.954] GetFileType (hFile=0x154) returned 0x1 [0127.954] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7d7 [0127.954] ReadFile (in: hFile=0x154, lpBuffer=0x1b5c364, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b5c364*, lpNumberOfBytesRead=0x2ae2a8*=0x7d7, lpOverlapped=0x0) returned 1 [0127.955] CloseHandle (hObject=0x154) returned 1 [0128.006] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg", lpFilePart=0x0) returned 0x71 [0128.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.006] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbicmp[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.008] GetFileType (hFile=0x154) returned 0x1 [0128.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.008] GetFileType (hFile=0x154) returned 0x1 [0128.008] WriteFile (in: hFile=0x154, lpBuffer=0x19ae1e8*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19ae1e8*, lpNumberOfBytesWritten=0x2ae270*=0x7e0, lpOverlapped=0x0) returned 1 [0128.010] CloseHandle (hObject=0x154) returned 1 [0128.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg", lpFilePart=0x0) returned 0x71 [0128.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbicmp[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d810250, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d810250, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb3d5210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7e0)) returned 1 [0128.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.010] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbicmp[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIcMP[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbicmp[1].jpg.anonymous")) returned 1 [0128.011] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg", lpFilePart=0x0) returned 0x71 [0128.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.011] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbidgd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.012] GetFileType (hFile=0x154) returned 0x1 [0128.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.012] GetFileType (hFile=0x154) returned 0x1 [0128.012] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7d3 [0128.012] ReadFile (in: hFile=0x154, lpBuffer=0x19afe58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19afe58*, lpNumberOfBytesRead=0x2ae2a8*=0x7d3, lpOverlapped=0x0) returned 1 [0128.014] CloseHandle (hObject=0x154) returned 1 [0128.031] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg", lpFilePart=0x0) returned 0x71 [0128.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.031] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbidgd[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.033] GetFileType (hFile=0x154) returned 0x1 [0128.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.033] GetFileType (hFile=0x154) returned 0x1 [0128.033] WriteFile (in: hFile=0x154, lpBuffer=0x1a00690*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a00690*, lpNumberOfBytesWritten=0x2ae270*=0x7e0, lpOverlapped=0x0) returned 1 [0128.034] CloseHandle (hObject=0x154) returned 1 [0128.035] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg", lpFilePart=0x0) returned 0x71 [0128.035] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbidgd[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d966eb0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d966eb0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb3fb370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7e0)) returned 1 [0128.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.035] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbidgd[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIDgd[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbidgd[1].jpg.anonymous")) returned 1 [0128.036] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg", lpFilePart=0x0) returned 0x71 [0128.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.036] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbier4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.037] GetFileType (hFile=0x154) returned 0x1 [0128.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.037] GetFileType (hFile=0x154) returned 0x1 [0128.037] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1a8b [0128.037] ReadFile (in: hFile=0x154, lpBuffer=0x1a01b20, nNumberOfBytesToRead=0x1a8b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a01b20*, lpNumberOfBytesRead=0x2ae2a8*=0x1a8b, lpOverlapped=0x0) returned 1 [0128.039] CloseHandle (hObject=0x154) returned 1 [0128.056] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg", lpFilePart=0x0) returned 0x71 [0128.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.056] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbier4[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.058] GetFileType (hFile=0x154) returned 0x1 [0128.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.058] GetFileType (hFile=0x154) returned 0x1 [0128.058] WriteFile (in: hFile=0x154, lpBuffer=0x1a56ddc*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a56ddc*, lpNumberOfBytesWritten=0x2ae29c*=0x1a90, lpOverlapped=0x0) returned 1 [0128.060] CloseHandle (hObject=0x154) returned 1 [0128.060] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg", lpFilePart=0x0) returned 0x71 [0128.060] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbier4[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9ff430, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9ff430, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb447630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a90)) returned 1 [0128.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.061] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbier4[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIer4[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbier4[1].jpg.anonymous")) returned 1 [0128.061] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg", lpFilePart=0x0) returned 0x71 [0128.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.062] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbihgz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.062] GetFileType (hFile=0x154) returned 0x1 [0128.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.062] GetFileType (hFile=0x154) returned 0x1 [0128.062] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x6b0 [0128.062] ReadFile (in: hFile=0x154, lpBuffer=0x1a59530, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a59530*, lpNumberOfBytesRead=0x2ae2a8*=0x6b0, lpOverlapped=0x0) returned 1 [0128.064] CloseHandle (hObject=0x154) returned 1 [0128.082] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg", lpFilePart=0x0) returned 0x71 [0128.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.082] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbihgz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.084] GetFileType (hFile=0x154) returned 0x1 [0128.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.084] GetFileType (hFile=0x154) returned 0x1 [0128.084] WriteFile (in: hFile=0x154, lpBuffer=0x1aa966c*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1aa966c*, lpNumberOfBytesWritten=0x2ae270*=0x6c0, lpOverlapped=0x0) returned 1 [0128.086] CloseHandle (hObject=0x154) returned 1 [0128.086] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg", lpFilePart=0x0) returned 0x71 [0128.086] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbihgz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d777cd0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d777cd0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb4938f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c0)) returned 1 [0128.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.086] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbihgz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIhGZ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbihgz[1].jpg.anonymous")) returned 1 [0128.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg", lpFilePart=0x0) returned 0x71 [0128.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.087] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbik9h[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.088] GetFileType (hFile=0x154) returned 0x1 [0128.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.088] GetFileType (hFile=0x154) returned 0x1 [0128.088] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1560 [0128.088] ReadFile (in: hFile=0x154, lpBuffer=0x1aaaafc, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aaaafc*, lpNumberOfBytesRead=0x2ae2a8*=0x1560, lpOverlapped=0x0) returned 1 [0128.090] CloseHandle (hObject=0x154) returned 1 [0128.108] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg", lpFilePart=0x0) returned 0x71 [0128.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.108] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbik9h[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.110] GetFileType (hFile=0x154) returned 0x1 [0128.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.110] GetFileType (hFile=0x154) returned 0x1 [0128.110] WriteFile (in: hFile=0x154, lpBuffer=0x1afe414*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1afe414*, lpNumberOfBytesWritten=0x2ae29c*=0x1570, lpOverlapped=0x0) returned 1 [0128.111] CloseHandle (hObject=0x154) returned 1 [0128.112] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg", lpFilePart=0x0) returned 0x71 [0128.112] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbik9h[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da979b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da979b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb4b9a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1570)) returned 1 [0128.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.112] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbik9h[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIK9H[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbik9h[1].jpg.anonymous")) returned 1 [0128.113] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg", lpFilePart=0x0) returned 0x71 [0128.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.113] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbipps[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.113] GetFileType (hFile=0x154) returned 0x1 [0128.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.114] GetFileType (hFile=0x154) returned 0x1 [0128.114] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa6b [0128.114] ReadFile (in: hFile=0x154, lpBuffer=0x1b00a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b00a04*, lpNumberOfBytesRead=0x2ae2a8*=0xa6b, lpOverlapped=0x0) returned 1 [0128.116] CloseHandle (hObject=0x154) returned 1 [0128.133] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg", lpFilePart=0x0) returned 0x71 [0128.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.133] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbipps[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.135] GetFileType (hFile=0x154) returned 0x1 [0128.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.135] GetFileType (hFile=0x154) returned 0x1 [0128.135] WriteFile (in: hFile=0x154, lpBuffer=0x1b51da8*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b51da8*, lpNumberOfBytesWritten=0x2ae270*=0xa70, lpOverlapped=0x0) returned 1 [0128.136] CloseHandle (hObject=0x154) returned 1 [0128.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg", lpFilePart=0x0) returned 0x71 [0128.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbipps[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d91abf0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d91abf0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb505d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa70)) returned 1 [0128.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.136] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbipps[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIpps[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbipps[1].jpg.anonymous")) returned 1 [0128.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg", lpFilePart=0x0) returned 0x71 [0128.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.137] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbiqdu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.137] GetFileType (hFile=0x154) returned 0x1 [0128.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.137] GetFileType (hFile=0x154) returned 0x1 [0128.137] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x20b7 [0128.137] ReadFile (in: hFile=0x154, lpBuffer=0x1b53238, nNumberOfBytesToRead=0x20b7, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b53238*, lpNumberOfBytesRead=0x2ae2a8*=0x20b7, lpOverlapped=0x0) returned 1 [0128.139] CloseHandle (hObject=0x154) returned 1 [0128.178] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg", lpFilePart=0x0) returned 0x71 [0128.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.178] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbiqdu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.179] GetFileType (hFile=0x154) returned 0x1 [0128.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.179] GetFileType (hFile=0x154) returned 0x1 [0128.180] WriteFile (in: hFile=0x154, lpBuffer=0x19ad8e0*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19ad8e0*, lpNumberOfBytesWritten=0x2ae29c*=0x20c0, lpOverlapped=0x0) returned 1 [0128.181] CloseHandle (hObject=0x154) returned 1 [0128.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg", lpFilePart=0x0) returned 0x71 [0128.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbiqdu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7c3f90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d7c3f90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb578130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20c0)) returned 1 [0128.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.181] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbiqdu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBIqDu[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbiqdu[1].jpg.anonymous")) returned 1 [0128.182] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg", lpFilePart=0x0) returned 0x71 [0128.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.182] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbisnd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.182] GetFileType (hFile=0x154) returned 0x1 [0128.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.182] GetFileType (hFile=0x154) returned 0x1 [0128.182] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x17d4 [0128.182] ReadFile (in: hFile=0x154, lpBuffer=0x19affa8, nNumberOfBytesToRead=0x17d4, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19affa8*, lpNumberOfBytesRead=0x2ae2a8*=0x17d4, lpOverlapped=0x0) returned 1 [0128.184] CloseHandle (hObject=0x154) returned 1 [0128.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg", lpFilePart=0x0) returned 0x71 [0128.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.201] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbisnd[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.202] GetFileType (hFile=0x154) returned 0x1 [0128.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.202] GetFileType (hFile=0x154) returned 0x1 [0128.202] WriteFile (in: hFile=0x154, lpBuffer=0x1a0464c*, nNumberOfBytesToWrite=0x17e0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a0464c*, lpNumberOfBytesWritten=0x2ae29c*=0x17e0, lpOverlapped=0x0) returned 1 [0128.203] CloseHandle (hObject=0x154) returned 1 [0128.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg", lpFilePart=0x0) returned 0x71 [0128.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbisnd[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d9b3170, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d9b3170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb59e290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17e0)) returned 1 [0128.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.204] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbisnd[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBBISNd[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbisnd[1].jpg.anonymous")) returned 1 [0128.205] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg", lpFilePart=0x0) returned 0x71 [0128.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.205] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbyalp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.205] GetFileType (hFile=0x154) returned 0x1 [0128.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.205] GetFileType (hFile=0x154) returned 0x1 [0128.205] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x3143 [0128.205] ReadFile (in: hFile=0x154, lpBuffer=0x1a06434, nNumberOfBytesToRead=0x3143, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a06434*, lpNumberOfBytesRead=0x2ae2a8*=0x3143, lpOverlapped=0x0) returned 1 [0128.207] CloseHandle (hObject=0x154) returned 1 [0128.219] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg", lpFilePart=0x0) returned 0x71 [0128.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.219] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbyalp[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.221] GetFileType (hFile=0x154) returned 0x1 [0128.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.221] GetFileType (hFile=0x154) returned 0x1 [0128.221] WriteFile (in: hFile=0x154, lpBuffer=0x1a628b0*, nNumberOfBytesToWrite=0x3150, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a628b0*, lpNumberOfBytesWritten=0x2ae29c*=0x3150, lpOverlapped=0x0) returned 1 [0128.222] CloseHandle (hObject=0x154) returned 1 [0128.222] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg", lpFilePart=0x0) returned 0x71 [0128.222] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbyalp[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d8363b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d8363b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeb5c43f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3150)) returned 1 [0128.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.223] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbyalp[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBByALp[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbbyalp[1].jpg.anonymous")) returned 1 [0128.223] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg", lpFilePart=0x0) returned 0x71 [0128.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.223] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfqm5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.224] GetFileType (hFile=0x154) returned 0x1 [0128.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.224] GetFileType (hFile=0x154) returned 0x1 [0128.224] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2fd5 [0128.224] ReadFile (in: hFile=0x154, lpBuffer=0x1a66008, nNumberOfBytesToRead=0x2fd5, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a66008*, lpNumberOfBytesRead=0x2ae2a8*=0x2fd5, lpOverlapped=0x0) returned 1 [0128.240] CloseHandle (hObject=0x154) returned 1 [0128.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg", lpFilePart=0x0) returned 0x71 [0128.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.254] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfqm5[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.255] GetFileType (hFile=0x154) returned 0x1 [0128.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.255] GetFileType (hFile=0x154) returned 0x1 [0128.255] WriteFile (in: hFile=0x154, lpBuffer=0x1ac1d54*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ac1d54*, lpNumberOfBytesWritten=0x2ae29c*=0x2fe0, lpOverlapped=0x0) returned 1 [0128.257] CloseHandle (hObject=0x154) returned 1 [0128.257] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg", lpFilePart=0x0) returned 0x71 [0128.257] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.257] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfqm5[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c5c84e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c5c84e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb636810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2fe0)) returned 1 [0128.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.257] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfqm5[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFQm5[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfqm5[1].jpg.anonymous")) returned 1 [0128.258] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg", lpFilePart=0x0) returned 0x71 [0128.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.258] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfsy9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.258] GetFileType (hFile=0x154) returned 0x1 [0128.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.258] GetFileType (hFile=0x154) returned 0x1 [0128.258] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xbd9 [0128.258] ReadFile (in: hFile=0x154, lpBuffer=0x1ac5f24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ac5f24*, lpNumberOfBytesRead=0x2ae2a8*=0xbd9, lpOverlapped=0x0) returned 1 [0128.283] CloseHandle (hObject=0x154) returned 1 [0128.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg", lpFilePart=0x0) returned 0x71 [0128.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.297] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfsy9[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.298] GetFileType (hFile=0x154) returned 0x1 [0128.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.299] GetFileType (hFile=0x154) returned 0x1 [0128.299] WriteFile (in: hFile=0x154, lpBuffer=0x1b179f8*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b179f8*, lpNumberOfBytesWritten=0x2ae270*=0xbe0, lpOverlapped=0x0) returned 1 [0128.300] CloseHandle (hObject=0x154) returned 1 [0128.300] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg", lpFilePart=0x0) returned 0x71 [0128.300] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfsy9[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4bdb40, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4bdb40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb682ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbe0)) returned 1 [0128.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.300] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfsy9[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDFSY9[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdfsy9[1].jpg.anonymous")) returned 1 [0128.301] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg", lpFilePart=0x0) returned 0x71 [0128.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.301] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdiafh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.302] GetFileType (hFile=0x154) returned 0x1 [0128.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.302] GetFileType (hFile=0x154) returned 0x1 [0128.302] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1f0e [0128.302] ReadFile (in: hFile=0x154, lpBuffer=0x1b18e88, nNumberOfBytesToRead=0x1f0e, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b18e88*, lpNumberOfBytesRead=0x2ae2a8*=0x1f0e, lpOverlapped=0x0) returned 1 [0128.321] CloseHandle (hObject=0x154) returned 1 [0128.333] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg", lpFilePart=0x0) returned 0x71 [0128.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.333] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdiafh[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.335] GetFileType (hFile=0x154) returned 0x1 [0128.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.335] GetFileType (hFile=0x154) returned 0x1 [0128.335] WriteFile (in: hFile=0x154, lpBuffer=0x1b6f7c4*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b6f7c4*, lpNumberOfBytesWritten=0x2ae29c*=0x1f10, lpOverlapped=0x0) returned 1 [0128.336] CloseHandle (hObject=0x154) returned 1 [0128.336] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg", lpFilePart=0x0) returned 0x71 [0128.336] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.336] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdiafh[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc54160, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc54160, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb6f4ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f10)) returned 1 [0128.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.336] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdiafh[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDIAFH[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdiafh[1].jpg.anonymous")) returned 1 [0128.337] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg", lpFilePart=0x0) returned 0x71 [0128.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.337] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjypa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.343] GetFileType (hFile=0x154) returned 0x1 [0128.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.343] GetFileType (hFile=0x154) returned 0x1 [0128.343] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x215b [0128.343] ReadFile (in: hFile=0x154, lpBuffer=0x1b71cdc, nNumberOfBytesToRead=0x215b, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b71cdc*, lpNumberOfBytesRead=0x2ae2a8*=0x215b, lpOverlapped=0x0) returned 1 [0128.352] CloseHandle (hObject=0x154) returned 1 [0128.397] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg", lpFilePart=0x0) returned 0x71 [0128.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.397] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjypa[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.401] GetFileType (hFile=0x154) returned 0x1 [0128.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.401] GetFileType (hFile=0x154) returned 0x1 [0128.401] WriteFile (in: hFile=0x154, lpBuffer=0x19cf91c*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19cf91c*, lpNumberOfBytesWritten=0x2ae29c*=0x2160, lpOverlapped=0x0) returned 1 [0128.402] CloseHandle (hObject=0x154) returned 1 [0128.402] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg", lpFilePart=0x0) returned 0x71 [0128.402] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjypa[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4e3ca0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4e3ca0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb78d470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2160)) returned 1 [0128.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.403] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjypa[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJYPA[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjypa[1].jpg.anonymous")) returned 1 [0128.403] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg", lpFilePart=0x0) returned 0x71 [0128.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.403] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjzdv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.404] GetFileType (hFile=0x154) returned 0x1 [0128.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.404] GetFileType (hFile=0x154) returned 0x1 [0128.404] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x89e [0128.404] ReadFile (in: hFile=0x154, lpBuffer=0x19d2930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19d2930*, lpNumberOfBytesRead=0x2ae2a8*=0x89e, lpOverlapped=0x0) returned 1 [0128.415] CloseHandle (hObject=0x154) returned 1 [0128.432] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg", lpFilePart=0x0) returned 0x71 [0128.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.433] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjzdv[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.434] GetFileType (hFile=0x154) returned 0x1 [0128.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.435] GetFileType (hFile=0x154) returned 0x1 [0128.435] WriteFile (in: hFile=0x154, lpBuffer=0x1a2351c*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a2351c*, lpNumberOfBytesWritten=0x2ae270*=0x8a0, lpOverlapped=0x0) returned 1 [0128.436] CloseHandle (hObject=0x154) returned 1 [0128.436] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg", lpFilePart=0x0) returned 0x71 [0128.436] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.436] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjzdv[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7916a0e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0ce300, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb7d9730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8a0)) returned 1 [0128.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.437] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjzdv[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDJZdv[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdjzdv[1].jpg.anonymous")) returned 1 [0128.437] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg", lpFilePart=0x0) returned 0x71 [0128.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.438] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk03j[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.438] GetFileType (hFile=0x154) returned 0x1 [0128.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.439] GetFileType (hFile=0x154) returned 0x1 [0128.439] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0xa5e [0128.439] ReadFile (in: hFile=0x154, lpBuffer=0x1a25418, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a25418*, lpNumberOfBytesRead=0x2ae2a8*=0xa5e, lpOverlapped=0x0) returned 1 [0128.449] CloseHandle (hObject=0x154) returned 1 [0128.466] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg", lpFilePart=0x0) returned 0x71 [0128.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.467] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk03j[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.468] GetFileType (hFile=0x154) returned 0x1 [0128.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.468] GetFileType (hFile=0x154) returned 0x1 [0128.469] WriteFile (in: hFile=0x154, lpBuffer=0x1a76768*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a76768*, lpNumberOfBytesWritten=0x2ae270*=0xa60, lpOverlapped=0x0) returned 1 [0128.470] CloseHandle (hObject=0x154) returned 1 [0128.470] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg", lpFilePart=0x0) returned 0x71 [0128.470] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk03j[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc7a2c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc7a2c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb8259f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa60)) returned 1 [0128.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.470] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk03j[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK03j[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk03j[1].jpg.anonymous")) returned 1 [0128.481] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg", lpFilePart=0x0) returned 0x71 [0128.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.482] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk2sb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.482] GetFileType (hFile=0x154) returned 0x1 [0128.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.483] GetFileType (hFile=0x154) returned 0x1 [0128.483] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x23e7 [0128.483] ReadFile (in: hFile=0x154, lpBuffer=0x1a77bf8, nNumberOfBytesToRead=0x23e7, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a77bf8*, lpNumberOfBytesRead=0x2ae2a8*=0x23e7, lpOverlapped=0x0) returned 1 [0128.501] CloseHandle (hObject=0x154) returned 1 [0128.513] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg", lpFilePart=0x0) returned 0x71 [0128.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.514] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk2sb[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.515] GetFileType (hFile=0x154) returned 0x1 [0128.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.515] GetFileType (hFile=0x154) returned 0x1 [0128.515] WriteFile (in: hFile=0x154, lpBuffer=0x1acfd94*, nNumberOfBytesToWrite=0x23f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1acfd94*, lpNumberOfBytesWritten=0x2ae29c*=0x23f0, lpOverlapped=0x0) returned 1 [0128.516] CloseHandle (hObject=0x154) returned 1 [0128.517] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg", lpFilePart=0x0) returned 0x71 [0128.517] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk2sb[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7dd820, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c7dd820, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb897e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x23f0)) returned 1 [0128.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.517] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk2sb[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDK2sB[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdk2sb[1].jpg.anonymous")) returned 1 [0128.518] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg", lpFilePart=0x0) returned 0x71 [0128.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.518] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdkwr8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.519] GetFileType (hFile=0x154) returned 0x1 [0128.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.519] GetFileType (hFile=0x154) returned 0x1 [0128.519] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x766 [0128.519] ReadFile (in: hFile=0x154, lpBuffer=0x1ad2f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ad2f00*, lpNumberOfBytesRead=0x2ae2a8*=0x766, lpOverlapped=0x0) returned 1 [0128.533] CloseHandle (hObject=0x154) returned 1 [0128.545] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg", lpFilePart=0x0) returned 0x71 [0128.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.545] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdkwr8[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.546] GetFileType (hFile=0x154) returned 0x1 [0128.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.546] GetFileType (hFile=0x154) returned 0x1 [0128.547] WriteFile (in: hFile=0x154, lpBuffer=0x1b233a8*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b233a8*, lpNumberOfBytesWritten=0x2ae270*=0x770, lpOverlapped=0x0) returned 1 [0128.548] CloseHandle (hObject=0x154) returned 1 [0128.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg", lpFilePart=0x0) returned 0x71 [0128.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdkwr8[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b11a5c0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b11a5c0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb8e40d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x770)) returned 1 [0128.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.548] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdkwr8[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDKWr8[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdkwr8[1].jpg.anonymous")) returned 1 [0128.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg", lpFilePart=0x0) returned 0x71 [0128.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.549] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlfez[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.549] GetFileType (hFile=0x154) returned 0x1 [0128.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.549] GetFileType (hFile=0x154) returned 0x1 [0128.550] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x17e8 [0128.550] ReadFile (in: hFile=0x154, lpBuffer=0x1b24838, nNumberOfBytesToRead=0x17e8, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b24838*, lpNumberOfBytesRead=0x2ae2a8*=0x17e8, lpOverlapped=0x0) returned 1 [0128.567] CloseHandle (hObject=0x154) returned 1 [0128.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg", lpFilePart=0x0) returned 0x71 [0128.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.580] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlfez[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.582] GetFileType (hFile=0x154) returned 0x1 [0128.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.582] GetFileType (hFile=0x154) returned 0x1 [0128.582] WriteFile (in: hFile=0x154, lpBuffer=0x1b78dd0*, nNumberOfBytesToWrite=0x17f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b78dd0*, lpNumberOfBytesWritten=0x2ae29c*=0x17f0, lpOverlapped=0x0) returned 1 [0128.583] CloseHandle (hObject=0x154) returned 1 [0128.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg", lpFilePart=0x0) returned 0x71 [0128.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlfez[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbbbbe0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbbbbe0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb9564f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17f0)) returned 1 [0128.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.583] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlfez[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLfeZ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlfez[1].jpg.anonymous")) returned 1 [0128.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg", lpFilePart=0x0) returned 0x71 [0128.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.584] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdljft[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.584] GetFileType (hFile=0x154) returned 0x1 [0128.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.585] GetFileType (hFile=0x154) returned 0x1 [0128.585] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x8e2 [0128.585] ReadFile (in: hFile=0x154, lpBuffer=0x1b7b4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b7b4b8*, lpNumberOfBytesRead=0x2ae2a8*=0x8e2, lpOverlapped=0x0) returned 1 [0128.591] CloseHandle (hObject=0x154) returned 1 [0128.634] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg", lpFilePart=0x0) returned 0x71 [0128.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.634] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdljft[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.636] GetFileType (hFile=0x154) returned 0x1 [0128.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.636] GetFileType (hFile=0x154) returned 0x1 [0128.636] WriteFile (in: hFile=0x154, lpBuffer=0x19d1114*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19d1114*, lpNumberOfBytesWritten=0x2ae270*=0x8f0, lpOverlapped=0x0) returned 1 [0128.637] CloseHandle (hObject=0x154) returned 1 [0128.637] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg", lpFilePart=0x0) returned 0x71 [0128.638] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdljft[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2f4ac0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2f4ac0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeb9c8910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8f0)) returned 1 [0128.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.638] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdljft[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLjFT[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdljft[1].jpg.anonymous")) returned 1 [0128.639] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg", lpFilePart=0x0) returned 0x71 [0128.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.639] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdllx3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.639] GetFileType (hFile=0x154) returned 0x1 [0128.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.640] GetFileType (hFile=0x154) returned 0x1 [0128.640] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x969 [0128.640] ReadFile (in: hFile=0x154, lpBuffer=0x19d2f1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19d2f1c*, lpNumberOfBytesRead=0x2ae2a8*=0x969, lpOverlapped=0x0) returned 1 [0128.669] CloseHandle (hObject=0x154) returned 1 [0128.682] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg", lpFilePart=0x0) returned 0x71 [0128.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.682] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdllx3[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.684] GetFileType (hFile=0x154) returned 0x1 [0128.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.684] GetFileType (hFile=0x154) returned 0x1 [0128.684] WriteFile (in: hFile=0x154, lpBuffer=0x1a23f1c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a23f1c*, lpNumberOfBytesWritten=0x2ae270*=0x970, lpOverlapped=0x0) returned 1 [0128.685] CloseHandle (hObject=0x154) returned 1 [0128.685] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg", lpFilePart=0x0) returned 0x71 [0128.686] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdllx3[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c44b720, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c44b720, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeba3ad30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0128.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.686] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdllx3[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLlX3[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdllx3[1].jpg.anonymous")) returned 1 [0128.687] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg", lpFilePart=0x0) returned 0x71 [0128.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.687] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlm5y[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.687] GetFileType (hFile=0x154) returned 0x1 [0128.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.687] GetFileType (hFile=0x154) returned 0x1 [0128.687] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x967 [0128.687] ReadFile (in: hFile=0x154, lpBuffer=0x1a25d20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a25d20*, lpNumberOfBytesRead=0x2ae2a8*=0x967, lpOverlapped=0x0) returned 1 [0128.705] CloseHandle (hObject=0x154) returned 1 [0128.718] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg", lpFilePart=0x0) returned 0x71 [0128.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.718] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlm5y[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.720] GetFileType (hFile=0x154) returned 0x1 [0128.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.720] GetFileType (hFile=0x154) returned 0x1 [0128.720] WriteFile (in: hFile=0x154, lpBuffer=0x1a76bc8*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a76bc8*, lpNumberOfBytesWritten=0x2ae270*=0x970, lpOverlapped=0x0) returned 1 [0128.721] CloseHandle (hObject=0x154) returned 1 [0128.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg", lpFilePart=0x0) returned 0x71 [0128.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlm5y[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c76b400, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c76b400, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeba86ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0128.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.722] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlm5y[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLM5y[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlm5y[1].jpg.anonymous")) returned 1 [0128.723] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg", lpFilePart=0x0) returned 0x71 [0128.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.723] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlpmu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.724] GetFileType (hFile=0x154) returned 0x1 [0128.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.724] GetFileType (hFile=0x154) returned 0x1 [0128.724] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2811 [0128.724] ReadFile (in: hFile=0x154, lpBuffer=0x1a78058, nNumberOfBytesToRead=0x2811, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a78058*, lpNumberOfBytesRead=0x2ae2a8*=0x2811, lpOverlapped=0x0) returned 1 [0128.748] CloseHandle (hObject=0x154) returned 1 [0128.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg", lpFilePart=0x0) returned 0x71 [0128.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.762] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlpmu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.764] GetFileType (hFile=0x154) returned 0x1 [0128.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.764] GetFileType (hFile=0x154) returned 0x1 [0128.764] WriteFile (in: hFile=0x154, lpBuffer=0x1ad16e4*, nNumberOfBytesToWrite=0x2820, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ad16e4*, lpNumberOfBytesWritten=0x2ae29c*=0x2820, lpOverlapped=0x0) returned 1 [0128.765] CloseHandle (hObject=0x154) returned 1 [0128.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg", lpFilePart=0x0) returned 0x71 [0128.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.766] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlpmu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d698040, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7d698040, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebaf9410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2820)) returned 1 [0128.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.766] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlpmu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLPMU[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlpmu[1].jpg.anonymous")) returned 1 [0128.766] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg", lpFilePart=0x0) returned 0x71 [0128.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.767] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlrsk[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.767] GetFileType (hFile=0x154) returned 0x1 [0128.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.767] GetFileType (hFile=0x154) returned 0x1 [0128.767] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2988 [0128.767] ReadFile (in: hFile=0x154, lpBuffer=0x1ad450c, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ad450c*, lpNumberOfBytesRead=0x2ae2a8*=0x2988, lpOverlapped=0x0) returned 1 [0128.785] CloseHandle (hObject=0x154) returned 1 [0128.797] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg", lpFilePart=0x0) returned 0x71 [0128.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.798] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlrsk[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.800] GetFileType (hFile=0x154) returned 0x1 [0128.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.800] GetFileType (hFile=0x154) returned 0x1 [0128.800] WriteFile (in: hFile=0x154, lpBuffer=0x1b2e2c4*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b2e2c4*, lpNumberOfBytesWritten=0x2ae29c*=0x2990, lpOverlapped=0x0) returned 1 [0128.802] CloseHandle (hObject=0x154) returned 1 [0128.802] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg", lpFilePart=0x0) returned 0x71 [0128.802] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlrsk[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc07ea0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc07ea0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebb6b830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2990)) returned 1 [0128.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.802] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlrsk[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLRsK[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlrsk[1].jpg.anonymous")) returned 1 [0128.803] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg", lpFilePart=0x0) returned 0x71 [0128.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.803] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlxkp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.804] GetFileType (hFile=0x154) returned 0x1 [0128.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.804] GetFileType (hFile=0x154) returned 0x1 [0128.804] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x900 [0128.804] ReadFile (in: hFile=0x154, lpBuffer=0x1b31b68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b31b68*, lpNumberOfBytesRead=0x2ae2a8*=0x900, lpOverlapped=0x0) returned 1 [0128.825] CloseHandle (hObject=0x154) returned 1 [0128.838] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg", lpFilePart=0x0) returned 0x71 [0128.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.838] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlxkp[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.839] GetFileType (hFile=0x154) returned 0x1 [0128.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.839] GetFileType (hFile=0x154) returned 0x1 [0128.839] WriteFile (in: hFile=0x154, lpBuffer=0x1b82834*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b82834*, lpNumberOfBytesWritten=0x2ae270*=0x910, lpOverlapped=0x0) returned 1 [0128.841] CloseHandle (hObject=0x154) returned 1 [0128.841] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg", lpFilePart=0x0) returned 0x71 [0128.841] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.841] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlxkp[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c829ae0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c829ae0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebbb7af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0128.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.841] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlxkp[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDLXKp[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdlxkp[1].jpg.anonymous")) returned 1 [0128.842] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg", lpFilePart=0x0) returned 0x71 [0128.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.842] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdm5lo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.842] GetFileType (hFile=0x154) returned 0x1 [0128.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.842] GetFileType (hFile=0x154) returned 0x1 [0128.842] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x9eb [0128.845] ReadFile (in: hFile=0x154, lpBuffer=0x1985bec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1985bec*, lpNumberOfBytesRead=0x2ae2a8*=0x9eb, lpOverlapped=0x0) returned 1 [0128.871] CloseHandle (hObject=0x154) returned 1 [0128.923] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg", lpFilePart=0x0) returned 0x71 [0128.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.924] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdm5lo[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.928] GetFileType (hFile=0x154) returned 0x1 [0128.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.928] GetFileType (hFile=0x154) returned 0x1 [0128.928] WriteFile (in: hFile=0x154, lpBuffer=0x19d6e6c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19d6e6c*, lpNumberOfBytesWritten=0x2ae270*=0x9f0, lpOverlapped=0x0) returned 1 [0128.929] CloseHandle (hObject=0x154) returned 1 [0128.929] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg", lpFilePart=0x0) returned 0x71 [0128.929] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdm5lo[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c76b400, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c76b400, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebc9c330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9f0)) returned 1 [0128.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.931] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdm5lo[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDM5Lo[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdm5lo[1].jpg.anonymous")) returned 1 [0128.932] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg", lpFilePart=0x0) returned 0x71 [0128.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0128.932] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmczb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.933] GetFileType (hFile=0x154) returned 0x1 [0128.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0128.934] GetFileType (hFile=0x154) returned 0x1 [0128.935] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7cc [0128.935] ReadFile (in: hFile=0x154, lpBuffer=0x19d8ad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19d8ad4*, lpNumberOfBytesRead=0x2ae2a8*=0x7cc, lpOverlapped=0x0) returned 1 [0128.980] CloseHandle (hObject=0x154) returned 1 [0128.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg", lpFilePart=0x0) returned 0x71 [0128.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0128.996] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmczb[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0128.997] GetFileType (hFile=0x154) returned 0x1 [0128.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0128.998] GetFileType (hFile=0x154) returned 0x1 [0128.998] WriteFile (in: hFile=0x154, lpBuffer=0x1a29154*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a29154*, lpNumberOfBytesWritten=0x2ae270*=0x7d0, lpOverlapped=0x0) returned 1 [0128.999] CloseHandle (hObject=0x154) returned 1 [0128.999] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg", lpFilePart=0x0) returned 0x71 [0128.999] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0128.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0128.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmczb[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cbbbbe0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cbbbbe0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebd348b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0128.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0128.999] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmczb[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMcZB[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmczb[1].jpg.anonymous")) returned 1 [0129.000] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg", lpFilePart=0x0) returned 0x71 [0129.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.000] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmgvz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.000] GetFileType (hFile=0x154) returned 0x1 [0129.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.000] GetFileType (hFile=0x154) returned 0x1 [0129.000] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1e95 [0129.000] ReadFile (in: hFile=0x154, lpBuffer=0x1a2a5e4, nNumberOfBytesToRead=0x1e95, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a2a5e4*, lpNumberOfBytesRead=0x2ae2a8*=0x1e95, lpOverlapped=0x0) returned 1 [0129.020] CloseHandle (hObject=0x154) returned 1 [0129.038] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg", lpFilePart=0x0) returned 0x71 [0129.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.038] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmgvz[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.041] GetFileType (hFile=0x154) returned 0x1 [0129.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.041] GetFileType (hFile=0x154) returned 0x1 [0129.041] WriteFile (in: hFile=0x154, lpBuffer=0x1a80cf0*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a80cf0*, lpNumberOfBytesWritten=0x2ae29c*=0x1ea0, lpOverlapped=0x0) returned 1 [0129.042] CloseHandle (hObject=0x154) returned 1 [0129.042] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg", lpFilePart=0x0) returned 0x71 [0129.042] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmgvz[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3dd6f90, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3dd6f90, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xebda6cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ea0)) returned 1 [0129.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.042] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmgvz[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMgVZ[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmgvz[1].jpg.anonymous")) returned 1 [0129.043] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg", lpFilePart=0x0) returned 0x71 [0129.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.043] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmj4f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.050] GetFileType (hFile=0x154) returned 0x1 [0129.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.050] GetFileType (hFile=0x154) returned 0x1 [0129.050] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2327 [0129.050] ReadFile (in: hFile=0x154, lpBuffer=0x1a83198, nNumberOfBytesToRead=0x2327, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a83198*, lpNumberOfBytesRead=0x2ae2a8*=0x2327, lpOverlapped=0x0) returned 1 [0129.069] CloseHandle (hObject=0x154) returned 1 [0129.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg", lpFilePart=0x0) returned 0x71 [0129.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.084] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmj4f[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.085] GetFileType (hFile=0x154) returned 0x1 [0129.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.085] GetFileType (hFile=0x154) returned 0x1 [0129.085] WriteFile (in: hFile=0x154, lpBuffer=0x1adaf74*, nNumberOfBytesToWrite=0x2330, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1adaf74*, lpNumberOfBytesWritten=0x2ae29c*=0x2330, lpOverlapped=0x0) returned 1 [0129.087] CloseHandle (hObject=0x154) returned 1 [0129.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg", lpFilePart=0x0) returned 0x71 [0129.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmj4f[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c340d80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c340d80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebe190f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2330)) returned 1 [0129.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.087] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmj4f[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJ4F[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmj4f[1].jpg.anonymous")) returned 1 [0129.088] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg", lpFilePart=0x0) returned 0x71 [0129.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.088] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmjlo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.088] GetFileType (hFile=0x154) returned 0x1 [0129.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.088] GetFileType (hFile=0x154) returned 0x1 [0129.088] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2efb [0129.088] ReadFile (in: hFile=0x154, lpBuffer=0x1add8ac, nNumberOfBytesToRead=0x2efb, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1add8ac*, lpNumberOfBytesRead=0x2ae2a8*=0x2efb, lpOverlapped=0x0) returned 1 [0129.104] CloseHandle (hObject=0x154) returned 1 [0129.122] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg", lpFilePart=0x0) returned 0x71 [0129.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.122] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmjlo[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.123] GetFileType (hFile=0x154) returned 0x1 [0129.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.124] GetFileType (hFile=0x154) returned 0x1 [0129.124] WriteFile (in: hFile=0x154, lpBuffer=0x1b39198*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1b39198*, lpNumberOfBytesWritten=0x2ae29c*=0x2f00, lpOverlapped=0x0) returned 1 [0129.125] CloseHandle (hObject=0x154) returned 1 [0129.125] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg", lpFilePart=0x0) returned 0x71 [0129.125] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.125] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmjlo[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7dd820, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c7dd820, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebe653b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f00)) returned 1 [0129.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.125] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmjlo[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMJlo[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmjlo[1].jpg.anonymous")) returned 1 [0129.126] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg", lpFilePart=0x0) returned 0x71 [0129.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.126] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmnrg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.126] GetFileType (hFile=0x154) returned 0x1 [0129.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.126] GetFileType (hFile=0x154) returned 0x1 [0129.126] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x21bf [0129.126] ReadFile (in: hFile=0x154, lpBuffer=0x1b3c6a0, nNumberOfBytesToRead=0x21bf, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b3c6a0*, lpNumberOfBytesRead=0x2ae2a8*=0x21bf, lpOverlapped=0x0) returned 1 [0129.143] CloseHandle (hObject=0x154) returned 1 [0129.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg", lpFilePart=0x0) returned 0x71 [0129.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.193] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmnrg[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.194] GetFileType (hFile=0x154) returned 0x1 [0129.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.194] GetFileType (hFile=0x154) returned 0x1 [0129.194] WriteFile (in: hFile=0x154, lpBuffer=0x1995748*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1995748*, lpNumberOfBytesWritten=0x2ae29c*=0x21c0, lpOverlapped=0x0) returned 1 [0129.196] CloseHandle (hObject=0x154) returned 1 [0129.196] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg", lpFilePart=0x0) returned 0x71 [0129.196] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmnrg[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c340d80, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c340d80, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebf23a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21c0)) returned 1 [0129.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.196] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmnrg[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMnRG[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmnrg[1].jpg.anonymous")) returned 1 [0129.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg", lpFilePart=0x0) returned 0x71 [0129.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.197] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdms2x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.198] GetFileType (hFile=0x154) returned 0x1 [0129.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.198] GetFileType (hFile=0x154) returned 0x1 [0129.198] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x95f [0129.198] ReadFile (in: hFile=0x154, lpBuffer=0x199887c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x199887c*, lpNumberOfBytesRead=0x2ae2a8*=0x95f, lpOverlapped=0x0) returned 1 [0129.209] CloseHandle (hObject=0x154) returned 1 [0129.222] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg", lpFilePart=0x0) returned 0x71 [0129.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.222] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdms2x[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.223] GetFileType (hFile=0x154) returned 0x1 [0129.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.223] GetFileType (hFile=0x154) returned 0x1 [0129.223] WriteFile (in: hFile=0x154, lpBuffer=0x19e9828*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19e9828*, lpNumberOfBytesWritten=0x2ae270*=0x960, lpOverlapped=0x0) returned 1 [0129.224] CloseHandle (hObject=0x154) returned 1 [0129.224] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg", lpFilePart=0x0) returned 0x71 [0129.225] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdms2x[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c3ff460, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c3ff460, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebf6fd50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x960)) returned 1 [0129.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.225] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdms2x[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMs2x[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdms2x[1].jpg.anonymous")) returned 1 [0129.228] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg", lpFilePart=0x0) returned 0x71 [0129.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.228] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmyru[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.248] GetFileType (hFile=0x154) returned 0x1 [0129.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.248] GetFileType (hFile=0x154) returned 0x1 [0129.248] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x5bd [0129.248] ReadFile (in: hFile=0x154, lpBuffer=0x19eb284, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19eb284*, lpNumberOfBytesRead=0x2ae2a8*=0x5bd, lpOverlapped=0x0) returned 1 [0129.255] CloseHandle (hObject=0x154) returned 1 [0129.267] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg", lpFilePart=0x0) returned 0x71 [0129.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.267] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmyru[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.268] GetFileType (hFile=0x154) returned 0x1 [0129.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.268] GetFileType (hFile=0x154) returned 0x1 [0129.269] WriteFile (in: hFile=0x154, lpBuffer=0x1a3aeb4*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a3aeb4*, lpNumberOfBytesWritten=0x2ae270*=0x5c0, lpOverlapped=0x0) returned 1 [0129.270] CloseHandle (hObject=0x154) returned 1 [0129.270] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg", lpFilePart=0x0) returned 0x71 [0129.270] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmyru[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c2f4ac0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c2f4ac0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xebfe2170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0129.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.270] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmyru[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMyRu[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmyru[1].jpg.anonymous")) returned 1 [0129.271] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg", lpFilePart=0x0) returned 0x71 [0129.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.271] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmzeu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.273] GetFileType (hFile=0x154) returned 0x1 [0129.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.274] GetFileType (hFile=0x154) returned 0x1 [0129.274] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x884 [0129.274] ReadFile (in: hFile=0x154, lpBuffer=0x1a3cbd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a3cbd4*, lpNumberOfBytesRead=0x2ae2a8*=0x884, lpOverlapped=0x0) returned 1 [0129.308] CloseHandle (hObject=0x154) returned 1 [0129.327] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg", lpFilePart=0x0) returned 0x71 [0129.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.327] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmzeu[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.329] GetFileType (hFile=0x154) returned 0x1 [0129.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.329] GetFileType (hFile=0x154) returned 0x1 [0129.329] WriteFile (in: hFile=0x154, lpBuffer=0x1a8d61c*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a8d61c*, lpNumberOfBytesWritten=0x2ae270*=0x890, lpOverlapped=0x0) returned 1 [0129.330] CloseHandle (hObject=0x154) returned 1 [0129.331] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg", lpFilePart=0x0) returned 0x71 [0129.331] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmzeu[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c366ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c366ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec07a6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x890)) returned 1 [0129.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.331] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmzeu[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDMzEU[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdmzeu[1].jpg.anonymous")) returned 1 [0129.332] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg", lpFilePart=0x0) returned 0x71 [0129.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.332] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdntnc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.332] GetFileType (hFile=0x154) returned 0x1 [0129.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.332] GetFileType (hFile=0x154) returned 0x1 [0129.332] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x224d [0129.332] ReadFile (in: hFile=0x154, lpBuffer=0x1a8eaac, nNumberOfBytesToRead=0x224d, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a8eaac*, lpNumberOfBytesRead=0x2ae2a8*=0x224d, lpOverlapped=0x0) returned 1 [0129.345] CloseHandle (hObject=0x154) returned 1 [0129.357] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg", lpFilePart=0x0) returned 0x71 [0129.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.357] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdntnc[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.359] GetFileType (hFile=0x154) returned 0x1 [0129.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.359] GetFileType (hFile=0x154) returned 0x1 [0129.359] WriteFile (in: hFile=0x154, lpBuffer=0x1ae6428*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1ae6428*, lpNumberOfBytesWritten=0x2ae29c*=0x2250, lpOverlapped=0x0) returned 1 [0129.361] CloseHandle (hObject=0x154) returned 1 [0129.361] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg", lpFilePart=0x0) returned 0x71 [0129.361] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdntnc[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc07ea0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc07ea0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec0a0850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2250)) returned 1 [0129.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.362] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdntnc[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDntNC[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdntnc[1].jpg.anonymous")) returned 1 [0129.363] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg", lpFilePart=0x0) returned 0x71 [0129.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.363] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvcmh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.385] GetFileType (hFile=0x154) returned 0x1 [0129.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.385] GetFileType (hFile=0x154) returned 0x1 [0129.385] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x740 [0129.385] ReadFile (in: hFile=0x154, lpBuffer=0x1ae93cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ae93cc*, lpNumberOfBytesRead=0x2ae2a8*=0x740, lpOverlapped=0x0) returned 1 [0129.417] CloseHandle (hObject=0x154) returned 1 [0129.433] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg", lpFilePart=0x0) returned 0x71 [0129.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.433] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvcmh[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.435] GetFileType (hFile=0x154) returned 0x1 [0129.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.435] GetFileType (hFile=0x154) returned 0x1 [0129.435] WriteFile (in: hFile=0x154, lpBuffer=0x1b397d8*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b397d8*, lpNumberOfBytesWritten=0x2ae270*=0x750, lpOverlapped=0x0) returned 1 [0129.437] CloseHandle (hObject=0x154) returned 1 [0129.437] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg", lpFilePart=0x0) returned 0x71 [0129.437] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvcmh[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c509e00, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c509e00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec15ef30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x750)) returned 1 [0129.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.437] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvcmh[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvCmH[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvcmh[1].jpg.anonymous")) returned 1 [0129.438] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg", lpFilePart=0x0) returned 0x71 [0129.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.439] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvxii[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.439] GetFileType (hFile=0x154) returned 0x1 [0129.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.440] GetFileType (hFile=0x154) returned 0x1 [0129.440] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2bd8 [0129.440] ReadFile (in: hFile=0x154, lpBuffer=0x1b3ac68, nNumberOfBytesToRead=0x2bd8, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b3ac68*, lpNumberOfBytesRead=0x2ae2a8*=0x2bd8, lpOverlapped=0x0) returned 1 [0129.488] CloseHandle (hObject=0x154) returned 1 [0129.533] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg", lpFilePart=0x0) returned 0x71 [0129.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.533] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvxii[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.535] GetFileType (hFile=0x154) returned 0x1 [0129.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.535] GetFileType (hFile=0x154) returned 0x1 [0129.535] WriteFile (in: hFile=0x154, lpBuffer=0x1995fe0*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1995fe0*, lpNumberOfBytesWritten=0x2ae29c*=0x2be0, lpOverlapped=0x0) returned 1 [0129.536] CloseHandle (hObject=0x154) returned 1 [0129.537] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg", lpFilePart=0x0) returned 0x71 [0129.537] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg.anonymous", lpFilePart=0x0) returned 0x7b [0129.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvxii[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cc2e000, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cc2e000, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec2698d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2be0)) returned 1 [0129.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.537] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvxii[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBDvxii[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbdvxii[1].jpg.anonymous")) returned 1 [0129.538] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png", lpFilePart=0x0) returned 0x71 [0129.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.538] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbghfvy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.538] GetFileType (hFile=0x154) returned 0x1 [0129.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.538] GetFileType (hFile=0x154) returned 0x1 [0129.538] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1dc [0129.538] ReadFile (in: hFile=0x154, lpBuffer=0x19993b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19993b0*, lpNumberOfBytesRead=0x2ae2a8*=0x1dc, lpOverlapped=0x0) returned 1 [0129.554] CloseHandle (hObject=0x154) returned 1 [0129.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png", lpFilePart=0x0) returned 0x71 [0129.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.568] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbghfvy[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.569] GetFileType (hFile=0x154) returned 0x1 [0129.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.569] GetFileType (hFile=0x154) returned 0x1 [0129.569] WriteFile (in: hFile=0x154, lpBuffer=0x19e7ddc*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19e7ddc*, lpNumberOfBytesWritten=0x2ae270*=0x1e0, lpOverlapped=0x0) returned 1 [0129.571] CloseHandle (hObject=0x154) returned 1 [0129.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png", lpFilePart=0x0) returned 0x71 [0129.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0129.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbghfvy[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d81860, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3d81860, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xec2b5b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e0)) returned 1 [0129.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.571] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBghfVy[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbghfvy[1].png.anonymous")) returned 1 [0129.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png", lpFilePart=0x0) returned 0x71 [0129.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.572] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbjbl9m[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.573] GetFileType (hFile=0x154) returned 0x1 [0129.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.573] GetFileType (hFile=0x154) returned 0x1 [0129.573] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1cd [0129.573] ReadFile (in: hFile=0x154, lpBuffer=0x19e9448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19e9448*, lpNumberOfBytesRead=0x2ae2a8*=0x1cd, lpOverlapped=0x0) returned 1 [0129.593] CloseHandle (hObject=0x154) returned 1 [0129.606] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png", lpFilePart=0x0) returned 0x71 [0129.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.606] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbjbl9m[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.607] GetFileType (hFile=0x154) returned 0x1 [0129.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.608] GetFileType (hFile=0x154) returned 0x1 [0129.608] WriteFile (in: hFile=0x154, lpBuffer=0x1a37cc8*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a37cc8*, lpNumberOfBytesWritten=0x2ae270*=0x1d0, lpOverlapped=0x0) returned 1 [0129.609] CloseHandle (hObject=0x154) returned 1 [0129.609] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png", lpFilePart=0x0) returned 0x71 [0129.609] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0129.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbjbl9m[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c366ee0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c366ee0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec301e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1 [0129.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.609] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbjbl9m[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBjBl9m[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbjbl9m[1].png.anonymous")) returned 1 [0129.610] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png", lpFilePart=0x0) returned 0x71 [0129.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.610] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkkhja[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.610] GetFileType (hFile=0x154) returned 0x1 [0129.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.610] GetFileType (hFile=0x154) returned 0x1 [0129.610] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x2c9 [0129.610] ReadFile (in: hFile=0x154, lpBuffer=0x1a39430, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a39430*, lpNumberOfBytesRead=0x2ae2a8*=0x2c9, lpOverlapped=0x0) returned 1 [0129.612] CloseHandle (hObject=0x154) returned 1 [0129.624] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png", lpFilePart=0x0) returned 0x71 [0129.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.624] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkkhja[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.625] GetFileType (hFile=0x154) returned 0x1 [0129.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.625] GetFileType (hFile=0x154) returned 0x1 [0129.625] WriteFile (in: hFile=0x154, lpBuffer=0x1a881b4*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a881b4*, lpNumberOfBytesWritten=0x2ae270*=0x2d0, lpOverlapped=0x0) returned 1 [0129.627] CloseHandle (hObject=0x154) returned 1 [0129.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png", lpFilePart=0x0) returned 0x71 [0129.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0129.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkkhja[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d4a42b0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d4a42b0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xec34e110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2d0)) returned 1 [0129.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.627] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkkhja[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkkhJa[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkkhja[1].png.anonymous")) returned 1 [0129.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png", lpFilePart=0x0) returned 0x70 [0129.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.628] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkwur[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.628] GetFileType (hFile=0x154) returned 0x1 [0129.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.628] GetFileType (hFile=0x154) returned 0x1 [0129.628] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x1af [0129.628] ReadFile (in: hFile=0x154, lpBuffer=0x1a897fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a897fc*, lpNumberOfBytesRead=0x2ae2a8*=0x1af, lpOverlapped=0x0) returned 1 [0129.647] CloseHandle (hObject=0x154) returned 1 [0129.659] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png", lpFilePart=0x0) returned 0x70 [0129.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.659] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkwur[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.660] GetFileType (hFile=0x154) returned 0x1 [0129.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.660] GetFileType (hFile=0x154) returned 0x1 [0129.660] WriteFile (in: hFile=0x154, lpBuffer=0x1ad7fd8*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ad7fd8*, lpNumberOfBytesWritten=0x2ae270*=0x1b0, lpOverlapped=0x0) returned 1 [0129.662] CloseHandle (hObject=0x154) returned 1 [0129.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png", lpFilePart=0x0) returned 0x70 [0129.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png.anonymous", lpFilePart=0x0) returned 0x7a [0129.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkwur[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d751b70, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d751b70, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xec39a3d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b0)) returned 1 [0129.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.662] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkwur[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBkwUr[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbkwur[1].png.anonymous")) returned 1 [0129.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png", lpFilePart=0x0) returned 0x71 [0129.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.663] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbm7qdo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.663] GetFileType (hFile=0x154) returned 0x1 [0129.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.664] GetFileType (hFile=0x154) returned 0x1 [0129.664] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x17c [0129.664] ReadFile (in: hFile=0x154, lpBuffer=0x1ad95f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ad95f0*, lpNumberOfBytesRead=0x2ae2a8*=0x17c, lpOverlapped=0x0) returned 1 [0129.669] CloseHandle (hObject=0x154) returned 1 [0129.681] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png", lpFilePart=0x0) returned 0x71 [0129.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.681] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbm7qdo[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.682] GetFileType (hFile=0x154) returned 0x1 [0129.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.682] GetFileType (hFile=0x154) returned 0x1 [0129.682] WriteFile (in: hFile=0x154, lpBuffer=0x1b27ce0*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b27ce0*, lpNumberOfBytesWritten=0x2ae270*=0x180, lpOverlapped=0x0) returned 1 [0129.683] CloseHandle (hObject=0x154) returned 1 [0129.683] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png", lpFilePart=0x0) returned 0x71 [0129.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0129.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbm7qdo[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6df750, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6df750, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xec3c0530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0129.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.684] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbm7qdo[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBm7qDo[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbm7qdo[1].png.anonymous")) returned 1 [0129.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png", lpFilePart=0x0) returned 0x71 [0129.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.685] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbs47te[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.685] GetFileType (hFile=0x154) returned 0x1 [0129.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.685] GetFileType (hFile=0x154) returned 0x1 [0129.685] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x23f [0129.685] ReadFile (in: hFile=0x154, lpBuffer=0x1b293bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b293bc*, lpNumberOfBytesRead=0x2ae2a8*=0x23f, lpOverlapped=0x0) returned 1 [0129.721] CloseHandle (hObject=0x154) returned 1 [0129.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png", lpFilePart=0x0) returned 0x71 [0129.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.738] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbs47te[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.739] GetFileType (hFile=0x154) returned 0x1 [0129.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.739] GetFileType (hFile=0x154) returned 0x1 [0129.739] WriteFile (in: hFile=0x154, lpBuffer=0x1b77e6c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b77e6c*, lpNumberOfBytesWritten=0x2ae270*=0x240, lpOverlapped=0x0) returned 1 [0129.740] CloseHandle (hObject=0x154) returned 1 [0129.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png", lpFilePart=0x0) returned 0x71 [0129.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0129.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbs47te[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b0ce300, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b0ce300, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec458ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0129.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.741] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbs47te[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBs47TE[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbs47te[1].png.anonymous")) returned 1 [0129.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png", lpFilePart=0x0) returned 0x71 [0129.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.741] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbxgaqg[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.742] GetFileType (hFile=0x154) returned 0x1 [0129.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.742] GetFileType (hFile=0x154) returned 0x1 [0129.742] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x28e9 [0129.742] ReadFile (in: hFile=0x154, lpBuffer=0x1b792fc, nNumberOfBytesToRead=0x28e9, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b792fc*, lpNumberOfBytesRead=0x2ae2a8*=0x28e9, lpOverlapped=0x0) returned 1 [0129.774] CloseHandle (hObject=0x154) returned 1 [0129.814] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png", lpFilePart=0x0) returned 0x71 [0129.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.814] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbxgaqg[1].png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.816] GetFileType (hFile=0x154) returned 0x1 [0129.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.816] GetFileType (hFile=0x154) returned 0x1 [0129.816] WriteFile (in: hFile=0x154, lpBuffer=0x19d2a80*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x19d2a80*, lpNumberOfBytesWritten=0x2ae29c*=0x28f0, lpOverlapped=0x0) returned 1 [0129.817] CloseHandle (hObject=0x154) returned 1 [0129.817] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png", lpFilePart=0x0) returned 0x71 [0129.817] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png.anonymous", lpFilePart=0x0) returned 0x7b [0129.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbxgaqg[1].png"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7da25590, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7da25590, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xec517190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x28f0)) returned 1 [0129.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.818] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbxgaqg[1].png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\BBxgAqg[1].png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\bbxgaqg[1].png.anonymous")) returned 1 [0129.818] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x79 [0129.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.819] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.819] GetFileType (hFile=0x154) returned 0x1 [0129.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.819] GetFileType (hFile=0x154) returned 0x1 [0129.819] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x7f78 [0129.819] ReadFile (in: hFile=0x154, lpBuffer=0x19d5a00, nNumberOfBytesToRead=0x7f78, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19d5a00*, lpNumberOfBytesRead=0x2ae2a8*=0x7f78, lpOverlapped=0x0) returned 1 [0129.839] CloseHandle (hObject=0x154) returned 1 [0129.854] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x79 [0129.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.854] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\fallback_728x90[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.856] GetFileType (hFile=0x154) returned 0x1 [0129.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.856] GetFileType (hFile=0x154) returned 0x1 [0129.856] WriteFile (in: hFile=0x154, lpBuffer=0x1a4a6c4*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1a4a6c4*, lpNumberOfBytesWritten=0x2ae29c*=0x7f80, lpOverlapped=0x0) returned 1 [0129.858] CloseHandle (hObject=0x154) returned 1 [0129.858] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x79 [0129.858] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg.anonymous", lpFilePart=0x0) returned 0x83 [0129.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\fallback_728x90[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b8b0be0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b8b0be0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec563450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7f80)) returned 1 [0129.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.858] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\fallback_728x90[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\fallback_728x90[1].jpg.anonymous")) returned 1 [0129.859] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x81 [0129.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0129.859] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\skyview_fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.859] GetFileType (hFile=0x154) returned 0x1 [0129.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0129.860] GetFileType (hFile=0x154) returned 0x1 [0129.860] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x5fb2 [0129.860] ReadFile (in: hFile=0x154, lpBuffer=0x1a52cdc, nNumberOfBytesToRead=0x5fb2, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a52cdc*, lpNumberOfBytesRead=0x2ae2a8*=0x5fb2, lpOverlapped=0x0) returned 1 [0129.926] CloseHandle (hObject=0x154) returned 1 [0129.939] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x81 [0129.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0129.939] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\skyview_fallback_728x90[1].jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.941] GetFileType (hFile=0x154) returned 0x1 [0129.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0129.941] GetFileType (hFile=0x154) returned 0x1 [0129.941] WriteFile (in: hFile=0x154, lpBuffer=0x1abd988*, nNumberOfBytesToWrite=0x5fc0, lpNumberOfBytesWritten=0x2ae29c, lpOverlapped=0x0 | out: lpBuffer=0x1abd988*, lpNumberOfBytesWritten=0x2ae29c*=0x5fc0, lpOverlapped=0x0) returned 1 [0129.942] CloseHandle (hObject=0x154) returned 1 [0129.942] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x81 [0129.942] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg.anonymous", lpFilePart=0x0) returned 0x8b [0129.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0129.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\skyview_fallback_728x90[1].jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a7e1080, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7a7e1080, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xec647c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5fc0)) returned 1 [0129.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.943] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\skyview_fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\XPUV5392\\Skyview_Fallback_728x90[1].jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\xpuv5392\\skyview_fallback_728x90[1].jpg.anonymous")) returned 1 [0129.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x55 [0129.943] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x56 [0129.943] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0129.944] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.944] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.944] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.944] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.944] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x55 [0129.944] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x56 [0129.945] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0129.945] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.945] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.945] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.945] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0129.945] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", lpFilePart=0x0) returned 0x57 [0129.945] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", lpFilePart=0x0) returned 0x58 [0129.945] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0129.946] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0129.946] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0129.946] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0129.946] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0129.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0129.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0129.946] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", lpFilePart=0x0) returned 0x57 [0129.947] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", lpFilePart=0x0) returned 0x58 [0129.947] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbea18 [0129.947] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0129.947] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0129.947] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0129.947] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0129.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0129.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0129.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", lpFilePart=0x0) returned 0x5d [0129.947] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", lpFilePart=0x0) returned 0x5e [0129.947] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea18 [0129.948] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0129.948] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0129.948] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0129.948] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0129.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0129.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0129.948] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", lpFilePart=0x0) returned 0x5d [0129.948] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", lpFilePart=0x0) returned 0x5e [0129.948] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbea18 [0129.948] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0129.948] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0129.949] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0129.949] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0129.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0129.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0129.949] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5", lpFilePart=0x0) returned 0x65 [0129.949] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\", lpFilePart=0x0) returned 0x66 [0129.949] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbea18 [0129.949] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0129.949] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0129.949] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0129.950] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0129.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0129.950] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5", lpFilePart=0x0) returned 0x65 [0129.950] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\", lpFilePart=0x0) returned 0x66 [0129.950] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbea18 [0129.950] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0129.950] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0129.950] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0129.950] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0129.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0129.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0129.950] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData", lpFilePart=0x0) returned 0x6d [0129.950] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\", lpFilePart=0x0) returned 0x6e [0129.951] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbea18 [0129.951] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0129.951] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0129.952] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0129.952] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0129.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0129.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0129.952] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData", lpFilePart=0x0) returned 0x6d [0129.952] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\", lpFilePart=0x0) returned 0x6e [0129.952] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbea18 [0129.952] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0129.952] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0129.952] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0129.952] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0129.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0129.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0129.953] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming", lpFilePart=0x0) returned 0x75 [0129.953] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x76 [0129.953] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbea18 [0129.953] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0129.953] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0129.953] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0129.953] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0129.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0129.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1d4) returned 1 [0129.953] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2adcdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming", lpFilePart=0x0) returned 0x75 [0129.953] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x2adcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x76 [0129.953] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\*", lpFindFileData=0x2adefc | out: lpFindFileData=0x2adefc) returned 0xbea18 [0129.954] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0129.954] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 1 [0129.954] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2adf0c | out: lpFindFileData=0x2adf0c) returned 0 [0129.954] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae194) returned 1 [0129.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1a0) returned 1 [0129.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae160) returned 1 [0129.954] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2adc68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x7f [0129.954] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2adc3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x80 [0129.954] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ade88 | out: lpFindFileData=0x2ade88) returned 0xbea18 [0129.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade98 | out: lpFindFileData=0x2ade98) returned 1 [0129.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade98 | out: lpFindFileData=0x2ade98) returned 1 [0129.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade98 | out: lpFindFileData=0x2ade98) returned 0 [0129.955] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae120) returned 1 [0129.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae12c) returned 1 [0129.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae160) returned 1 [0129.955] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2adc68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x7f [0129.955] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2adc3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x80 [0129.955] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ade88 | out: lpFindFileData=0x2ade88) returned 0xbea18 [0129.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade98 | out: lpFindFileData=0x2ade98) returned 1 [0129.955] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade98 | out: lpFindFileData=0x2ade98) returned 1 [0129.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade98 | out: lpFindFileData=0x2ade98) returned 0 [0129.956] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae120) returned 1 [0129.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae12c) returned 1 [0129.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0ec) returned 1 [0129.956] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2adbf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x87 [0129.956] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adbc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x88 [0129.956] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ade14 | out: lpFindFileData=0x2ade14) returned 0xbea18 [0129.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade24 | out: lpFindFileData=0x2ade24) returned 1 [0129.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade24 | out: lpFindFileData=0x2ade24) returned 1 [0129.956] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade24 | out: lpFindFileData=0x2ade24) returned 0 [0129.956] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0ac) returned 1 [0129.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0b8) returned 1 [0129.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae0ec) returned 1 [0129.957] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2adbf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x87 [0129.957] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adbc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x88 [0129.957] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ade14 | out: lpFindFileData=0x2ade14) returned 0xbea18 [0129.957] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade24 | out: lpFindFileData=0x2ade24) returned 1 [0129.957] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade24 | out: lpFindFileData=0x2ade24) returned 1 [0129.957] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ade24 | out: lpFindFileData=0x2ade24) returned 0 [0129.957] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0ac) returned 1 [0129.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae0b8) returned 1 [0129.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae078) returned 1 [0129.957] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x2adb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x90 [0129.957] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x2adb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x91 [0129.957] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2adda0 | out: lpFindFileData=0x2adda0) returned 0xbea18 [0129.958] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2addb0 | out: lpFindFileData=0x2addb0) returned 1 [0129.958] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2addb0 | out: lpFindFileData=0x2addb0) returned 1 [0129.958] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2addb0 | out: lpFindFileData=0x2addb0) returned 0 [0129.958] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae038) returned 1 [0129.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae044) returned 1 [0129.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae078) returned 1 [0129.959] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x2adb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x90 [0129.959] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x2adb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x91 [0129.959] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2adda0 | out: lpFindFileData=0x2adda0) returned 0xbea18 [0129.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2addb0 | out: lpFindFileData=0x2addb0) returned 1 [0129.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2addb0 | out: lpFindFileData=0x2addb0) returned 1 [0129.959] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2addb0 | out: lpFindFileData=0x2addb0) returned 0 [0129.959] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae038) returned 1 [0129.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae044) returned 1 [0129.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae004) returned 1 [0129.959] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x2adb0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x94 [0129.959] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x2adae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x95 [0129.959] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2add2c | out: lpFindFileData=0x2add2c) returned 0xbea18 [0129.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2add3c | out: lpFindFileData=0x2add3c) returned 1 [0129.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2add3c | out: lpFindFileData=0x2add3c) returned 0 [0129.960] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2adfc4) returned 1 [0129.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2adfd0) returned 1 [0129.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae004) returned 1 [0129.960] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x2adb0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x94 [0129.960] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x2adae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x95 [0129.960] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2add2c | out: lpFindFileData=0x2add2c) returned 0xbea18 [0129.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2add3c | out: lpFindFileData=0x2add3c) returned 1 [0129.960] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2add3c | out: lpFindFileData=0x2add3c) returned 0 [0129.961] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2adfc4) returned 1 [0129.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2adfd0) returned 1 [0129.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.961] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x37 [0129.961] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x38 [0129.961] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0129.963] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.963] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.963] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0129.963] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0129.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.963] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x37 [0129.963] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x38 [0129.963] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0129.963] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.964] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0129.964] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0129.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x34 [0129.964] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x35 [0129.964] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0129.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0129.965] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0129.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.965] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x34 [0129.965] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x35 [0129.965] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0129.965] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.966] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.966] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.966] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0129.966] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0129.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.966] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x38 [0129.966] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x39 [0129.966] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0129.966] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.967] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.967] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.967] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x38 [0129.967] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x39 [0129.967] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0129.967] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.967] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.967] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.967] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x42 [0129.967] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x43 [0129.967] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0129.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.968] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.968] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x42 [0129.968] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x43 [0129.968] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0129.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.968] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.969] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0129.969] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x35 [0129.969] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x36 [0129.969] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0129.971] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.971] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.972] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.973] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.973] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.973] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0129.973] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0129.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0129.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0129.974] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x35 [0129.974] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x36 [0129.974] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbea18 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.975] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.976] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0129.976] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0129.976] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0129.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0129.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0129.977] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFilePart=0x0) returned 0x3f [0129.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0129.977] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.978] GetFileType (hFile=0x154) returned 0x1 [0129.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0129.978] GetFileType (hFile=0x154) returned 0x1 [0129.978] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x104 [0129.978] ReadFile (in: hFile=0x154, lpBuffer=0x1ae38a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ae38a4*, lpNumberOfBytesRead=0x2ae478*=0x104, lpOverlapped=0x0) returned 1 [0129.979] CloseHandle (hObject=0x154) returned 1 [0129.993] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFilePart=0x0) returned 0x3f [0129.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0129.993] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0129.994] GetFileType (hFile=0x154) returned 0x1 [0129.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0129.994] GetFileType (hFile=0x154) returned 0x1 [0129.994] WriteFile (in: hFile=0x154, lpBuffer=0x1b31cfc*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b31cfc*, lpNumberOfBytesWritten=0x2ae440*=0x110, lpOverlapped=0x0) returned 1 [0129.995] CloseHandle (hObject=0x154) returned 1 [0129.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFilePart=0x0) returned 0x3f [0129.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.anonymous", lpFilePart=0x0) returned 0x49 [0129.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0129.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8fa33d0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8fa33d0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec6ba0b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0129.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.996] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\oeold.xml.anonymous")) returned 1 [0129.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x3c [0129.997] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x3d [0129.997] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0129.997] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.997] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.997] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0129.997] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0129.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0129.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x3c [0129.997] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x3d [0129.997] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0129.997] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.997] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0129.998] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0129.998] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0129.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0129.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0129.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.998] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x40 [0129.998] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpFilePart=0x0) returned 0x41 [0129.998] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0129.998] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.998] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.998] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.998] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.998] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.998] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0129.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0129.998] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x40 [0129.998] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpFilePart=0x0) returned 0x41 [0129.998] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0129.999] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.999] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.999] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.999] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0129.999] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0129.999] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0129.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0129.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0129.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0129.999] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x40 [0129.999] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x41 [0129.999] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.011] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.012] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0130.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.013] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x40 [0130.013] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x41 [0130.013] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.014] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.014] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0130.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.015] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a [0130.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.016] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.017] GetFileType (hFile=0x154) returned 0x1 [0130.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.017] GetFileType (hFile=0x154) returned 0x1 [0130.017] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x432 [0130.017] ReadFile (in: hFile=0x154, lpBuffer=0x1b3cad0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3cad0*, lpNumberOfBytesRead=0x2ae404*=0x432, lpOverlapped=0x0) returned 1 [0130.044] CloseHandle (hObject=0x154) returned 1 [0130.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a [0130.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.084] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.085] GetFileType (hFile=0x154) returned 0x1 [0130.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.085] GetFileType (hFile=0x154) returned 0x1 [0130.085] WriteFile (in: hFile=0x154, lpBuffer=0x198b2b4*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x198b2b4*, lpNumberOfBytesWritten=0x2ae3cc*=0x440, lpOverlapped=0x0) returned 1 [0130.086] CloseHandle (hObject=0x154) returned 1 [0130.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a [0130.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.anonymous", lpFilePart=0x0) returned 0x54 [0130.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8fa33d0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8fa33d0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec79e8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x440)) returned 1 [0130.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.087] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.anonymous")) returned 1 [0130.088] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b [0130.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.088] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.088] GetFileType (hFile=0x154) returned 0x1 [0130.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.089] GetFileType (hFile=0x154) returned 0x1 [0130.089] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5d3f [0130.089] ReadFile (in: hFile=0x154, lpBuffer=0x198c63c, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x198c63c*, lpNumberOfBytesRead=0x2ae404*=0x5d3f, lpOverlapped=0x0) returned 1 [0130.104] CloseHandle (hObject=0x154) returned 1 [0130.119] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b [0130.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.119] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.121] GetFileType (hFile=0x154) returned 0x1 [0130.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.121] GetFileType (hFile=0x154) returned 0x1 [0130.121] WriteFile (in: hFile=0x154, lpBuffer=0x19f67c4*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19f67c4*, lpNumberOfBytesWritten=0x2ae3f8*=0x5d40, lpOverlapped=0x0) returned 1 [0130.122] CloseHandle (hObject=0x154) returned 1 [0130.122] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b [0130.122] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.anonymous", lpFilePart=0x0) returned 0x55 [0130.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec7eabb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5d40)) returned 1 [0130.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.122] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.anonymous")) returned 1 [0130.123] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51 [0130.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.123] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.123] GetFileType (hFile=0x154) returned 0x1 [0130.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.123] GetFileType (hFile=0x154) returned 0x1 [0130.123] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1906 [0130.123] ReadFile (in: hFile=0x154, lpBuffer=0x19fc9b0, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fc9b0*, lpNumberOfBytesRead=0x2ae404*=0x1906, lpOverlapped=0x0) returned 1 [0130.140] CloseHandle (hObject=0x154) returned 1 [0130.152] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51 [0130.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.152] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.154] GetFileType (hFile=0x154) returned 0x1 [0130.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.154] GetFileType (hFile=0x154) returned 0x1 [0130.154] WriteFile (in: hFile=0x154, lpBuffer=0x1a514ec*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a514ec*, lpNumberOfBytesWritten=0x2ae3f8*=0x1910, lpOverlapped=0x0) returned 1 [0130.155] CloseHandle (hObject=0x154) returned 1 [0130.155] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51 [0130.155] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0130.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec836e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1910)) returned 1 [0130.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.155] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.anonymous")) returned 1 [0130.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f [0130.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.156] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.157] GetFileType (hFile=0x154) returned 0x1 [0130.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.157] GetFileType (hFile=0x154) returned 0x1 [0130.157] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x107e [0130.157] ReadFile (in: hFile=0x154, lpBuffer=0x1a532dc, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a532dc*, lpNumberOfBytesRead=0x2ae404*=0x107e, lpOverlapped=0x0) returned 1 [0130.174] CloseHandle (hObject=0x154) returned 1 [0130.187] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f [0130.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.187] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.189] GetFileType (hFile=0x154) returned 0x1 [0130.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.189] GetFileType (hFile=0x154) returned 0x1 [0130.189] WriteFile (in: hFile=0x154, lpBuffer=0x1aa5348*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aa5348*, lpNumberOfBytesWritten=0x2ae3f8*=0x1080, lpOverlapped=0x0) returned 1 [0130.190] CloseHandle (hObject=0x154) returned 1 [0130.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f [0130.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.anonymous", lpFilePart=0x0) returned 0x59 [0130.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.190] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec8a9290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1080)) returned 1 [0130.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.190] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.anonymous")) returned 1 [0130.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52 [0130.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.191] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.191] GetFileType (hFile=0x154) returned 0x1 [0130.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.192] GetFileType (hFile=0x154) returned 0x1 [0130.192] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x18ed [0130.192] ReadFile (in: hFile=0x154, lpBuffer=0x1aa68a0, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa68a0*, lpNumberOfBytesRead=0x2ae404*=0x18ed, lpOverlapped=0x0) returned 1 [0130.193] CloseHandle (hObject=0x154) returned 1 [0130.205] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52 [0130.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.205] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.206] GetFileType (hFile=0x154) returned 0x1 [0130.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.206] GetFileType (hFile=0x154) returned 0x1 [0130.206] WriteFile (in: hFile=0x154, lpBuffer=0x1afb33c*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1afb33c*, lpNumberOfBytesWritten=0x2ae3f8*=0x18f0, lpOverlapped=0x0) returned 1 [0130.208] CloseHandle (hObject=0x154) returned 1 [0130.208] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52 [0130.208] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.anonymous", lpFilePart=0x0) returned 0x5c [0130.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.208] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec8cf3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18f0)) returned 1 [0130.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.208] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.anonymous")) returned 1 [0130.209] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c [0130.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.209] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.209] GetFileType (hFile=0x154) returned 0x1 [0130.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.209] GetFileType (hFile=0x154) returned 0x1 [0130.209] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13fb [0130.209] ReadFile (in: hFile=0x154, lpBuffer=0x1afd110, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1afd110*, lpNumberOfBytesRead=0x2ae404*=0x13fb, lpOverlapped=0x0) returned 1 [0130.231] CloseHandle (hObject=0x154) returned 1 [0130.243] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c [0130.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.243] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.245] GetFileType (hFile=0x154) returned 0x1 [0130.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.245] GetFileType (hFile=0x154) returned 0x1 [0130.245] WriteFile (in: hFile=0x154, lpBuffer=0x1b502fc*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b502fc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1400, lpOverlapped=0x0) returned 1 [0130.246] CloseHandle (hObject=0x154) returned 1 [0130.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c [0130.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.anonymous", lpFilePart=0x0) returned 0x56 [0130.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xec91b6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1 [0130.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.246] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.anonymous")) returned 1 [0130.247] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a [0130.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.247] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.248] GetFileType (hFile=0x154) returned 0x1 [0130.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.248] GetFileType (hFile=0x154) returned 0x1 [0130.248] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x780 [0130.248] ReadFile (in: hFile=0x154, lpBuffer=0x1b52328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b52328*, lpNumberOfBytesRead=0x2ae404*=0x780, lpOverlapped=0x0) returned 1 [0130.325] CloseHandle (hObject=0x154) returned 1 [0130.362] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a [0130.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.362] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.363] GetFileType (hFile=0x154) returned 0x1 [0130.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.363] GetFileType (hFile=0x154) returned 0x1 [0130.363] WriteFile (in: hFile=0x154, lpBuffer=0x19a2ba4*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a2ba4*, lpNumberOfBytesWritten=0x2ae3cc*=0x790, lpOverlapped=0x0) returned 1 [0130.364] CloseHandle (hObject=0x154) returned 1 [0130.364] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a [0130.364] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.anonymous", lpFilePart=0x0) returned 0x54 [0130.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.365] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xeca4c1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x790)) returned 1 [0130.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.365] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.anonymous")) returned 1 [0130.365] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51 [0130.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.365] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.366] GetFileType (hFile=0x154) returned 0x1 [0130.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.366] GetFileType (hFile=0x154) returned 0x1 [0130.366] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x127e [0130.366] ReadFile (in: hFile=0x154, lpBuffer=0x19a3f2c, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a3f2c*, lpNumberOfBytesRead=0x2ae404*=0x127e, lpOverlapped=0x0) returned 1 [0130.368] CloseHandle (hObject=0x154) returned 1 [0130.380] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51 [0130.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.380] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.382] GetFileType (hFile=0x154) returned 0x1 [0130.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.382] GetFileType (hFile=0x154) returned 0x1 [0130.382] WriteFile (in: hFile=0x154, lpBuffer=0x19f6af4*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19f6af4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1280, lpOverlapped=0x0) returned 1 [0130.383] CloseHandle (hObject=0x154) returned 1 [0130.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51 [0130.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0130.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xeca72310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1280)) returned 1 [0130.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.384] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.anonymous")) returned 1 [0130.384] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d [0130.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.384] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.385] GetFileType (hFile=0x154) returned 0x1 [0130.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.385] GetFileType (hFile=0x154) returned 0x1 [0130.385] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2949 [0130.385] ReadFile (in: hFile=0x154, lpBuffer=0x19f824c, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f824c*, lpNumberOfBytesRead=0x2ae404*=0x2949, lpOverlapped=0x0) returned 1 [0130.386] CloseHandle (hObject=0x154) returned 1 [0130.399] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d [0130.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.399] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.401] GetFileType (hFile=0x154) returned 0x1 [0130.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.401] GetFileType (hFile=0x154) returned 0x1 [0130.401] WriteFile (in: hFile=0x154, lpBuffer=0x1a51ec8*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a51ec8*, lpNumberOfBytesWritten=0x2ae3f8*=0x2950, lpOverlapped=0x0) returned 1 [0130.402] CloseHandle (hObject=0x154) returned 1 [0130.402] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d [0130.402] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.anonymous", lpFilePart=0x0) returned 0x57 [0130.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f7d270, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f7d270, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xeca98470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2950)) returned 1 [0130.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.402] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.anonymous")) returned 1 [0130.403] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a [0130.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0130.403] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.404] GetFileType (hFile=0x154) returned 0x1 [0130.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0130.404] GetFileType (hFile=0x154) returned 0x1 [0130.404] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1d51 [0130.404] ReadFile (in: hFile=0x154, lpBuffer=0x1a54cbc, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a54cbc*, lpNumberOfBytesRead=0x2ae404*=0x1d51, lpOverlapped=0x0) returned 1 [0130.405] CloseHandle (hObject=0x154) returned 1 [0130.417] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a [0130.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0130.417] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.419] GetFileType (hFile=0x154) returned 0x1 [0130.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0130.419] GetFileType (hFile=0x154) returned 0x1 [0130.419] WriteFile (in: hFile=0x154, lpBuffer=0x1aaad88*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aaad88*, lpNumberOfBytesWritten=0x2ae3f8*=0x1d60, lpOverlapped=0x0) returned 1 [0130.420] CloseHandle (hObject=0x154) returned 1 [0130.420] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a [0130.420] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.anonymous", lpFilePart=0x0) returned 0x54 [0130.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0130.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f57110, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f57110, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xecabe5d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d60)) returned 1 [0130.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.420] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.anonymous")) returned 1 [0130.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0130.421] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x36 [0130.421] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x37 [0130.421] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0130.421] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.422] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.422] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0130.422] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0130.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0130.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0130.422] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x36 [0130.422] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x37 [0130.422] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0130.422] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.422] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.423] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0130.423] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0130.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0130.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.423] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x3b [0130.423] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x3c [0130.423] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0130.423] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.423] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.423] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.423] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.423] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.424] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x3b [0130.424] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x3c [0130.424] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0130.424] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.424] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.424] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.424] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.424] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0130.425] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38 [0130.425] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x39 [0130.425] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0130.425] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.425] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.425] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.425] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0130.425] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0130.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0130.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0130.426] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38 [0130.426] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x39 [0130.426] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0130.426] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.426] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.426] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.426] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0130.426] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0130.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0130.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.426] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40 [0130.426] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x41 [0130.427] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0130.427] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.427] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.427] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.427] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40 [0130.427] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x41 [0130.427] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0130.427] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.427] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.428] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0130.428] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x2d [0130.428] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x2e [0130.428] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0130.428] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.428] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0130.428] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0130.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0130.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0130.429] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x2d [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x2e [0130.429] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0130.429] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.429] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0130.429] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0130.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0130.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0130.429] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x26 [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x27 [0130.429] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0130.430] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.430] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.430] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.430] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0130.430] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0130.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0130.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0130.430] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x26 [0130.430] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x27 [0130.430] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0130.430] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.431] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.431] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0130.431] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0130.431] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0130.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0130.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0130.431] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x2e [0130.431] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x2f [0130.431] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0130.431] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.431] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.432] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0130.432] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0130.432] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x2e [0130.432] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x2f [0130.432] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0130.432] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.432] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0130.432] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0130.432] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.432] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x37 [0130.432] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x38 [0130.433] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0130.433] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.433] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.433] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.433] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0130.433] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x37 [0130.433] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x38 [0130.433] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0130.434] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.434] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0130.434] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0130.434] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0130.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0130.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0130.434] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpFilePart=0x0) returned 0x48 [0130.434] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpFilePart=0x0) returned 0x49 [0130.434] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0130.452] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.452] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.452] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.453] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.453] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.453] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.453] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.453] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0130.454] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0130.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0130.455] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpFilePart=0x0) returned 0x48 [0130.455] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpFilePart=0x0) returned 0x49 [0130.455] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0130.456] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0130.457] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0130.457] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0130.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0130.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0130.459] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache", lpFilePart=0x0) returned 0x4e [0130.459] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\", lpFilePart=0x0) returned 0x4f [0130.459] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.480] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.481] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.482] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.482] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.482] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0130.482] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0130.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0130.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0130.483] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache", lpFilePart=0x0) returned 0x4e [0130.483] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\", lpFilePart=0x0) returned 0x4f [0130.483] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.484] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.484] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.484] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.484] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.485] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.486] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.486] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.486] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.486] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.486] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0130.486] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0130.486] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0130.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0130.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0", lpFilePart=0x0) returned 0x50 [0130.487] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\", lpFilePart=0x0) returned 0x51 [0130.487] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.494] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.494] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.494] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0", lpFilePart=0x0) returned 0x50 [0130.494] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\", lpFilePart=0x0) returned 0x51 [0130.494] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.495] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.495] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B", lpFilePart=0x0) returned 0x53 [0130.495] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B\\", lpFilePart=0x0) returned 0x54 [0130.495] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.496] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.496] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.496] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.496] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B", lpFilePart=0x0) returned 0x53 [0130.496] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B\\", lpFilePart=0x0) returned 0x54 [0130.496] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\2B\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.496] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.496] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.496] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.496] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98", lpFilePart=0x0) returned 0x53 [0130.496] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98\\", lpFilePart=0x0) returned 0x54 [0130.496] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.497] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.497] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.497] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.497] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.497] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98", lpFilePart=0x0) returned 0x53 [0130.497] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98\\", lpFilePart=0x0) returned 0x54 [0130.497] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\98\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.498] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.498] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.498] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.498] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8", lpFilePart=0x0) returned 0x53 [0130.498] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8\\", lpFilePart=0x0) returned 0x54 [0130.498] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.521] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.521] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.521] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.521] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8", lpFilePart=0x0) returned 0x53 [0130.522] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8\\", lpFilePart=0x0) returned 0x54 [0130.522] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\A8\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.522] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.522] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.522] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.522] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB", lpFilePart=0x0) returned 0x53 [0130.522] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB\\", lpFilePart=0x0) returned 0x54 [0130.522] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.523] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.523] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.523] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.523] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.523] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB", lpFilePart=0x0) returned 0x53 [0130.523] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB\\", lpFilePart=0x0) returned 0x54 [0130.523] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\CB\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.523] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.523] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.523] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.523] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.523] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4", lpFilePart=0x0) returned 0x53 [0130.524] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4\\", lpFilePart=0x0) returned 0x54 [0130.524] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.524] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.524] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.524] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.524] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.524] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4", lpFilePart=0x0) returned 0x53 [0130.524] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4\\", lpFilePart=0x0) returned 0x54 [0130.524] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\0\\F4\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.525] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.525] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1", lpFilePart=0x0) returned 0x50 [0130.525] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\", lpFilePart=0x0) returned 0x51 [0130.525] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.525] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.525] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.526] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1", lpFilePart=0x0) returned 0x50 [0130.526] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\", lpFilePart=0x0) returned 0x51 [0130.526] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.526] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.526] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.526] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.526] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.526] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.526] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.526] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03", lpFilePart=0x0) returned 0x53 [0130.526] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03\\", lpFilePart=0x0) returned 0x54 [0130.526] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.527] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.527] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.527] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.527] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.527] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03", lpFilePart=0x0) returned 0x53 [0130.527] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03\\", lpFilePart=0x0) returned 0x54 [0130.527] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\03\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.527] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.527] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.527] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.527] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.528] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2", lpFilePart=0x0) returned 0x53 [0130.528] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2\\", lpFilePart=0x0) returned 0x54 [0130.528] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.528] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.528] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.528] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.528] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.528] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2", lpFilePart=0x0) returned 0x53 [0130.528] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2\\", lpFilePart=0x0) returned 0x54 [0130.529] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\C2\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.529] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.529] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.529] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.529] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.529] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6", lpFilePart=0x0) returned 0x53 [0130.529] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6\\", lpFilePart=0x0) returned 0x54 [0130.529] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.530] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.530] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.530] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.530] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.530] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6", lpFilePart=0x0) returned 0x53 [0130.530] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6\\", lpFilePart=0x0) returned 0x54 [0130.530] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\1\\F6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.530] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.530] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.530] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.530] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.530] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2", lpFilePart=0x0) returned 0x50 [0130.530] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\", lpFilePart=0x0) returned 0x51 [0130.530] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.531] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.531] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.531] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.531] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.531] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2", lpFilePart=0x0) returned 0x50 [0130.531] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\", lpFilePart=0x0) returned 0x51 [0130.531] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.531] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.531] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.531] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.531] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.532] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36", lpFilePart=0x0) returned 0x53 [0130.532] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36\\", lpFilePart=0x0) returned 0x54 [0130.532] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.532] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.533] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.533] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.533] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.533] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36", lpFilePart=0x0) returned 0x53 [0130.533] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36\\", lpFilePart=0x0) returned 0x54 [0130.533] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\2\\36\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.533] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.533] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.533] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.533] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.533] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3", lpFilePart=0x0) returned 0x50 [0130.534] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\", lpFilePart=0x0) returned 0x51 [0130.534] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.534] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.534] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.534] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.534] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.534] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.534] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3", lpFilePart=0x0) returned 0x50 [0130.534] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\", lpFilePart=0x0) returned 0x51 [0130.534] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.535] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.535] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.535] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.535] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.535] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.535] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A", lpFilePart=0x0) returned 0x53 [0130.535] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A\\", lpFilePart=0x0) returned 0x54 [0130.535] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.536] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.536] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.536] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.536] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.536] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A", lpFilePart=0x0) returned 0x53 [0130.536] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A\\", lpFilePart=0x0) returned 0x54 [0130.536] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\9A\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.537] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.537] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.537] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.537] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.537] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA", lpFilePart=0x0) returned 0x53 [0130.537] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA\\", lpFilePart=0x0) returned 0x54 [0130.537] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.538] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.538] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.538] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.538] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.538] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA", lpFilePart=0x0) returned 0x53 [0130.538] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA\\", lpFilePart=0x0) returned 0x54 [0130.538] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\3\\DA\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.538] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.539] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.539] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.539] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.539] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4", lpFilePart=0x0) returned 0x50 [0130.539] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\", lpFilePart=0x0) returned 0x51 [0130.539] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.540] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.540] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.540] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.540] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.540] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.540] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.540] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4", lpFilePart=0x0) returned 0x50 [0130.540] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\", lpFilePart=0x0) returned 0x51 [0130.540] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.540] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.541] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.541] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.541] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.541] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.541] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.541] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC", lpFilePart=0x0) returned 0x53 [0130.541] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC\\", lpFilePart=0x0) returned 0x54 [0130.541] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.542] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.542] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.542] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.542] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.542] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC", lpFilePart=0x0) returned 0x53 [0130.542] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC\\", lpFilePart=0x0) returned 0x54 [0130.542] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EC\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.542] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.543] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.543] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.543] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.543] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE", lpFilePart=0x0) returned 0x53 [0130.543] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE\\", lpFilePart=0x0) returned 0x54 [0130.543] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.544] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.544] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.544] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.544] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.544] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE", lpFilePart=0x0) returned 0x53 [0130.544] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE\\", lpFilePart=0x0) returned 0x54 [0130.544] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\EE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.544] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.545] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.545] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.545] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.545] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD", lpFilePart=0x0) returned 0x53 [0130.545] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD\\", lpFilePart=0x0) returned 0x54 [0130.545] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.545] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.545] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.545] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.545] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.546] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD", lpFilePart=0x0) returned 0x53 [0130.546] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD\\", lpFilePart=0x0) returned 0x54 [0130.546] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\4\\FD\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.546] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.546] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.546] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0130.546] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.546] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5", lpFilePart=0x0) returned 0x50 [0130.546] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\", lpFilePart=0x0) returned 0x51 [0130.546] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.547] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.547] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.547] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.547] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.547] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5", lpFilePart=0x0) returned 0x50 [0130.547] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\", lpFilePart=0x0) returned 0x51 [0130.547] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.547] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.547] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0130.547] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0130.547] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.547] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1", lpFilePart=0x0) returned 0x53 [0130.548] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1\\", lpFilePart=0x0) returned 0x54 [0130.548] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.548] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0130.548] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1", lpFilePart=0x0) returned 0x53 [0130.548] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1\\", lpFilePart=0x0) returned 0x54 [0130.548] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\5\\F1\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.548] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6", lpFilePart=0x0) returned 0x50 [0130.548] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6\\", lpFilePart=0x0) returned 0x51 [0130.549] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.549] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6", lpFilePart=0x0) returned 0x50 [0130.549] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6\\", lpFilePart=0x0) returned 0x51 [0130.549] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\6\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.549] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7", lpFilePart=0x0) returned 0x50 [0130.549] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\", lpFilePart=0x0) returned 0x51 [0130.549] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.550] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7", lpFilePart=0x0) returned 0x50 [0130.551] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\", lpFilePart=0x0) returned 0x51 [0130.551] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.551] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D", lpFilePart=0x0) returned 0x53 [0130.551] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D\\", lpFilePart=0x0) returned 0x54 [0130.551] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.552] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.552] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D", lpFilePart=0x0) returned 0x53 [0130.552] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D\\", lpFilePart=0x0) returned 0x54 [0130.552] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\1D\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.552] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.552] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26", lpFilePart=0x0) returned 0x53 [0130.552] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26\\", lpFilePart=0x0) returned 0x54 [0130.553] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.553] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.553] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26", lpFilePart=0x0) returned 0x53 [0130.553] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26\\", lpFilePart=0x0) returned 0x54 [0130.553] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\26\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.553] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.553] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B", lpFilePart=0x0) returned 0x53 [0130.553] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B\\", lpFilePart=0x0) returned 0x54 [0130.553] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.554] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.554] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B", lpFilePart=0x0) returned 0x53 [0130.554] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B\\", lpFilePart=0x0) returned 0x54 [0130.554] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\5B\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.554] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.554] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6", lpFilePart=0x0) returned 0x53 [0130.554] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6\\", lpFilePart=0x0) returned 0x54 [0130.554] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.555] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0130.555] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6", lpFilePart=0x0) returned 0x53 [0130.555] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6\\", lpFilePart=0x0) returned 0x54 [0130.555] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\7\\D6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.555] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0130.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0130.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.555] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8", lpFilePart=0x0) returned 0x50 [0130.555] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\", lpFilePart=0x0) returned 0x51 [0130.555] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.556] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0130.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0130.556] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8", lpFilePart=0x0) returned 0x50 [0130.556] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\", lpFilePart=0x0) returned 0x51 [0130.556] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.556] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0130.556] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE", lpFilePart=0x0) returned 0x53 [0130.556] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE\\", lpFilePart=0x0) returned 0x54 [0130.556] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.556] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE", lpFilePart=0x0) returned 0x53 [0130.557] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE\\", lpFilePart=0x0) returned 0x54 [0130.557] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\8\\AE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.557] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9", lpFilePart=0x0) returned 0x50 [0130.557] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\", lpFilePart=0x0) returned 0x51 [0130.557] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.557] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9", lpFilePart=0x0) returned 0x50 [0130.557] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\", lpFilePart=0x0) returned 0x51 [0130.557] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.557] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10", lpFilePart=0x0) returned 0x53 [0130.557] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10\\", lpFilePart=0x0) returned 0x54 [0130.557] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.558] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.558] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10", lpFilePart=0x0) returned 0x53 [0130.558] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10\\", lpFilePart=0x0) returned 0x54 [0130.558] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\10\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.558] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.558] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C", lpFilePart=0x0) returned 0x53 [0130.558] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C\\", lpFilePart=0x0) returned 0x54 [0130.559] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.559] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.559] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C", lpFilePart=0x0) returned 0x53 [0130.559] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C\\", lpFilePart=0x0) returned 0x54 [0130.559] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\2C\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.559] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.559] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49", lpFilePart=0x0) returned 0x53 [0130.559] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49\\", lpFilePart=0x0) returned 0x54 [0130.559] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.560] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49", lpFilePart=0x0) returned 0x53 [0130.560] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49\\", lpFilePart=0x0) returned 0x54 [0130.560] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\49\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.560] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61", lpFilePart=0x0) returned 0x53 [0130.560] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61\\", lpFilePart=0x0) returned 0x54 [0130.560] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.560] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61", lpFilePart=0x0) returned 0x53 [0130.561] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61\\", lpFilePart=0x0) returned 0x54 [0130.561] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\61\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.561] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D", lpFilePart=0x0) returned 0x53 [0130.561] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D\\", lpFilePart=0x0) returned 0x54 [0130.561] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.561] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D", lpFilePart=0x0) returned 0x53 [0130.561] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D\\", lpFilePart=0x0) returned 0x54 [0130.561] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\8D\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.561] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0", lpFilePart=0x0) returned 0x53 [0130.562] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0\\", lpFilePart=0x0) returned 0x54 [0130.562] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.562] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0", lpFilePart=0x0) returned 0x53 [0130.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0\\", lpFilePart=0x0) returned 0x54 [0130.563] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\9\\E0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.563] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A", lpFilePart=0x0) returned 0x50 [0130.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\", lpFilePart=0x0) returned 0x51 [0130.563] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.563] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A", lpFilePart=0x0) returned 0x50 [0130.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\", lpFilePart=0x0) returned 0x51 [0130.563] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.563] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6", lpFilePart=0x0) returned 0x53 [0130.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6\\", lpFilePart=0x0) returned 0x54 [0130.564] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.564] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6", lpFilePart=0x0) returned 0x53 [0130.564] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6\\", lpFilePart=0x0) returned 0x54 [0130.564] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\B6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.564] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE", lpFilePart=0x0) returned 0x53 [0130.564] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE\\", lpFilePart=0x0) returned 0x54 [0130.565] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.565] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE", lpFilePart=0x0) returned 0x53 [0130.565] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE\\", lpFilePart=0x0) returned 0x54 [0130.565] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\A\\CE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.565] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B", lpFilePart=0x0) returned 0x50 [0130.565] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\", lpFilePart=0x0) returned 0x51 [0130.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.566] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B", lpFilePart=0x0) returned 0x50 [0130.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\", lpFilePart=0x0) returned 0x51 [0130.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.566] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C", lpFilePart=0x0) returned 0x53 [0130.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C\\", lpFilePart=0x0) returned 0x54 [0130.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.567] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C", lpFilePart=0x0) returned 0x53 [0130.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C\\", lpFilePart=0x0) returned 0x54 [0130.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\2C\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.567] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64", lpFilePart=0x0) returned 0x53 [0130.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64\\", lpFilePart=0x0) returned 0x54 [0130.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.568] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64", lpFilePart=0x0) returned 0x53 [0130.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64\\", lpFilePart=0x0) returned 0x54 [0130.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\64\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.568] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5", lpFilePart=0x0) returned 0x53 [0130.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5\\", lpFilePart=0x0) returned 0x54 [0130.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.568] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5", lpFilePart=0x0) returned 0x53 [0130.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5\\", lpFilePart=0x0) returned 0x54 [0130.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\B\\E5\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.569] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C", lpFilePart=0x0) returned 0x50 [0130.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\", lpFilePart=0x0) returned 0x51 [0130.569] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.569] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C", lpFilePart=0x0) returned 0x50 [0130.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\", lpFilePart=0x0) returned 0x51 [0130.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.570] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F", lpFilePart=0x0) returned 0x53 [0130.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F\\", lpFilePart=0x0) returned 0x54 [0130.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.570] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F", lpFilePart=0x0) returned 0x53 [0130.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F\\", lpFilePart=0x0) returned 0x54 [0130.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\1F\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.571] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6", lpFilePart=0x0) returned 0x53 [0130.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6\\", lpFilePart=0x0) returned 0x54 [0130.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.571] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6", lpFilePart=0x0) returned 0x53 [0130.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6\\", lpFilePart=0x0) returned 0x54 [0130.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\C\\F6\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.571] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D", lpFilePart=0x0) returned 0x50 [0130.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\", lpFilePart=0x0) returned 0x51 [0130.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.572] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D", lpFilePart=0x0) returned 0x50 [0130.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\", lpFilePart=0x0) returned 0x51 [0130.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.572] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07", lpFilePart=0x0) returned 0x53 [0130.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07\\", lpFilePart=0x0) returned 0x54 [0130.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.572] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07", lpFilePart=0x0) returned 0x53 [0130.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07\\", lpFilePart=0x0) returned 0x54 [0130.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\07\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.573] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\08", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\08", lpFilePart=0x0) returned 0x53 [0130.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\08\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\08\\", lpFilePart=0x0) returned 0x54 [0130.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\08\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.573] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\08\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.574] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\46\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.574] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\46\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.574] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\99\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.575] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\99\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.575] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\FE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.575] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\D\\FE\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.575] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\E\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.576] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\E\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.576] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\E\\69\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.580] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.580] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\E\\69\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.580] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.580] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\E\\B3\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.581] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\E\\B3\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.581] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\F\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.581] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\F\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0130.581] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\F\\23\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.581] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\F\\23\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.582] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\F\\F0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.582] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\Cache\\F\\F0\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0130.583] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\OfflineCache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.583] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\OfflineCache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.583] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\safebrowsing\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.594] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\safebrowsing\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.596] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\startupCache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.598] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\startupCache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.598] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.637] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.638] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0130.639] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0130.640] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.641] GetFileType (hFile=0x154) returned 0x1 [0130.641] GetFileType (hFile=0x154) returned 0x1 [0130.641] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x492a [0130.679] CloseHandle (hObject=0x154) returned 1 [0130.694] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.695] GetFileType (hFile=0x154) returned 0x1 [0130.695] GetFileType (hFile=0x154) returned 0x1 [0130.695] WriteFile (in: hFile=0x154, lpBuffer=0x199dd00*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x199dd00*, lpNumberOfBytesWritten=0x2ae310*=0x4930, lpOverlapped=0x0) returned 1 [0130.697] CloseHandle (hObject=0x154) returned 1 [0130.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc35ddb70, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xc35ddb70, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xecd6be90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4930)) returned 1 [0130.697] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\055464b452b05946907d444400041929.png.anonymous")) returned 1 [0130.697] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.698] GetFileType (hFile=0x154) returned 0x1 [0130.698] GetFileType (hFile=0x154) returned 0x1 [0130.698] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x326b [0130.735] CloseHandle (hObject=0x154) returned 1 [0130.754] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.756] GetFileType (hFile=0x154) returned 0x1 [0130.756] GetFileType (hFile=0x154) returned 0x1 [0130.756] WriteFile (in: hFile=0x154, lpBuffer=0x19ff858*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x19ff858*, lpNumberOfBytesWritten=0x2ae310*=0x3270, lpOverlapped=0x0) returned 1 [0130.757] CloseHandle (hObject=0x154) returned 1 [0130.757] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74a31b90, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x74a31b90, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xece04410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3270)) returned 1 [0130.758] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.anonymous")) returned 1 [0130.758] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.759] GetFileType (hFile=0x154) returned 0x1 [0130.759] GetFileType (hFile=0x154) returned 0x1 [0130.759] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x492a [0130.789] CloseHandle (hObject=0x154) returned 1 [0130.807] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.809] GetFileType (hFile=0x154) returned 0x1 [0130.809] GetFileType (hFile=0x154) returned 0x1 [0130.809] WriteFile (in: hFile=0x154, lpBuffer=0x1a66d54*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x1a66d54*, lpNumberOfBytesWritten=0x2ae310*=0x4930, lpOverlapped=0x0) returned 1 [0130.811] CloseHandle (hObject=0x154) returned 1 [0130.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc35ddb70, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xc35ddb70, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xece76830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4930)) returned 1 [0130.811] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\a1d1a508444ac649673a66fafc239be9.png.anonymous")) returned 1 [0130.812] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.813] GetFileType (hFile=0x154) returned 0x1 [0130.813] GetFileType (hFile=0x154) returned 0x1 [0130.813] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x326b [0130.839] CloseHandle (hObject=0x154) returned 1 [0130.856] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.858] GetFileType (hFile=0x154) returned 0x1 [0130.858] GetFileType (hFile=0x154) returned 0x1 [0130.858] WriteFile (in: hFile=0x154, lpBuffer=0x1ac8750*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x1ac8750*, lpNumberOfBytesWritten=0x2ae310*=0x3270, lpOverlapped=0x0) returned 1 [0130.860] CloseHandle (hObject=0x154) returned 1 [0130.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74a31b90, ftCreationTime.dwHighDateTime=0x1d2da24, ftLastAccessTime.dwLowDateTime=0x74a31b90, ftLastAccessTime.dwHighDateTime=0x1d2da24, ftLastWriteTime.dwLowDateTime=0xecf0edb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3270)) returned 1 [0130.861] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.anonymous")) returned 1 [0130.861] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.862] GetFileType (hFile=0x154) returned 0x1 [0130.862] GetFileType (hFile=0x154) returned 0x1 [0130.862] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x18605 [0130.862] ReadFile (in: hFile=0x154, lpBuffer=0x1c57a480, nNumberOfBytesToRead=0x18605, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1c57a480*, lpNumberOfBytesRead=0x2ae31c*=0x18605, lpOverlapped=0x0) returned 1 [0130.910] CloseHandle (hObject=0x154) returned 1 [0130.948] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.950] GetFileType (hFile=0x154) returned 0x1 [0130.950] GetFileType (hFile=0x154) returned 0x1 [0130.950] WriteFile (in: hFile=0x154, lpBuffer=0x1c5f4308*, nNumberOfBytesToWrite=0x18610, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x1c5f4308*, lpNumberOfBytesWritten=0x2ae310*=0x18610, lpOverlapped=0x0) returned 1 [0130.955] CloseHandle (hObject=0x154) returned 1 [0130.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8a541c90, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x8a541c90, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xecff35f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18610)) returned 1 [0130.957] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.anonymous")) returned 1 [0130.958] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0130.958] GetFileType (hFile=0x154) returned 0x1 [0130.958] GetFileType (hFile=0x154) returned 0x1 [0130.958] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0xf34d [0131.008] CloseHandle (hObject=0x154) returned 1 [0131.050] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png", lpFilePart=0x0) returned 0x78 [0131.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0131.050] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.053] GetFileType (hFile=0x154) returned 0x1 [0131.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0131.053] GetFileType (hFile=0x154) returned 0x1 [0131.053] WriteFile (in: hFile=0x154, lpBuffer=0x1995b00*, nNumberOfBytesToWrite=0xf350, lpNumberOfBytesWritten=0x2ae310, lpOverlapped=0x0 | out: lpBuffer=0x1995b00*, lpNumberOfBytesWritten=0x2ae310*=0xf350, lpOverlapped=0x0) returned 1 [0131.055] CloseHandle (hObject=0x154) returned 1 [0131.055] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png", lpFilePart=0x0) returned 0x78 [0131.055] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png.anonymous", lpFilePart=0x0) returned 0x82 [0131.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0131.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5d96a90, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xcae5f530, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xed0d7e30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf350)) returned 1 [0131.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0131.056] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\firefox\\profiles\\h231daer.default\\thumbnails\\d2ea1355d529838a6539b19e2bc342fe.png.anonymous")) returned 1 [0131.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.057] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x2e [0131.057] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x2f [0131.057] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0131.058] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.058] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.058] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.058] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0131.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.059] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x2e [0131.059] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x2f [0131.059] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0131.059] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.059] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.059] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.059] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0131.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.059] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB", lpFilePart=0x0) returned 0x3f [0131.060] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\", lpFilePart=0x0) returned 0x40 [0131.060] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0131.072] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.072] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.072] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.072] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.072] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.073] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0131.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.074] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB", lpFilePart=0x0) returned 0x3f [0131.074] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\", lpFilePart=0x0) returned 0x40 [0131.074] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0131.075] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.075] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.075] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.075] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.075] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.075] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0131.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.076] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml", lpFilePart=0x0) returned 0x51 [0131.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0131.076] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\active-update.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.078] GetFileType (hFile=0x154) returned 0x1 [0131.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0131.078] GetFileType (hFile=0x154) returned 0x1 [0131.078] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x464 [0131.078] ReadFile (in: hFile=0x154, lpBuffer=0x19a8c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a8c10*, lpNumberOfBytesRead=0x2ae404*=0x464, lpOverlapped=0x0) returned 1 [0131.079] CloseHandle (hObject=0x154) returned 1 [0131.113] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml", lpFilePart=0x0) returned 0x51 [0131.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0131.113] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\active-update.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.115] GetFileType (hFile=0x154) returned 0x1 [0131.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0131.115] GetFileType (hFile=0x154) returned 0x1 [0131.115] WriteFile (in: hFile=0x154, lpBuffer=0x19f82d8*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19f82d8*, lpNumberOfBytesWritten=0x2ae3cc*=0x470, lpOverlapped=0x0) returned 1 [0131.116] CloseHandle (hObject=0x154) returned 1 [0131.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml", lpFilePart=0x0) returned 0x51 [0131.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml.anonymous", lpFilePart=0x0) returned 0x5b [0131.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0131.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\active-update.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cb9000, ftCreationTime.dwHighDateTime=0x1d2fb2f, ftLastAccessTime.dwLowDateTime=0xc0b9cc0, ftLastAccessTime.dwHighDateTime=0x1d2fb2f, ftLastWriteTime.dwLowDateTime=0xed1703b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x470)) returned 1 [0131.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.116] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\active-update.xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\active-update.xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\active-update.xml.anonymous")) returned 1 [0131.117] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml", lpFilePart=0x0) returned 0x4b [0131.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0131.117] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\updates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.118] GetFileType (hFile=0x154) returned 0x1 [0131.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0131.118] GetFileType (hFile=0x154) returned 0x1 [0131.118] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x39 [0131.118] ReadFile (in: hFile=0x154, lpBuffer=0x19f969c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f969c*, lpNumberOfBytesRead=0x2ae404*=0x39, lpOverlapped=0x0) returned 1 [0131.119] CloseHandle (hObject=0x154) returned 1 [0131.131] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml", lpFilePart=0x0) returned 0x4b [0131.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0131.131] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\updates.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.132] GetFileType (hFile=0x154) returned 0x1 [0131.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0131.132] GetFileType (hFile=0x154) returned 0x1 [0131.132] WriteFile (in: hFile=0x154, lpBuffer=0x1a47760*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a47760*, lpNumberOfBytesWritten=0x2ae3cc*=0x40, lpOverlapped=0x0) returned 1 [0131.133] CloseHandle (hObject=0x154) returned 1 [0131.133] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml", lpFilePart=0x0) returned 0x4b [0131.133] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml.anonymous", lpFilePart=0x0) returned 0x55 [0131.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0131.133] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\updates.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d052c0, ftCreationTime.dwHighDateTime=0x1d2fb2f, ftLastAccessTime.dwLowDateTime=0xc0dfe20, ftLastAccessTime.dwHighDateTime=0x1d2fb2f, ftLastWriteTime.dwLowDateTime=0xed196510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0131.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.134] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\updates.xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates.xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\updates.xml.anonymous")) returned 1 [0131.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.134] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates", lpFilePart=0x0) returned 0x47 [0131.134] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\", lpFilePart=0x0) returned 0x48 [0131.134] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0131.134] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.135] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.135] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.135] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0131.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.135] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates", lpFilePart=0x0) returned 0x47 [0131.135] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\", lpFilePart=0x0) returned 0x48 [0131.135] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0131.135] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.135] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.135] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.136] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0131.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0", lpFilePart=0x0) returned 0x49 [0131.136] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\", lpFilePart=0x0) returned 0x4a [0131.136] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb58 [0131.136] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.136] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.136] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.136] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.136] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0131.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0", lpFilePart=0x0) returned 0x49 [0131.137] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\", lpFilePart=0x0) returned 0x4a [0131.137] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb58 [0131.137] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.137] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.137] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.137] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.137] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0131.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0131.138] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24 [0131.138] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.138] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.139] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.140] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.141] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.142] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.143] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.143] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.143] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.143] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.143] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.143] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0131.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.143] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0131.143] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24 [0131.143] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.144] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.145] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.146] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.147] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.148] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.149] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.149] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.149] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.149] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0131.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.149] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv", lpFilePart=0x0) returned 0x39 [0131.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.149] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\1bush_dekkedaxr9f.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.149] GetFileType (hFile=0x154) returned 0x1 [0131.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.149] GetFileType (hFile=0x154) returned 0x1 [0131.149] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x153fd [0131.150] ReadFile (in: hFile=0x154, lpBuffer=0x1c62afd8, nNumberOfBytesToRead=0x153fd, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1c62afd8*, lpNumberOfBytesRead=0x2ae4ec*=0x153fd, lpOverlapped=0x0) returned 1 [0131.151] CloseHandle (hObject=0x154) returned 1 [0131.170] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv", lpFilePart=0x0) returned 0x39 [0131.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.170] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\1bush_dekkedaxr9f.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.172] GetFileType (hFile=0x154) returned 0x1 [0131.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.172] GetFileType (hFile=0x154) returned 0x1 [0131.172] WriteFile (in: hFile=0x154, lpBuffer=0x1c695418*, nNumberOfBytesToWrite=0x15400, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1c695418*, lpNumberOfBytesWritten=0x2ae4e0*=0x15400, lpOverlapped=0x0) returned 1 [0131.174] CloseHandle (hObject=0x154) returned 1 [0131.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv", lpFilePart=0x0) returned 0x39 [0131.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv.anonymous", lpFilePart=0x0) returned 0x43 [0131.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\1bush_dekkedaxr9f.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd049eee0, ftCreationTime.dwHighDateTime=0x1d415e4, ftLastAccessTime.dwLowDateTime=0x5e1dffa0, ftLastAccessTime.dwHighDateTime=0x1d4101c, ftLastWriteTime.dwLowDateTime=0xed208930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15400)) returned 1 [0131.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.175] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\1bush_dekkedaxr9f.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\1BusH_dekKEdAxR9F.flv.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\1bush_dekkedaxr9f.flv.anonymous")) returned 1 [0131.176] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv", lpFilePart=0x0) returned 0x3a [0131.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.176] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\56oqjy-y9ps t6ozeb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.176] GetFileType (hFile=0x154) returned 0x1 [0131.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.176] GetFileType (hFile=0x154) returned 0x1 [0131.176] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a24 [0131.176] ReadFile (in: hFile=0x154, lpBuffer=0x1aa25c8, nNumberOfBytesToRead=0x1a24, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aa25c8*, lpNumberOfBytesRead=0x2ae4ec*=0x1a24, lpOverlapped=0x0) returned 1 [0131.177] CloseHandle (hObject=0x154) returned 1 [0131.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv", lpFilePart=0x0) returned 0x3a [0131.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.189] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\56oqjy-y9ps t6ozeb.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.191] GetFileType (hFile=0x154) returned 0x1 [0131.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.191] GetFileType (hFile=0x154) returned 0x1 [0131.191] WriteFile (in: hFile=0x154, lpBuffer=0x1af76a0*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1af76a0*, lpNumberOfBytesWritten=0x2ae4e0*=0x1a30, lpOverlapped=0x0) returned 1 [0131.192] CloseHandle (hObject=0x154) returned 1 [0131.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv", lpFilePart=0x0) returned 0x3a [0131.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv.anonymous", lpFilePart=0x0) returned 0x44 [0131.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\56oqjy-y9ps t6ozeb.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x22b1ce70, ftCreationTime.dwHighDateTime=0x1d419da, ftLastAccessTime.dwLowDateTime=0xb76add0, ftLastAccessTime.dwHighDateTime=0x1d413c1, ftLastWriteTime.dwLowDateTime=0xed22ea90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a30)) returned 1 [0131.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.192] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\56oqjy-y9ps t6ozeb.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\56oqJy-y9Ps t6OZeB.flv.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\56oqjy-y9ps t6ozeb.flv.anonymous")) returned 1 [0131.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3", lpFilePart=0x0) returned 0x2f [0131.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.193] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\7w9ls3l.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.193] GetFileType (hFile=0x154) returned 0x1 [0131.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.193] GetFileType (hFile=0x154) returned 0x1 [0131.193] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x96d2 [0131.193] ReadFile (in: hFile=0x154, lpBuffer=0x1af94ac, nNumberOfBytesToRead=0x96d2, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1af94ac*, lpNumberOfBytesRead=0x2ae4ec*=0x96d2, lpOverlapped=0x0) returned 1 [0131.194] CloseHandle (hObject=0x154) returned 1 [0131.208] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3", lpFilePart=0x0) returned 0x2f [0131.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.208] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\7w9ls3l.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.210] GetFileType (hFile=0x154) returned 0x1 [0131.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.210] GetFileType (hFile=0x154) returned 0x1 [0131.210] WriteFile (in: hFile=0x154, lpBuffer=0x1b754f8*, nNumberOfBytesToWrite=0x96e0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b754f8*, lpNumberOfBytesWritten=0x2ae4e0*=0x96e0, lpOverlapped=0x0) returned 1 [0131.212] CloseHandle (hObject=0x154) returned 1 [0131.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3", lpFilePart=0x0) returned 0x2f [0131.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3.anonymous", lpFilePart=0x0) returned 0x39 [0131.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\7w9ls3l.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3f82e80, ftCreationTime.dwHighDateTime=0x1d41478, ftLastAccessTime.dwLowDateTime=0x281ac570, ftLastAccessTime.dwHighDateTime=0x1d40fd9, ftLastWriteTime.dwLowDateTime=0xed254bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x96e0)) returned 1 [0131.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.212] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\7w9ls3l.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\7w9LS3l.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\7w9ls3l.mp3.anonymous")) returned 1 [0131.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3", lpFilePart=0x0) returned 0x31 [0131.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.213] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\9vyyzm66l.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.213] GetFileType (hFile=0x154) returned 0x1 [0131.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.213] GetFileType (hFile=0x154) returned 0x1 [0131.214] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1332d [0131.214] ReadFile (in: hFile=0x154, lpBuffer=0x1b7ef44, nNumberOfBytesToRead=0x1332d, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b7ef44*, lpNumberOfBytesRead=0x2ae4ec*=0x1332d, lpOverlapped=0x0) returned 1 [0131.215] CloseHandle (hObject=0x154) returned 1 [0131.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3", lpFilePart=0x0) returned 0x31 [0131.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.255] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\9vyyzm66l.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.257] GetFileType (hFile=0x154) returned 0x1 [0131.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.257] GetFileType (hFile=0x154) returned 0x1 [0131.257] WriteFile (in: hFile=0x154, lpBuffer=0x1a099b4*, nNumberOfBytesToWrite=0x13330, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a099b4*, lpNumberOfBytesWritten=0x2ae4e0*=0x13330, lpOverlapped=0x0) returned 1 [0131.259] CloseHandle (hObject=0x154) returned 1 [0131.259] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3", lpFilePart=0x0) returned 0x31 [0131.259] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3.anonymous", lpFilePart=0x0) returned 0x3b [0131.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\9vyyzm66l.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3abda0f0, ftCreationTime.dwHighDateTime=0x1d41e50, ftLastAccessTime.dwLowDateTime=0x284cebb0, ftLastAccessTime.dwHighDateTime=0x1d4143c, ftLastWriteTime.dwLowDateTime=0xed2c7010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13330)) returned 1 [0131.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.259] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\9vyyzm66l.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\9vYYzm66L.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\9vyyzm66l.mp3.anonymous")) returned 1 [0131.260] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3", lpFilePart=0x0) returned 0x30 [0131.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.260] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\ah3c7g9y.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.260] GetFileType (hFile=0x154) returned 0x1 [0131.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.260] GetFileType (hFile=0x154) returned 0x1 [0131.260] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x4002 [0131.260] ReadFile (in: hFile=0x154, lpBuffer=0x1a1d094, nNumberOfBytesToRead=0x4002, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a1d094*, lpNumberOfBytesRead=0x2ae4ec*=0x4002, lpOverlapped=0x0) returned 1 [0131.261] CloseHandle (hObject=0x154) returned 1 [0131.274] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3", lpFilePart=0x0) returned 0x30 [0131.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.274] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\ah3c7g9y.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.275] GetFileType (hFile=0x154) returned 0x1 [0131.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.275] GetFileType (hFile=0x154) returned 0x1 [0131.275] WriteFile (in: hFile=0x154, lpBuffer=0x1a7e02c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a7e02c*, lpNumberOfBytesWritten=0x2ae4e0*=0x4010, lpOverlapped=0x0) returned 1 [0131.276] CloseHandle (hObject=0x154) returned 1 [0131.276] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3", lpFilePart=0x0) returned 0x30 [0131.277] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3.anonymous", lpFilePart=0x0) returned 0x3a [0131.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\ah3c7g9y.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ec1d800, ftCreationTime.dwHighDateTime=0x1d41ba0, ftLastAccessTime.dwLowDateTime=0x5d62d640, ftLastAccessTime.dwHighDateTime=0x1d417cd, ftLastWriteTime.dwLowDateTime=0xed2ed170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4010)) returned 1 [0131.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.277] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\ah3c7g9y.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\Ah3c7G9Y.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\ah3c7g9y.mp3.anonymous")) returned 1 [0131.277] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt", lpFilePart=0x0) returned 0x33 [0131.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.278] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\altibojvm-p.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.278] GetFileType (hFile=0x154) returned 0x1 [0131.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.278] GetFileType (hFile=0x154) returned 0x1 [0131.278] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x16c05 [0131.278] ReadFile (in: hFile=0x154, lpBuffer=0x1f7fc2c8, nNumberOfBytesToRead=0x16c05, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1f7fc2c8*, lpNumberOfBytesRead=0x2ae4ec*=0x16c05, lpOverlapped=0x0) returned 1 [0131.280] CloseHandle (hObject=0x154) returned 1 [0131.299] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt", lpFilePart=0x0) returned 0x33 [0131.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.299] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\altibojvm-p.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.301] GetFileType (hFile=0x154) returned 0x1 [0131.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.301] GetFileType (hFile=0x154) returned 0x1 [0131.301] WriteFile (in: hFile=0x154, lpBuffer=0x1f86df50*, nNumberOfBytesToWrite=0x16c10, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1f86df50*, lpNumberOfBytesWritten=0x2ae4e0*=0x16c10, lpOverlapped=0x0) returned 1 [0131.304] CloseHandle (hObject=0x154) returned 1 [0131.304] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt", lpFilePart=0x0) returned 0x33 [0131.304] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt.anonymous", lpFilePart=0x0) returned 0x3d [0131.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\altibojvm-p.odt"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x226d6d70, ftCreationTime.dwHighDateTime=0x1d4104d, ftLastAccessTime.dwLowDateTime=0x98e20290, ftLastAccessTime.dwHighDateTime=0x1d41c5a, ftLastWriteTime.dwLowDateTime=0xed339430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16c10)) returned 1 [0131.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.304] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\altibojvm-p.odt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\AlTIBOJVM-p.odt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\altibojvm-p.odt.anonymous")) returned 1 [0131.305] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg", lpFilePart=0x0) returned 0x30 [0131.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.305] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\be3uuimi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.305] GetFileType (hFile=0x154) returned 0x1 [0131.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.305] GetFileType (hFile=0x154) returned 0x1 [0131.305] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x170a2 [0131.306] ReadFile (in: hFile=0x154, lpBuffer=0x1f884b80, nNumberOfBytesToRead=0x170a2, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1f884b80*, lpNumberOfBytesRead=0x2ae4ec*=0x170a2, lpOverlapped=0x0) returned 1 [0131.307] CloseHandle (hObject=0x154) returned 1 [0131.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg", lpFilePart=0x0) returned 0x30 [0131.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.326] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\be3uuimi.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.329] GetFileType (hFile=0x154) returned 0x1 [0131.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.329] GetFileType (hFile=0x154) returned 0x1 [0131.329] WriteFile (in: hFile=0x154, lpBuffer=0x1f8f7f20*, nNumberOfBytesToWrite=0x170b0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1f8f7f20*, lpNumberOfBytesWritten=0x2ae4e0*=0x170b0, lpOverlapped=0x0) returned 1 [0131.331] CloseHandle (hObject=0x154) returned 1 [0131.331] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg", lpFilePart=0x0) returned 0x30 [0131.331] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg.anonymous", lpFilePart=0x0) returned 0x3a [0131.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\be3uuimi.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2cf9cfa0, ftCreationTime.dwHighDateTime=0x1d41d08, ftLastAccessTime.dwLowDateTime=0x11d45a30, ftLastAccessTime.dwHighDateTime=0x1d41004, ftLastWriteTime.dwLowDateTime=0xed3856f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x170b0)) returned 1 [0131.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.331] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\be3uuimi.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\BE3UuiMi.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\be3uuimi.jpg.anonymous")) returned 1 [0131.332] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif", lpFilePart=0x0) returned 0x30 [0131.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.332] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\dgvoq3a8.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.332] GetFileType (hFile=0x154) returned 0x1 [0131.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.333] GetFileType (hFile=0x154) returned 0x1 [0131.333] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6c57 [0131.333] ReadFile (in: hFile=0x154, lpBuffer=0x1b1c6cc, nNumberOfBytesToRead=0x6c57, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b1c6cc*, lpNumberOfBytesRead=0x2ae4ec*=0x6c57, lpOverlapped=0x0) returned 1 [0131.334] CloseHandle (hObject=0x154) returned 1 [0131.346] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif", lpFilePart=0x0) returned 0x30 [0131.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.346] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\dgvoq3a8.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.348] GetFileType (hFile=0x154) returned 0x1 [0131.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.348] GetFileType (hFile=0x154) returned 0x1 [0131.348] WriteFile (in: hFile=0x154, lpBuffer=0x1b8b298*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b8b298*, lpNumberOfBytesWritten=0x2ae4e0*=0x6c60, lpOverlapped=0x0) returned 1 [0131.349] CloseHandle (hObject=0x154) returned 1 [0131.349] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif", lpFilePart=0x0) returned 0x30 [0131.349] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif.anonymous", lpFilePart=0x0) returned 0x3a [0131.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\dgvoq3a8.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765c0210, ftCreationTime.dwHighDateTime=0x1d41ecc, ftLastAccessTime.dwLowDateTime=0x39f46c20, ftLastAccessTime.dwHighDateTime=0x1d41d61, ftLastWriteTime.dwLowDateTime=0xed3ab850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c60)) returned 1 [0131.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.349] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\dgvoq3a8.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\DgvOQ3A8.gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\dgvoq3a8.gif.anonymous")) returned 1 [0131.350] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv", lpFilePart=0x0) returned 0x39 [0131.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.350] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\f3jtsw8x2yodrjjyf.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.350] GetFileType (hFile=0x154) returned 0x1 [0131.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.351] GetFileType (hFile=0x154) returned 0x1 [0131.351] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2958 [0131.351] ReadFile (in: hFile=0x154, lpBuffer=0x1b92298, nNumberOfBytesToRead=0x2958, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b92298*, lpNumberOfBytesRead=0x2ae4ec*=0x2958, lpOverlapped=0x0) returned 1 [0131.352] CloseHandle (hObject=0x154) returned 1 [0131.390] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv", lpFilePart=0x0) returned 0x39 [0131.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.390] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\f3jtsw8x2yodrjjyf.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.391] GetFileType (hFile=0x154) returned 0x1 [0131.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.391] GetFileType (hFile=0x154) returned 0x1 [0131.391] WriteFile (in: hFile=0x154, lpBuffer=0x19db534*, nNumberOfBytesToWrite=0x2960, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19db534*, lpNumberOfBytesWritten=0x2ae4e0*=0x2960, lpOverlapped=0x0) returned 1 [0131.392] CloseHandle (hObject=0x154) returned 1 [0131.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv", lpFilePart=0x0) returned 0x39 [0131.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv.anonymous", lpFilePart=0x0) returned 0x43 [0131.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\f3jtsw8x2yodrjjyf.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfad13e90, ftCreationTime.dwHighDateTime=0x1d41a06, ftLastAccessTime.dwLowDateTime=0xaca8f470, ftLastAccessTime.dwHighDateTime=0x1d41514, ftLastWriteTime.dwLowDateTime=0xed41dc70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2960)) returned 1 [0131.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.393] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\f3jtsw8x2yodrjjyf.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\F3jTSw8X2yOdrJJYF.flv.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\f3jtsw8x2yodrjjyf.flv.anonymous")) returned 1 [0131.393] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg", lpFilePart=0x0) returned 0x2c [0131.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.394] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\fqmp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.394] GetFileType (hFile=0x154) returned 0x1 [0131.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0131.394] GetFileType (hFile=0x154) returned 0x1 [0131.394] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xac9e [0131.394] ReadFile (in: hFile=0x154, lpBuffer=0x19de254, nNumberOfBytesToRead=0xac9e, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19de254*, lpNumberOfBytesRead=0x2ae4ec*=0xac9e, lpOverlapped=0x0) returned 1 [0131.395] CloseHandle (hObject=0x154) returned 1 [0131.408] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg", lpFilePart=0x0) returned 0x2c [0131.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0131.408] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\fqmp.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.410] GetFileType (hFile=0x154) returned 0x1 [0131.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0131.410] GetFileType (hFile=0x154) returned 0x1 [0131.410] WriteFile (in: hFile=0x154, lpBuffer=0x1a4b790*, nNumberOfBytesToWrite=0xaca0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a4b790*, lpNumberOfBytesWritten=0x2ae4e0*=0xaca0, lpOverlapped=0x0) returned 1 [0131.412] CloseHandle (hObject=0x154) returned 1 [0131.412] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg", lpFilePart=0x0) returned 0x2c [0131.412] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg.anonymous", lpFilePart=0x0) returned 0x36 [0131.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0131.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\fqmp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eb947d0, ftCreationTime.dwHighDateTime=0x1d42019, ftLastAccessTime.dwLowDateTime=0xc62058b0, ftLastAccessTime.dwHighDateTime=0x1d41ecb, ftLastWriteTime.dwLowDateTime=0xed443dd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaca0)) returned 1 [0131.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.412] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\fqmp.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\fQMP.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\fqmp.jpg.anonymous")) returned 1 [0131.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0131.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0131.413] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\eebsym5\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0131.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad2a8) returned 1 [0131.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.456] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37 [0131.456] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x38 [0131.456] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xffffffff [0131.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae538) returned 1 [0131.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.457] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x2b [0131.457] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x2c [0131.457] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0131.458] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.458] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.458] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.458] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x2b [0131.458] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x2c [0131.458] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0131.458] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.459] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0131.459] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21 [0131.459] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22 [0131.459] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0131.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.459] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0131.460] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0131.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0131.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0131.460] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21 [0131.460] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22 [0131.460] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0131.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.460] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.461] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0131.461] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0131.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0131.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x27 [0131.461] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x28 [0131.461] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0131.462] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.462] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.462] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.462] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.462] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.463] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x27 [0131.463] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x28 [0131.463] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0131.463] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.463] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.463] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.463] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.463] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.463] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0131.463] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x30 [0131.464] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0131.464] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.464] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.464] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.464] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.464] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0131.464] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x30 [0131.464] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0131.465] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.465] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.465] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.465] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0131.465] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x35 [0131.465] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.466] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.466] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.466] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.467] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.467] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.467] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.468] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0131.468] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x35 [0131.468] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.469] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.469] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.469] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.469] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.470] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.470] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x43 [0131.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0131.471] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.472] GetFileType (hFile=0x154) returned 0x1 [0131.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0131.472] GetFileType (hFile=0x154) returned 0x1 [0131.472] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa5ff [0131.472] ReadFile (in: hFile=0x154, lpBuffer=0x1a5e328, nNumberOfBytesToRead=0xa5ff, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5e328*, lpNumberOfBytesRead=0x2ae404*=0xa5ff, lpOverlapped=0x0) returned 1 [0131.473] CloseHandle (hObject=0x154) returned 1 [0131.508] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x43 [0131.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0131.508] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.510] GetFileType (hFile=0x154) returned 0x1 [0131.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0131.510] GetFileType (hFile=0x154) returned 0x1 [0131.510] WriteFile (in: hFile=0x154, lpBuffer=0x1adef14*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1adef14*, lpNumberOfBytesWritten=0x2ae3f8*=0xa600, lpOverlapped=0x0) returned 1 [0131.511] CloseHandle (hObject=0x154) returned 1 [0131.511] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x43 [0131.511] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.anonymous", lpFilePart=0x0) returned 0x4d [0131.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0131.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe47d0310, ftCreationTime.dwHighDateTime=0x1d2da18, ftLastAccessTime.dwLowDateTime=0xe47d0310, ftLastAccessTime.dwHighDateTime=0x1d2da18, ftLastWriteTime.dwLowDateTime=0xed528610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa600)) returned 1 [0131.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.512] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.anonymous")) returned 1 [0131.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.512] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x3b [0131.512] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x3c [0131.512] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.513] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.513] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.513] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.513] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x3b [0131.513] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x3c [0131.513] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.513] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.513] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.514] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.520] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0131.520] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x34 [0131.520] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.520] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.521] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.521] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.521] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.521] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0131.521] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x34 [0131.521] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.521] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.521] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.522] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.522] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0131.522] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x41 [0131.522] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.522] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.522] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.522] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.523] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.523] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0131.523] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x41 [0131.523] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.523] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.523] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.523] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.523] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.524] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x58 [0131.524] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x59 [0131.524] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.539] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.539] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.539] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.539] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.539] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.539] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.540] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.541] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.542] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.542] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.543] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x58 [0131.544] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x59 [0131.544] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.545] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.546] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.547] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.547] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x5c [0131.548] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x5d [0131.548] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.549] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.549] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.549] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x5c [0131.549] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x5d [0131.549] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.550] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.550] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.550] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.550] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara", lpFilePart=0x0) returned 0x5c [0131.550] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara\\", lpFilePart=0x0) returned 0x5d [0131.550] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.551] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.551] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.551] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara", lpFilePart=0x0) returned 0x5c [0131.551] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara\\", lpFilePart=0x0) returned 0x5d [0131.551] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ara\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.551] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.551] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.551] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x5c [0131.551] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x5d [0131.551] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.552] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.552] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.552] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.552] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x5c [0131.552] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x5d [0131.552] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.552] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.552] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.552] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.552] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x5c [0131.553] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x5d [0131.553] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.556] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.556] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.556] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x5c [0131.557] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x5d [0131.557] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.557] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.557] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.557] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul", lpFilePart=0x0) returned 0x5c [0131.557] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul\\", lpFilePart=0x0) returned 0x5d [0131.557] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.558] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.558] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.558] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.558] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul", lpFilePart=0x0) returned 0x5c [0131.558] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul\\", lpFilePart=0x0) returned 0x5d [0131.558] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\bul\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.558] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.558] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.558] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.559] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can", lpFilePart=0x0) returned 0x5c [0131.559] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can\\", lpFilePart=0x0) returned 0x5d [0131.559] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.559] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.559] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.559] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.562] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can", lpFilePart=0x0) returned 0x5c [0131.562] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can\\", lpFilePart=0x0) returned 0x5d [0131.562] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\can\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.562] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.562] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.562] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.562] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr", lpFilePart=0x0) returned 0x5c [0131.562] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr\\", lpFilePart=0x0) returned 0x5d [0131.562] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.562] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.563] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.563] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr", lpFilePart=0x0) returned 0x5c [0131.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr\\", lpFilePart=0x0) returned 0x5d [0131.563] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cfr\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.563] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.563] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.563] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl", lpFilePart=0x0) returned 0x5c [0131.563] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl\\", lpFilePart=0x0) returned 0x5d [0131.563] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.564] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.564] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.564] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl", lpFilePart=0x0) returned 0x5c [0131.564] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl\\", lpFilePart=0x0) returned 0x5d [0131.564] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\ctl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.564] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.564] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.564] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze", lpFilePart=0x0) returned 0x5c [0131.565] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze\\", lpFilePart=0x0) returned 0x5d [0131.565] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.565] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.565] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.565] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze", lpFilePart=0x0) returned 0x5c [0131.565] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze\\", lpFilePart=0x0) returned 0x5d [0131.565] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\cze\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.565] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.565] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.565] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x5c [0131.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x5d [0131.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.566] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.566] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.566] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x5c [0131.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x5d [0131.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.567] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.567] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.567] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x5c [0131.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x5d [0131.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.567] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.567] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.567] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x5c [0131.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x5d [0131.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.568] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.568] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.568] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x5c [0131.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x5d [0131.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.568] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.568] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.568] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x5c [0131.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x5d [0131.569] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.569] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.569] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.569] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est", lpFilePart=0x0) returned 0x5c [0131.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est\\", lpFilePart=0x0) returned 0x5d [0131.569] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.569] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.569] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.569] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est", lpFilePart=0x0) returned 0x5c [0131.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est\\", lpFilePart=0x0) returned 0x5d [0131.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\est\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.570] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.570] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.570] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin", lpFilePart=0x0) returned 0x5c [0131.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin\\", lpFilePart=0x0) returned 0x5d [0131.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.570] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.570] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.570] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin", lpFilePart=0x0) returned 0x5c [0131.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin\\", lpFilePart=0x0) returned 0x5d [0131.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\fin\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.571] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.571] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.571] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x5c [0131.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x5d [0131.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.571] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.571] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.571] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x5c [0131.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x5d [0131.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.572] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.572] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.572] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre", lpFilePart=0x0) returned 0x5c [0131.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre\\", lpFilePart=0x0) returned 0x5d [0131.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.572] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.572] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.572] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre", lpFilePart=0x0) returned 0x5c [0131.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre\\", lpFilePart=0x0) returned 0x5d [0131.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\gre\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.573] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.573] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.573] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x5c [0131.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x5d [0131.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.573] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.573] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.573] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x5c [0131.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x5d [0131.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.574] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.574] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.574] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb", lpFilePart=0x0) returned 0x5c [0131.574] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb\\", lpFilePart=0x0) returned 0x5d [0131.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.575] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.575] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.575] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb", lpFilePart=0x0) returned 0x5c [0131.576] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb\\", lpFilePart=0x0) returned 0x5d [0131.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\heb\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.576] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.576] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.576] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv", lpFilePart=0x0) returned 0x5c [0131.576] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv\\", lpFilePart=0x0) returned 0x5d [0131.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.577] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.577] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.577] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv", lpFilePart=0x0) returned 0x5c [0131.577] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv\\", lpFilePart=0x0) returned 0x5d [0131.577] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hrv\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.577] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.577] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.577] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun", lpFilePart=0x0) returned 0x5c [0131.577] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun\\", lpFilePart=0x0) returned 0x5d [0131.577] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.577] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.578] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.578] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun", lpFilePart=0x0) returned 0x5c [0131.578] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun\\", lpFilePart=0x0) returned 0x5d [0131.578] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\hun\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.578] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.578] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.578] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x5c [0131.578] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x5d [0131.578] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.579] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.579] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.579] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.579] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x5c [0131.579] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x5d [0131.579] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.579] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.579] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.579] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.579] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav", lpFilePart=0x0) returned 0x5c [0131.579] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav\\", lpFilePart=0x0) returned 0x5d [0131.579] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.580] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.580] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.580] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav", lpFilePart=0x0) returned 0x5c [0131.580] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav\\", lpFilePart=0x0) returned 0x5d [0131.580] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lav\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.580] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.580] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.580] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit", lpFilePart=0x0) returned 0x5c [0131.580] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit\\", lpFilePart=0x0) returned 0x5d [0131.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.581] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.581] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.581] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.581] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit", lpFilePart=0x0) returned 0x5c [0131.581] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit\\", lpFilePart=0x0) returned 0x5d [0131.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\lit\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.582] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.582] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.582] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x5c [0131.582] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x5d [0131.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.582] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.582] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.582] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x5c [0131.583] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x5d [0131.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.583] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.583] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.583] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn", lpFilePart=0x0) returned 0x5c [0131.583] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn\\", lpFilePart=0x0) returned 0x5d [0131.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.583] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.583] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.583] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn", lpFilePart=0x0) returned 0x5c [0131.584] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn\\", lpFilePart=0x0) returned 0x5d [0131.584] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nyn\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.584] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.584] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.584] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol", lpFilePart=0x0) returned 0x5c [0131.584] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol\\", lpFilePart=0x0) returned 0x5d [0131.584] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.584] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.584] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.584] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol", lpFilePart=0x0) returned 0x5c [0131.584] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol\\", lpFilePart=0x0) returned 0x5d [0131.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\pol\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.585] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.585] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.585] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x5c [0131.585] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x5d [0131.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.585] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.585] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.585] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x5c [0131.585] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x5d [0131.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.586] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.586] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.586] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum", lpFilePart=0x0) returned 0x5c [0131.586] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum\\", lpFilePart=0x0) returned 0x5d [0131.586] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.586] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.586] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.586] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum", lpFilePart=0x0) returned 0x5c [0131.586] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum\\", lpFilePart=0x0) returned 0x5d [0131.586] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rum\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.587] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.587] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.587] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus", lpFilePart=0x0) returned 0x5c [0131.587] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus\\", lpFilePart=0x0) returned 0x5d [0131.587] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.587] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.587] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.587] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus", lpFilePart=0x0) returned 0x5c [0131.587] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus\\", lpFilePart=0x0) returned 0x5d [0131.587] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\rus\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.588] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.588] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.588] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.588] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr", lpFilePart=0x0) returned 0x5c [0131.588] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr\\", lpFilePart=0x0) returned 0x5d [0131.588] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.588] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.588] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.588] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.588] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr", lpFilePart=0x0) returned 0x5c [0131.588] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr\\", lpFilePart=0x0) returned 0x5d [0131.588] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\sgr\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.588] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.588] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.589] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.589] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo", lpFilePart=0x0) returned 0x5c [0131.589] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo\\", lpFilePart=0x0) returned 0x5d [0131.589] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.589] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.589] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.589] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.589] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo", lpFilePart=0x0) returned 0x5c [0131.589] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo\\", lpFilePart=0x0) returned 0x5d [0131.589] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\slo\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.589] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.589] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.589] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x5c [0131.589] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x5d [0131.589] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.590] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.590] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x5c [0131.590] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x5d [0131.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.590] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.590] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x5c [0131.590] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x5d [0131.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.590] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.590] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x5c [0131.590] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x5d [0131.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.591] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.591] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur", lpFilePart=0x0) returned 0x5c [0131.591] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur\\", lpFilePart=0x0) returned 0x5d [0131.591] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.591] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.591] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur", lpFilePart=0x0) returned 0x5c [0131.591] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur\\", lpFilePart=0x0) returned 0x5d [0131.591] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\tur\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbef18 [0131.591] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.591] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x2b [0131.591] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x2c [0131.591] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbef18 [0131.592] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.592] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x2b [0131.592] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x2c [0131.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbef18 [0131.592] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.592] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x3c [0131.592] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x3d [0131.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.592] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.592] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x3c [0131.592] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x3d [0131.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.593] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x44 [0131.593] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x45 [0131.593] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.593] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x44 [0131.593] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x45 [0131.593] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.593] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x45 [0131.594] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x46 [0131.594] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.594] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x45 [0131.594] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x46 [0131.594] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.594] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0131.595] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x32 [0131.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.595] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.595] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0131.595] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x32 [0131.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.595] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0131.596] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x33 [0131.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.596] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0131.596] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x33 [0131.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.596] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0131.596] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x34 [0131.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.596] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0131.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x34 [0131.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.597] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0131.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x34 [0131.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.597] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0131.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x34 [0131.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.597] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0131.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3e [0131.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.598] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0131.598] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3e [0131.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0131.598] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x46 [0131.598] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x47 [0131.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.599] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x46 [0131.599] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x47 [0131.599] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0131.599] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4", lpFilePart=0x0) returned 0x4f [0131.599] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4\\", lpFilePart=0x0) returned 0x50 [0131.599] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.599] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4", lpFilePart=0x0) returned 0x4f [0131.599] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4\\", lpFilePart=0x0) returned 0x50 [0131.599] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\28ZN9XO4\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.600] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.600] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C", lpFilePart=0x0) returned 0x4f [0131.600] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C\\", lpFilePart=0x0) returned 0x50 [0131.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.600] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.600] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C", lpFilePart=0x0) returned 0x4f [0131.600] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C\\", lpFilePart=0x0) returned 0x50 [0131.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\6ZWEND9C\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.600] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.600] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3", lpFilePart=0x0) returned 0x4f [0131.600] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\", lpFilePart=0x0) returned 0x50 [0131.600] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.600] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.601] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3", lpFilePart=0x0) returned 0x4f [0131.601] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\", lpFilePart=0x0) returned 0x50 [0131.601] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbef18 [0131.601] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0131.601] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml", lpFilePart=0x0) returned 0x5e [0131.601] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hk6o7my3\\www.msn[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.601] GetFileType (hFile=0x154) returned 0x1 [0131.601] GetFileType (hFile=0x154) returned 0x1 [0131.601] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x337 [0131.602] CloseHandle (hObject=0x154) returned 1 [0131.638] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml", lpFilePart=0x0) returned 0x5e [0131.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0131.639] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hk6o7my3\\www.msn[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.640] GetFileType (hFile=0x154) returned 0x1 [0131.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0131.640] GetFileType (hFile=0x154) returned 0x1 [0131.640] WriteFile (in: hFile=0x154, lpBuffer=0x19b4ba8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19b4ba8*, lpNumberOfBytesWritten=0x2ae358*=0x340, lpOverlapped=0x0) returned 1 [0131.641] CloseHandle (hObject=0x154) returned 1 [0131.641] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml", lpFilePart=0x0) returned 0x5e [0131.641] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml.anonymous", lpFilePart=0x0) returned 0x68 [0131.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0131.642] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hk6o7my3\\www.msn[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77168d90, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x77168d90, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xed67f270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0131.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.642] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hk6o7my3\\www.msn[1].xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HK6O7MY3\\www.msn[1].xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hk6o7my3\\www.msn[1].xml.anonymous")) returned 1 [0131.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.642] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41", lpFilePart=0x0) returned 0x4f [0131.642] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\", lpFilePart=0x0) returned 0x50 [0131.642] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf298 [0131.643] FindNextFileW (in: hFindFile=0xbf298, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.643] FindNextFileW (in: hFindFile=0xbf298, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.643] FindNextFileW (in: hFindFile=0xbf298, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.643] FindClose (in: hFindFile=0xbf298 | out: hFindFile=0xbf298) returned 1 [0131.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.643] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41", lpFilePart=0x0) returned 0x4f [0131.643] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\", lpFilePart=0x0) returned 0x50 [0131.643] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf298 [0131.643] FindNextFileW (in: hFindFile=0xbf298, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.644] FindNextFileW (in: hFindFile=0xbf298, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.644] FindNextFileW (in: hFindFile=0xbf298, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.644] FindClose (in: hFindFile=0xbf298 | out: hFindFile=0xbf298) returned 1 [0131.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x67 [0131.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0131.644] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hnmxka41\\imagesrv.adition[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.645] GetFileType (hFile=0x154) returned 0x1 [0131.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0131.645] GetFileType (hFile=0x154) returned 0x1 [0131.645] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x63 [0131.645] ReadFile (in: hFile=0x154, lpBuffer=0x19b7cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19b7cc8*, lpNumberOfBytesRead=0x2ae390*=0x63, lpOverlapped=0x0) returned 1 [0131.646] CloseHandle (hObject=0x154) returned 1 [0131.658] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x67 [0131.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0131.658] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hnmxka41\\imagesrv.adition[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.659] GetFileType (hFile=0x154) returned 0x1 [0131.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0131.659] GetFileType (hFile=0x154) returned 0x1 [0131.659] WriteFile (in: hFile=0x154, lpBuffer=0x1a05fa0*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a05fa0*, lpNumberOfBytesWritten=0x2ae358*=0x70, lpOverlapped=0x0) returned 1 [0131.660] CloseHandle (hObject=0x154) returned 1 [0131.660] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x67 [0131.660] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml.anonymous", lpFilePart=0x0) returned 0x71 [0131.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0131.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hnmxka41\\imagesrv.adition[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d079c30, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d079c30, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xed6a53d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0131.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.661] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hnmxka41\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HNMXKA41\\imagesrv.adition[1].xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hnmxka41\\imagesrv.adition[1].xml.anonymous")) returned 1 [0131.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.661] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x46 [0131.662] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x47 [0131.662] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.663] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.663] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.663] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.663] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x46 [0131.663] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x47 [0131.663] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.663] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.665] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.665] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.665] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x25 [0131.665] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\", lpFilePart=0x0) returned 0x26 [0131.665] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0131.666] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.666] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.667] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.667] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0131.667] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x25 [0131.667] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe8d8 [0131.667] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.667] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0131.667] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0131.667] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0131.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.668] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0131.668] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.668] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.669] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.669] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.669] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.669] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0131.669] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbe8d8 [0131.669] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.669] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.669] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.670] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0131.670] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0131.670] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0131.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0131.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.670] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.670] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.670] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.670] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.671] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.671] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.671] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.671] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.671] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.671] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.671] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.671] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.672] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.688] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.688] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.688] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.688] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.688] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.688] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.688] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.689] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.689] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.689] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.689] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.689] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.689] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.689] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe8d8 [0131.702] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.702] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.703] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.703] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.703] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.703] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.703] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.704] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe8d8 [0131.705] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.705] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.705] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.705] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.706] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.706] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.706] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.707] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe8d8 [0131.707] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.707] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.707] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.708] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0131.708] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbe8d8 [0131.708] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.708] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0131.708] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0131.708] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0131.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0131.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.708] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe8d8 [0131.709] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.710] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.710] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0131.710] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbe8d8 [0131.710] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0131.710] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0131.710] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0131.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0131.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.711] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.711] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.711] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.711] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.711] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.712] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0131.712] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0131.712] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.712] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.712] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0131.713] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0131.713] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0131.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0131.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0131.713] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0131.713] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.713] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.714] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.715] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.716] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.716] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.716] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.716] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.716] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.716] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.717] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.717] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.717] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.717] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.717] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.717] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.718] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0131.719] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0131.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0131.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0131.719] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe8d8 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.719] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.720] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0131.721] FindNextFileW (in: hFindFile=0xbe8d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0131.721] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0131.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0131.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0131.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.721] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\-Q6z.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\-q6z.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.722] GetFileType (hFile=0x154) returned 0x1 [0131.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.722] GetFileType (hFile=0x154) returned 0x1 [0131.722] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3834 [0131.722] ReadFile (in: hFile=0x154, lpBuffer=0x1a1cba8, nNumberOfBytesToRead=0x3834, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a1cba8*, lpNumberOfBytesRead=0x2ae560*=0x3834, lpOverlapped=0x0) returned 1 [0131.723] CloseHandle (hObject=0x154) returned 1 [0131.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.735] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\-Q6z.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\-q6z.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.737] GetFileType (hFile=0x154) returned 0x1 [0131.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.737] GetFileType (hFile=0x154) returned 0x1 [0131.737] WriteFile (in: hFile=0x154, lpBuffer=0x1a7b2d0*, nNumberOfBytesToWrite=0x3840, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a7b2d0*, lpNumberOfBytesWritten=0x2ae554*=0x3840, lpOverlapped=0x0) returned 1 [0131.738] CloseHandle (hObject=0x154) returned 1 [0131.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.738] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\-Q6z.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\-q6z.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a5f3ec0, ftCreationTime.dwHighDateTime=0x1d40fd4, ftLastAccessTime.dwLowDateTime=0x7c89f750, ftLastAccessTime.dwHighDateTime=0x1d412c9, ftLastWriteTime.dwLowDateTime=0xed763ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3840)) returned 1 [0131.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.738] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\-Q6z.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\-q6z.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\-Q6z.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\-q6z.bmp.anonymous")) returned 1 [0131.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.739] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\085Nrmhl2TUwcqB1 jCh.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\085nrmhl2tuwcqb1 jch.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.739] GetFileType (hFile=0x154) returned 0x1 [0131.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.739] GetFileType (hFile=0x154) returned 0x1 [0131.739] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x10197 [0131.739] ReadFile (in: hFile=0x154, lpBuffer=0x1a7ee88, nNumberOfBytesToRead=0x10197, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a7ee88*, lpNumberOfBytesRead=0x2ae560*=0x10197, lpOverlapped=0x0) returned 1 [0131.741] CloseHandle (hObject=0x154) returned 1 [0131.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.761] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\085Nrmhl2TUwcqB1 jCh.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\085nrmhl2tuwcqb1 jch.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.764] GetFileType (hFile=0x154) returned 0x1 [0131.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.764] GetFileType (hFile=0x154) returned 0x1 [0131.764] WriteFile (in: hFile=0x154, lpBuffer=0x1afc168*, nNumberOfBytesToWrite=0x101a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1afc168*, lpNumberOfBytesWritten=0x2ae554*=0x101a0, lpOverlapped=0x0) returned 1 [0131.767] CloseHandle (hObject=0x154) returned 1 [0131.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\085Nrmhl2TUwcqB1 jCh.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\085nrmhl2tuwcqb1 jch.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1937b710, ftCreationTime.dwHighDateTime=0x1d41bfb, ftLastAccessTime.dwLowDateTime=0x78b7be30, ftLastAccessTime.dwHighDateTime=0x1d417ee, ftLastWriteTime.dwLowDateTime=0xed7afd70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x101a0)) returned 1 [0131.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.767] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\085Nrmhl2TUwcqB1 jCh.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\085nrmhl2tuwcqb1 jch.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\085Nrmhl2TUwcqB1 jCh.gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\085nrmhl2tuwcqb1 jch.gif.anonymous")) returned 1 [0131.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.768] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\0k2xuwtnv.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.769] GetFileType (hFile=0x154) returned 0x1 [0131.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.769] GetFileType (hFile=0x154) returned 0x1 [0131.769] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x136b4 [0131.769] ReadFile (in: hFile=0x154, lpBuffer=0x1b0c6dc, nNumberOfBytesToRead=0x136b4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0c6dc*, lpNumberOfBytesRead=0x2ae560*=0x136b4, lpOverlapped=0x0) returned 1 [0131.770] CloseHandle (hObject=0x154) returned 1 [0131.794] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png", lpFilePart=0x0) returned 0x2e [0131.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.794] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\0k2xuwtnv.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.796] GetFileType (hFile=0x154) returned 0x1 [0131.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.796] GetFileType (hFile=0x154) returned 0x1 [0131.796] WriteFile (in: hFile=0x154, lpBuffer=0x199a1f4*, nNumberOfBytesToWrite=0x136c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x199a1f4*, lpNumberOfBytesWritten=0x2ae554*=0x136c0, lpOverlapped=0x0) returned 1 [0131.798] CloseHandle (hObject=0x154) returned 1 [0131.798] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png", lpFilePart=0x0) returned 0x2e [0131.798] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png.anonymous", lpFilePart=0x0) returned 0x38 [0131.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\0k2xuwtnv.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe252d860, ftCreationTime.dwHighDateTime=0x1d41254, ftLastAccessTime.dwLowDateTime=0xfc052ca0, ftLastAccessTime.dwHighDateTime=0x1d41ab4, ftLastWriteTime.dwLowDateTime=0xed7fc030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x136c0)) returned 1 [0131.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.798] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\0k2xuwtnv.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\0K2XUWTNV.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\0k2xuwtnv.png.anonymous")) returned 1 [0131.799] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif", lpFilePart=0x0) returned 0x2e [0131.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.799] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2a86ykumh.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.799] GetFileType (hFile=0x154) returned 0x1 [0131.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.800] GetFileType (hFile=0x154) returned 0x1 [0131.800] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x181c0 [0131.800] ReadFile (in: hFile=0x154, lpBuffer=0x1f96b9f0, nNumberOfBytesToRead=0x181c0, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1f96b9f0*, lpNumberOfBytesRead=0x2ae560*=0x181c0, lpOverlapped=0x0) returned 1 [0131.802] CloseHandle (hObject=0x154) returned 1 [0131.845] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif", lpFilePart=0x0) returned 0x2e [0131.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.845] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2a86ykumh.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.847] GetFileType (hFile=0x154) returned 0x1 [0131.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.847] GetFileType (hFile=0x154) returned 0x1 [0131.847] WriteFile (in: hFile=0x154, lpBuffer=0x1f9e4330*, nNumberOfBytesToWrite=0x181d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1f9e4330*, lpNumberOfBytesWritten=0x2ae554*=0x181d0, lpOverlapped=0x0) returned 1 [0131.850] CloseHandle (hObject=0x154) returned 1 [0131.850] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif", lpFilePart=0x0) returned 0x2e [0131.850] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif.anonymous", lpFilePart=0x0) returned 0x38 [0131.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2a86ykumh.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cfce740, ftCreationTime.dwHighDateTime=0x1d41ae8, ftLastAccessTime.dwLowDateTime=0xa9d3ff30, ftLastAccessTime.dwHighDateTime=0x1d41427, ftLastWriteTime.dwLowDateTime=0xed86e450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x181d0)) returned 1 [0131.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.850] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2a86ykumh.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2A86YKUMH.gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2a86ykumh.gif.anonymous")) returned 1 [0131.851] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png", lpFilePart=0x0) returned 0x31 [0131.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.851] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2ccc6nbaza1o.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.851] GetFileType (hFile=0x154) returned 0x1 [0131.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.851] GetFileType (hFile=0x154) returned 0x1 [0131.851] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x12b85 [0131.852] ReadFile (in: hFile=0x154, lpBuffer=0x19faef0, nNumberOfBytesToRead=0x12b85, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19faef0*, lpNumberOfBytesRead=0x2ae560*=0x12b85, lpOverlapped=0x0) returned 1 [0131.853] CloseHandle (hObject=0x154) returned 1 [0131.867] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png", lpFilePart=0x0) returned 0x31 [0131.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.868] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2ccc6nbaza1o.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.870] GetFileType (hFile=0x154) returned 0x1 [0131.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.870] GetFileType (hFile=0x154) returned 0x1 [0131.870] WriteFile (in: hFile=0x154, lpBuffer=0x1a7ffa0*, nNumberOfBytesToWrite=0x12b90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a7ffa0*, lpNumberOfBytesWritten=0x2ae554*=0x12b90, lpOverlapped=0x0) returned 1 [0131.887] CloseHandle (hObject=0x154) returned 1 [0131.887] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png", lpFilePart=0x0) returned 0x31 [0131.887] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png.anonymous", lpFilePart=0x0) returned 0x3b [0131.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2ccc6nbaza1o.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb557d8f0, ftCreationTime.dwHighDateTime=0x1d41c7d, ftLastAccessTime.dwLowDateTime=0x8b5abb70, ftLastAccessTime.dwHighDateTime=0x1d416e8, ftLastWriteTime.dwLowDateTime=0xed8ba710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12b90)) returned 1 [0131.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.887] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2ccc6nbaza1o.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\2ccC6NBAzA1O.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\2ccc6nbaza1o.png.anonymous")) returned 1 [0131.888] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg", lpFilePart=0x0) returned 0x38 [0131.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.888] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\3ieij6rt82yif3 vfeu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.888] GetFileType (hFile=0x154) returned 0x1 [0131.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.888] GetFileType (hFile=0x154) returned 0x1 [0131.888] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5daf [0131.888] ReadFile (in: hFile=0x154, lpBuffer=0x1a92edc, nNumberOfBytesToRead=0x5daf, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a92edc*, lpNumberOfBytesRead=0x2ae560*=0x5daf, lpOverlapped=0x0) returned 1 [0131.889] CloseHandle (hObject=0x154) returned 1 [0131.901] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg", lpFilePart=0x0) returned 0x38 [0131.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.901] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\3ieij6rt82yif3 vfeu.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.903] GetFileType (hFile=0x154) returned 0x1 [0131.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.903] GetFileType (hFile=0x154) returned 0x1 [0131.903] WriteFile (in: hFile=0x154, lpBuffer=0x1afd138*, nNumberOfBytesToWrite=0x5db0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1afd138*, lpNumberOfBytesWritten=0x2ae554*=0x5db0, lpOverlapped=0x0) returned 1 [0131.904] CloseHandle (hObject=0x154) returned 1 [0131.904] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg", lpFilePart=0x0) returned 0x38 [0131.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg.anonymous", lpFilePart=0x0) returned 0x42 [0131.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\3ieij6rt82yif3 vfeu.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd48e14c0, ftCreationTime.dwHighDateTime=0x1d41a64, ftLastAccessTime.dwLowDateTime=0x8b53ab20, ftLastAccessTime.dwHighDateTime=0x1d41088, ftLastWriteTime.dwLowDateTime=0xed9069d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5db0)) returned 1 [0131.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.905] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\3ieij6rt82yif3 vfeu.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\3ieIJ6rt82yiF3 vfEU.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\3ieij6rt82yif3 vfeu.jpg.anonymous")) returned 1 [0131.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp", lpFilePart=0x0) returned 0x32 [0131.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.906] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\6qrfy37n1bnvq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.906] GetFileType (hFile=0x154) returned 0x1 [0131.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.906] GetFileType (hFile=0x154) returned 0x1 [0131.906] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x10b8d [0131.906] ReadFile (in: hFile=0x154, lpBuffer=0x1b032c8, nNumberOfBytesToRead=0x10b8d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b032c8*, lpNumberOfBytesRead=0x2ae560*=0x10b8d, lpOverlapped=0x0) returned 1 [0131.907] CloseHandle (hObject=0x154) returned 1 [0131.922] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp", lpFilePart=0x0) returned 0x32 [0131.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.922] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\6qrfy37n1bnvq.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.924] GetFileType (hFile=0x154) returned 0x1 [0131.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.924] GetFileType (hFile=0x154) returned 0x1 [0131.924] WriteFile (in: hFile=0x154, lpBuffer=0x1b82378*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b82378*, lpNumberOfBytesWritten=0x2ae554*=0x10b90, lpOverlapped=0x0) returned 1 [0131.926] CloseHandle (hObject=0x154) returned 1 [0131.926] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp", lpFilePart=0x0) returned 0x32 [0131.926] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp.anonymous", lpFilePart=0x0) returned 0x3c [0131.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\6qrfy37n1bnvq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ca06d0, ftCreationTime.dwHighDateTime=0x1d4176d, ftLastAccessTime.dwLowDateTime=0xdbad9b0, ftLastAccessTime.dwHighDateTime=0x1d41059, ftLastWriteTime.dwLowDateTime=0xed92cb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10b90)) returned 1 [0131.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.926] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\6qrfy37n1bnvq.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\6qRfY37N1BNVq.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\6qrfy37n1bnvq.bmp.anonymous")) returned 1 [0131.927] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp", lpFilePart=0x0) returned 0x38 [0131.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.927] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\8o jt3mgjchjyd6tlti.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.927] GetFileType (hFile=0x154) returned 0x1 [0131.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.927] GetFileType (hFile=0x154) returned 0x1 [0131.927] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x626c [0131.927] ReadFile (in: hFile=0x154, lpBuffer=0x1b932c4, nNumberOfBytesToRead=0x626c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b932c4*, lpNumberOfBytesRead=0x2ae560*=0x626c, lpOverlapped=0x0) returned 1 [0131.928] CloseHandle (hObject=0x154) returned 1 [0131.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp", lpFilePart=0x0) returned 0x38 [0131.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.965] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\8o jt3mgjchjyd6tlti.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.966] GetFileType (hFile=0x154) returned 0x1 [0131.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.966] GetFileType (hFile=0x154) returned 0x1 [0131.966] WriteFile (in: hFile=0x154, lpBuffer=0x19f0cb4*, nNumberOfBytesToWrite=0x6270, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19f0cb4*, lpNumberOfBytesWritten=0x2ae554*=0x6270, lpOverlapped=0x0) returned 1 [0131.968] CloseHandle (hObject=0x154) returned 1 [0131.968] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp", lpFilePart=0x0) returned 0x38 [0131.968] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp.anonymous", lpFilePart=0x0) returned 0x42 [0131.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\8o jt3mgjchjyd6tlti.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca176920, ftCreationTime.dwHighDateTime=0x1d415db, ftLastAccessTime.dwLowDateTime=0xcf18f3b0, ftLastAccessTime.dwHighDateTime=0x1d4160a, ftLastWriteTime.dwLowDateTime=0xed99ef50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6270)) returned 1 [0131.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.968] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\8o jt3mgjchjyd6tlti.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\8o JT3mgJChJyD6tLTi.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\8o jt3mgjchjyd6tlti.bmp.anonymous")) returned 1 [0131.969] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg", lpFilePart=0x0) returned 0x2d [0131.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.969] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\9joqd5ex.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.969] GetFileType (hFile=0x154) returned 0x1 [0131.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.969] GetFileType (hFile=0x154) returned 0x1 [0131.969] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x18cb9 [0131.970] ReadFile (in: hFile=0x154, lpBuffer=0x1fa43360, nNumberOfBytesToRead=0x18cb9, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1fa43360*, lpNumberOfBytesRead=0x2ae560*=0x18cb9, lpOverlapped=0x0) returned 1 [0131.972] CloseHandle (hObject=0x154) returned 1 [0131.991] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg", lpFilePart=0x0) returned 0x2d [0131.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0131.991] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\9joqd5ex.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.993] GetFileType (hFile=0x154) returned 0x1 [0131.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0131.993] GetFileType (hFile=0x154) returned 0x1 [0131.993] WriteFile (in: hFile=0x154, lpBuffer=0x1fabf358*, nNumberOfBytesToWrite=0x18cc0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1fabf358*, lpNumberOfBytesWritten=0x2ae554*=0x18cc0, lpOverlapped=0x0) returned 1 [0131.996] CloseHandle (hObject=0x154) returned 1 [0131.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg", lpFilePart=0x0) returned 0x2d [0131.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg.anonymous", lpFilePart=0x0) returned 0x37 [0131.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0131.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\9joqd5ex.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe202f300, ftCreationTime.dwHighDateTime=0x1d4146a, ftLastAccessTime.dwLowDateTime=0x38353510, ftLastAccessTime.dwHighDateTime=0x1d4144f, ftLastWriteTime.dwLowDateTime=0xed9c50b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18cc0)) returned 1 [0131.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0131.996] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\9joqd5ex.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\9joQD5eX.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\9joqd5ex.jpg.anonymous")) returned 1 [0131.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv", lpFilePart=0x0) returned 0x2e [0131.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0131.997] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\b9tcuamsn.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0131.997] GetFileType (hFile=0x154) returned 0x1 [0131.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0131.997] GetFileType (hFile=0x154) returned 0x1 [0131.997] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1609d [0131.998] ReadFile (in: hFile=0x154, lpBuffer=0x1fad8038, nNumberOfBytesToRead=0x1609d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1fad8038*, lpNumberOfBytesRead=0x2ae560*=0x1609d, lpOverlapped=0x0) returned 1 [0132.000] CloseHandle (hObject=0x154) returned 1 [0132.018] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv", lpFilePart=0x0) returned 0x2e [0132.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.018] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\b9tcuamsn.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.020] GetFileType (hFile=0x154) returned 0x1 [0132.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.020] GetFileType (hFile=0x154) returned 0x1 [0132.020] WriteFile (in: hFile=0x154, lpBuffer=0x1fb46398*, nNumberOfBytesToWrite=0x160a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1fb46398*, lpNumberOfBytesWritten=0x2ae554*=0x160a0, lpOverlapped=0x0) returned 1 [0132.023] CloseHandle (hObject=0x154) returned 1 [0132.023] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv", lpFilePart=0x0) returned 0x2e [0132.023] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv.anonymous", lpFilePart=0x0) returned 0x38 [0132.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\b9tcuamsn.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9cd6060, ftCreationTime.dwHighDateTime=0x1d41e1c, ftLastAccessTime.dwLowDateTime=0x767294f0, ftLastAccessTime.dwHighDateTime=0x1d419b6, ftLastWriteTime.dwLowDateTime=0xeda11370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x160a0)) returned 1 [0132.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.023] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\b9tcuamsn.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\b9TcUAMSn.flv.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\b9tcuamsn.flv.anonymous")) returned 1 [0132.024] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png", lpFilePart=0x0) returned 0x38 [0132.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.024] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\bv2g72jduqxbisfhnl8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.024] GetFileType (hFile=0x154) returned 0x1 [0132.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.024] GetFileType (hFile=0x154) returned 0x1 [0132.024] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5efc [0132.024] ReadFile (in: hFile=0x154, lpBuffer=0x1a91720, nNumberOfBytesToRead=0x5efc, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a91720*, lpNumberOfBytesRead=0x2ae560*=0x5efc, lpOverlapped=0x0) returned 1 [0132.025] CloseHandle (hObject=0x154) returned 1 [0132.038] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png", lpFilePart=0x0) returned 0x38 [0132.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.038] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\bv2g72jduqxbisfhnl8.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.039] GetFileType (hFile=0x154) returned 0x1 [0132.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.039] GetFileType (hFile=0x154) returned 0x1 [0132.039] WriteFile (in: hFile=0x154, lpBuffer=0x1afc008*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1afc008*, lpNumberOfBytesWritten=0x2ae554*=0x5f00, lpOverlapped=0x0) returned 1 [0132.041] CloseHandle (hObject=0x154) returned 1 [0132.041] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png", lpFilePart=0x0) returned 0x38 [0132.041] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png.anonymous", lpFilePart=0x0) returned 0x42 [0132.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.041] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\bv2g72jduqxbisfhnl8.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd54472f0, ftCreationTime.dwHighDateTime=0x1d41191, ftLastAccessTime.dwLowDateTime=0xd46c770, ftLastAccessTime.dwHighDateTime=0x1d41354, ftLastWriteTime.dwLowDateTime=0xeda374d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f00)) returned 1 [0132.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.041] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\bv2g72jduqxbisfhnl8.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\BV2g72JDuqxBisfhNl8.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\bv2g72jduqxbisfhnl8.png.anonymous")) returned 1 [0132.042] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv", lpFilePart=0x0) returned 0x32 [0132.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.042] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\hmfj4of_qnjac.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.042] GetFileType (hFile=0x154) returned 0x1 [0132.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.042] GetFileType (hFile=0x154) returned 0x1 [0132.042] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x35c9 [0132.042] ReadFile (in: hFile=0x154, lpBuffer=0x1b02318, nNumberOfBytesToRead=0x35c9, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b02318*, lpNumberOfBytesRead=0x2ae560*=0x35c9, lpOverlapped=0x0) returned 1 [0132.043] CloseHandle (hObject=0x154) returned 1 [0132.055] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv", lpFilePart=0x0) returned 0x32 [0132.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.055] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\hmfj4of_qnjac.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.057] GetFileType (hFile=0x154) returned 0x1 [0132.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.057] GetFileType (hFile=0x154) returned 0x1 [0132.057] WriteFile (in: hFile=0x154, lpBuffer=0x1b5fe14*, nNumberOfBytesToWrite=0x35d0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b5fe14*, lpNumberOfBytesWritten=0x2ae554*=0x35d0, lpOverlapped=0x0) returned 1 [0132.058] CloseHandle (hObject=0x154) returned 1 [0132.058] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv", lpFilePart=0x0) returned 0x32 [0132.058] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv.anonymous", lpFilePart=0x0) returned 0x3c [0132.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.058] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\hmfj4of_qnjac.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d31c520, ftCreationTime.dwHighDateTime=0x1d419f8, ftLastAccessTime.dwLowDateTime=0xd5e7ce40, ftLastAccessTime.dwHighDateTime=0x1d41778, ftLastWriteTime.dwLowDateTime=0xeda5d630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x35d0)) returned 1 [0132.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.058] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\hmfj4of_qnjac.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\HMfj4OF_QnJAC.flv.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\hmfj4of_qnjac.flv.anonymous")) returned 1 [0132.059] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3", lpFilePart=0x0) returned 0x2b [0132.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.059] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\lbrpti.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.059] GetFileType (hFile=0x154) returned 0x1 [0132.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.059] GetFileType (hFile=0x154) returned 0x1 [0132.060] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1997 [0132.060] ReadFile (in: hFile=0x154, lpBuffer=0x1b63784, nNumberOfBytesToRead=0x1997, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b63784*, lpNumberOfBytesRead=0x2ae560*=0x1997, lpOverlapped=0x0) returned 1 [0132.061] CloseHandle (hObject=0x154) returned 1 [0132.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3", lpFilePart=0x0) returned 0x2b [0132.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.101] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\lbrpti.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.103] GetFileType (hFile=0x154) returned 0x1 [0132.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.103] GetFileType (hFile=0x154) returned 0x1 [0132.103] WriteFile (in: hFile=0x154, lpBuffer=0x19b3ca8*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19b3ca8*, lpNumberOfBytesWritten=0x2ae554*=0x19a0, lpOverlapped=0x0) returned 1 [0132.105] CloseHandle (hObject=0x154) returned 1 [0132.105] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3", lpFilePart=0x0) returned 0x2b [0132.105] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3.anonymous", lpFilePart=0x0) returned 0x35 [0132.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\lbrpti.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb0636f0, ftCreationTime.dwHighDateTime=0x1d41d98, ftLastAccessTime.dwLowDateTime=0x9c386070, ftLastAccessTime.dwHighDateTime=0x1d4157e, ftLastWriteTime.dwLowDateTime=0xedacfa50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19a0)) returned 1 [0132.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.105] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\lbrpti.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LBRpTI.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\lbrpti.mp3.anonymous")) returned 1 [0132.106] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp", lpFilePart=0x0) returned 0x2a [0132.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.107] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ljyuz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.107] GetFileType (hFile=0x154) returned 0x1 [0132.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.107] GetFileType (hFile=0x154) returned 0x1 [0132.107] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9830 [0132.107] ReadFile (in: hFile=0x154, lpBuffer=0x19b5980, nNumberOfBytesToRead=0x9830, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19b5980*, lpNumberOfBytesRead=0x2ae560*=0x9830, lpOverlapped=0x0) returned 1 [0132.109] CloseHandle (hObject=0x154) returned 1 [0132.123] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp", lpFilePart=0x0) returned 0x2a [0132.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.124] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ljyuz.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.125] GetFileType (hFile=0x154) returned 0x1 [0132.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.125] GetFileType (hFile=0x154) returned 0x1 [0132.125] WriteFile (in: hFile=0x154, lpBuffer=0x1a32204*, nNumberOfBytesToWrite=0x9840, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a32204*, lpNumberOfBytesWritten=0x2ae554*=0x9840, lpOverlapped=0x0) returned 1 [0132.127] CloseHandle (hObject=0x154) returned 1 [0132.127] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp", lpFilePart=0x0) returned 0x2a [0132.127] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp.anonymous", lpFilePart=0x0) returned 0x34 [0132.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ljyuz.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed73f880, ftCreationTime.dwHighDateTime=0x1d41cf6, ftLastAccessTime.dwLowDateTime=0x9c98cad0, ftLastAccessTime.dwHighDateTime=0x1d419ae, ftLastWriteTime.dwLowDateTime=0xedb1bd10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9840)) returned 1 [0132.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.127] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ljyuz.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\LJyUZ.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ljyuz.bmp.anonymous")) returned 1 [0132.128] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp", lpFilePart=0x0) returned 0x2d [0132.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.129] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\nkmglel7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.129] GetFileType (hFile=0x154) returned 0x1 [0132.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.129] GetFileType (hFile=0x154) returned 0x1 [0132.129] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xb22a [0132.129] ReadFile (in: hFile=0x154, lpBuffer=0x1a3bd84, nNumberOfBytesToRead=0xb22a, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a3bd84*, lpNumberOfBytesRead=0x2ae560*=0xb22a, lpOverlapped=0x0) returned 1 [0132.130] CloseHandle (hObject=0x154) returned 1 [0132.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp", lpFilePart=0x0) returned 0x2d [0132.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.148] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\nkmglel7.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.149] GetFileType (hFile=0x154) returned 0x1 [0132.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.149] GetFileType (hFile=0x154) returned 0x1 [0132.149] WriteFile (in: hFile=0x154, lpBuffer=0x1aaa214*, nNumberOfBytesToWrite=0xb230, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aaa214*, lpNumberOfBytesWritten=0x2ae554*=0xb230, lpOverlapped=0x0) returned 1 [0132.151] CloseHandle (hObject=0x154) returned 1 [0132.152] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp", lpFilePart=0x0) returned 0x2d [0132.152] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp.anonymous", lpFilePart=0x0) returned 0x37 [0132.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\nkmglel7.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb31011e0, ftCreationTime.dwHighDateTime=0x1d41906, ftLastAccessTime.dwLowDateTime=0xe6ac0830, ftLastAccessTime.dwHighDateTime=0x1d415a8, ftLastWriteTime.dwLowDateTime=0xedb41e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb230)) returned 1 [0132.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.152] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\nkmglel7.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\NKmGleL7.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\nkmglel7.bmp.anonymous")) returned 1 [0132.163] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3", lpFilePart=0x0) returned 0x37 [0132.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.163] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\od0jzu_2q_uzxbqt_y.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.163] GetFileType (hFile=0x154) returned 0x1 [0132.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.163] GetFileType (hFile=0x154) returned 0x1 [0132.163] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x150b [0132.163] ReadFile (in: hFile=0x154, lpBuffer=0x1ab57dc, nNumberOfBytesToRead=0x150b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1ab57dc*, lpNumberOfBytesRead=0x2ae560*=0x150b, lpOverlapped=0x0) returned 1 [0132.164] CloseHandle (hObject=0x154) returned 1 [0132.177] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3", lpFilePart=0x0) returned 0x37 [0132.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.177] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\od0jzu_2q_uzxbqt_y.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.179] GetFileType (hFile=0x154) returned 0x1 [0132.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.179] GetFileType (hFile=0x154) returned 0x1 [0132.179] WriteFile (in: hFile=0x154, lpBuffer=0x1b08f18*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b08f18*, lpNumberOfBytesWritten=0x2ae554*=0x1510, lpOverlapped=0x0) returned 1 [0132.180] CloseHandle (hObject=0x154) returned 1 [0132.180] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3", lpFilePart=0x0) returned 0x37 [0132.180] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3.anonymous", lpFilePart=0x0) returned 0x41 [0132.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\od0jzu_2q_uzxbqt_y.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a67d0f0, ftCreationTime.dwHighDateTime=0x1d41668, ftLastAccessTime.dwLowDateTime=0xab30e320, ftLastAccessTime.dwHighDateTime=0x1d41774, ftLastWriteTime.dwLowDateTime=0xedb8e130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1510)) returned 1 [0132.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.180] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\od0jzu_2q_uzxbqt_y.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oD0jZU_2q_UzXbQT_y.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\od0jzu_2q_uzxbqt_y.mp3.anonymous")) returned 1 [0132.181] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx", lpFilePart=0x0) returned 0x33 [0132.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.182] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\odvbunwtlsole.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.182] GetFileType (hFile=0x154) returned 0x1 [0132.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.182] GetFileType (hFile=0x154) returned 0x1 [0132.182] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xfe5f [0132.182] ReadFile (in: hFile=0x154, lpBuffer=0x1b0a7fc, nNumberOfBytesToRead=0xfe5f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b0a7fc*, lpNumberOfBytesRead=0x2ae560*=0xfe5f, lpOverlapped=0x0) returned 1 [0132.183] CloseHandle (hObject=0x154) returned 1 [0132.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx", lpFilePart=0x0) returned 0x33 [0132.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.197] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\odvbunwtlsole.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.199] GetFileType (hFile=0x154) returned 0x1 [0132.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.199] GetFileType (hFile=0x154) returned 0x1 [0132.199] WriteFile (in: hFile=0x154, lpBuffer=0x1b8711c*, nNumberOfBytesToWrite=0xfe60, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b8711c*, lpNumberOfBytesWritten=0x2ae554*=0xfe60, lpOverlapped=0x0) returned 1 [0132.201] CloseHandle (hObject=0x154) returned 1 [0132.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx", lpFilePart=0x0) returned 0x33 [0132.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx.anonymous", lpFilePart=0x0) returned 0x3d [0132.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\odvbunwtlsole.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9049470, ftCreationTime.dwHighDateTime=0x1d410e4, ftLastAccessTime.dwLowDateTime=0x2fc39e90, ftLastAccessTime.dwHighDateTime=0x1d41142, ftLastWriteTime.dwLowDateTime=0xedbda3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfe60)) returned 1 [0132.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.202] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\odvbunwtlsole.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\oDVBUnwtlSolE.docx.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\odvbunwtlsole.docx.anonymous")) returned 1 [0132.202] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf", lpFilePart=0x0) returned 0x2a [0132.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.202] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\orovh.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.203] GetFileType (hFile=0x154) returned 0x1 [0132.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.203] GetFileType (hFile=0x154) returned 0x1 [0132.203] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xcfd8 [0132.205] ReadFile (in: hFile=0x154, lpBuffer=0x1986558, nNumberOfBytesToRead=0xcfd8, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1986558*, lpNumberOfBytesRead=0x2ae560*=0xcfd8, lpOverlapped=0x0) returned 1 [0132.206] CloseHandle (hObject=0x154) returned 1 [0132.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf", lpFilePart=0x0) returned 0x2a [0132.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.246] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\orovh.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.248] GetFileType (hFile=0x154) returned 0x1 [0132.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.248] GetFileType (hFile=0x154) returned 0x1 [0132.248] WriteFile (in: hFile=0x154, lpBuffer=0x19fa450*, nNumberOfBytesToWrite=0xcfe0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19fa450*, lpNumberOfBytesWritten=0x2ae554*=0xcfe0, lpOverlapped=0x0) returned 1 [0132.250] CloseHandle (hObject=0x154) returned 1 [0132.250] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf", lpFilePart=0x0) returned 0x2a [0132.250] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf.anonymous", lpFilePart=0x0) returned 0x34 [0132.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\orovh.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376b29d0, ftCreationTime.dwHighDateTime=0x1d41348, ftLastAccessTime.dwLowDateTime=0x56fd1940, ftLastAccessTime.dwHighDateTime=0x1d412e7, ftLastWriteTime.dwLowDateTime=0xedc4c810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcfe0)) returned 1 [0132.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.250] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\orovh.rtf"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\orovh.rtf.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\orovh.rtf.anonymous")) returned 1 [0132.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp", lpFilePart=0x0) returned 0x34 [0132.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.251] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\owvdkggvqs6w_k_.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.251] GetFileType (hFile=0x154) returned 0x1 [0132.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.251] GetFileType (hFile=0x154) returned 0x1 [0132.251] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x5433 [0132.251] ReadFile (in: hFile=0x154, lpBuffer=0x1a0778c, nNumberOfBytesToRead=0x5433, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0778c*, lpNumberOfBytesRead=0x2ae560*=0x5433, lpOverlapped=0x0) returned 1 [0132.252] CloseHandle (hObject=0x154) returned 1 [0132.267] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp", lpFilePart=0x0) returned 0x34 [0132.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.268] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\owvdkggvqs6w_k_.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.269] GetFileType (hFile=0x154) returned 0x1 [0132.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.269] GetFileType (hFile=0x154) returned 0x1 [0132.270] WriteFile (in: hFile=0x154, lpBuffer=0x1a6eab8*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a6eab8*, lpNumberOfBytesWritten=0x2ae554*=0x5440, lpOverlapped=0x0) returned 1 [0132.271] CloseHandle (hObject=0x154) returned 1 [0132.271] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp", lpFilePart=0x0) returned 0x34 [0132.272] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp.anonymous", lpFilePart=0x0) returned 0x3e [0132.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.272] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\owvdkggvqs6w_k_.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8330d270, ftCreationTime.dwHighDateTime=0x1d41ef6, ftLastAccessTime.dwLowDateTime=0x6d487120, ftLastAccessTime.dwHighDateTime=0x1d411f9, ftLastWriteTime.dwLowDateTime=0xedc72970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5440)) returned 1 [0132.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.272] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\owvdkggvqs6w_k_.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\owvdkGgVQS6w_k_.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\owvdkggvqs6w_k_.bmp.anonymous")) returned 1 [0132.273] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg", lpFilePart=0x0) returned 0x36 [0132.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.273] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\rs7dknm4snvxjfuzk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.273] GetFileType (hFile=0x154) returned 0x1 [0132.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.273] GetFileType (hFile=0x154) returned 0x1 [0132.273] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc75f [0132.273] ReadFile (in: hFile=0x154, lpBuffer=0x1a742f0, nNumberOfBytesToRead=0xc75f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a742f0*, lpNumberOfBytesRead=0x2ae560*=0xc75f, lpOverlapped=0x0) returned 1 [0132.274] CloseHandle (hObject=0x154) returned 1 [0132.288] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg", lpFilePart=0x0) returned 0x36 [0132.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.288] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\rs7dknm4snvxjfuzk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.290] GetFileType (hFile=0x154) returned 0x1 [0132.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.290] GetFileType (hFile=0x154) returned 0x1 [0132.290] WriteFile (in: hFile=0x154, lpBuffer=0x1ae6710*, nNumberOfBytesToWrite=0xc760, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ae6710*, lpNumberOfBytesWritten=0x2ae554*=0xc760, lpOverlapped=0x0) returned 1 [0132.292] CloseHandle (hObject=0x154) returned 1 [0132.292] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg", lpFilePart=0x0) returned 0x36 [0132.292] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg.anonymous", lpFilePart=0x0) returned 0x40 [0132.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\rs7dknm4snvxjfuzk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30531110, ftCreationTime.dwHighDateTime=0x1d41b79, ftLastAccessTime.dwLowDateTime=0xd2abcfa0, ftLastAccessTime.dwHighDateTime=0x1d416d4, ftLastWriteTime.dwLowDateTime=0xedc98ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc760)) returned 1 [0132.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.292] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\rs7dknm4snvxjfuzk.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\rS7DkNM4sNvXjfuzK.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\rs7dknm4snvxjfuzk.jpg.anonymous")) returned 1 [0132.293] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif", lpFilePart=0x0) returned 0x37 [0132.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.293] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\w2zoj7q7wjuxud71u1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.293] GetFileType (hFile=0x154) returned 0x1 [0132.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.293] GetFileType (hFile=0x154) returned 0x1 [0132.293] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd9ad [0132.293] ReadFile (in: hFile=0x154, lpBuffer=0x1af3268, nNumberOfBytesToRead=0xd9ad, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af3268*, lpNumberOfBytesRead=0x2ae560*=0xd9ad, lpOverlapped=0x0) returned 1 [0132.294] CloseHandle (hObject=0x154) returned 1 [0132.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif", lpFilePart=0x0) returned 0x37 [0132.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.310] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\w2zoj7q7wjuxud71u1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.312] GetFileType (hFile=0x154) returned 0x1 [0132.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.312] GetFileType (hFile=0x154) returned 0x1 [0132.312] WriteFile (in: hFile=0x154, lpBuffer=0x1b68d78*, nNumberOfBytesToWrite=0xd9b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b68d78*, lpNumberOfBytesWritten=0x2ae554*=0xd9b0, lpOverlapped=0x0) returned 1 [0132.314] CloseHandle (hObject=0x154) returned 1 [0132.314] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif", lpFilePart=0x0) returned 0x37 [0132.314] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif.anonymous", lpFilePart=0x0) returned 0x41 [0132.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\w2zoj7q7wjuxud71u1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc21c6a30, ftCreationTime.dwHighDateTime=0x1d419c9, ftLastAccessTime.dwLowDateTime=0xebb7ba60, ftLastAccessTime.dwHighDateTime=0x1d41894, ftLastWriteTime.dwLowDateTime=0xedce4d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd9b0)) returned 1 [0132.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.315] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\w2zoj7q7wjuxud71u1.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\w2Zoj7Q7wjUxUD71U1.gif.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\w2zoj7q7wjuxud71u1.gif.anonymous")) returned 1 [0132.316] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx", lpFilePart=0x0) returned 0x37 [0132.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.316] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wwjgjs4g0aj2-rroe.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.316] GetFileType (hFile=0x154) returned 0x1 [0132.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.316] GetFileType (hFile=0x154) returned 0x1 [0132.316] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x12b25 [0132.316] ReadFile (in: hFile=0x154, lpBuffer=0x1b76b0c, nNumberOfBytesToRead=0x12b25, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b76b0c*, lpNumberOfBytesRead=0x2ae560*=0x12b25, lpOverlapped=0x0) returned 1 [0132.318] CloseHandle (hObject=0x154) returned 1 [0132.358] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx", lpFilePart=0x0) returned 0x37 [0132.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.358] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wwjgjs4g0aj2-rroe.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.360] GetFileType (hFile=0x154) returned 0x1 [0132.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.360] GetFileType (hFile=0x154) returned 0x1 [0132.360] WriteFile (in: hFile=0x154, lpBuffer=0x1a09ee4*, nNumberOfBytesToWrite=0x12b30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a09ee4*, lpNumberOfBytesWritten=0x2ae554*=0x12b30, lpOverlapped=0x0) returned 1 [0132.362] CloseHandle (hObject=0x154) returned 1 [0132.362] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx", lpFilePart=0x0) returned 0x37 [0132.362] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx.anonymous", lpFilePart=0x0) returned 0x41 [0132.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wwjgjs4g0aj2-rroe.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f2defc0, ftCreationTime.dwHighDateTime=0x1d410bc, ftLastAccessTime.dwLowDateTime=0x19bd9380, ftLastAccessTime.dwHighDateTime=0x1d41b38, ftLastWriteTime.dwLowDateTime=0xedd571b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12b30)) returned 1 [0132.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.363] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wwjgjs4g0aj2-rroe.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\wWJgjS4g0aj2-rroE.docx.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wwjgjs4g0aj2-rroe.docx.anonymous")) returned 1 [0132.363] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3", lpFilePart=0x0) returned 0x29 [0132.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.364] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wx6l.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.364] GetFileType (hFile=0x154) returned 0x1 [0132.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.364] GetFileType (hFile=0x154) returned 0x1 [0132.364] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x7a3d [0132.364] ReadFile (in: hFile=0x154, lpBuffer=0x1a1cdc0, nNumberOfBytesToRead=0x7a3d, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a1cdc0*, lpNumberOfBytesRead=0x2ae560*=0x7a3d, lpOverlapped=0x0) returned 1 [0132.365] CloseHandle (hObject=0x154) returned 1 [0132.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3", lpFilePart=0x0) returned 0x29 [0132.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.383] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wx6l.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.384] GetFileType (hFile=0x154) returned 0x1 [0132.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.384] GetFileType (hFile=0x154) returned 0x1 [0132.384] WriteFile (in: hFile=0x154, lpBuffer=0x1a90048*, nNumberOfBytesToWrite=0x7a40, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a90048*, lpNumberOfBytesWritten=0x2ae554*=0x7a40, lpOverlapped=0x0) returned 1 [0132.386] CloseHandle (hObject=0x154) returned 1 [0132.386] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3", lpFilePart=0x0) returned 0x29 [0132.386] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3.anonymous", lpFilePart=0x0) returned 0x33 [0132.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wx6l.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88b9c050, ftCreationTime.dwHighDateTime=0x1d41670, ftLastAccessTime.dwLowDateTime=0x34ac8e00, ftLastAccessTime.dwHighDateTime=0x1d41c67, ftLastWriteTime.dwLowDateTime=0xedd7d310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7a40)) returned 1 [0132.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.386] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wx6l.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\WX6l.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\wx6l.mp3.anonymous")) returned 1 [0132.387] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf", lpFilePart=0x0) returned 0x2a [0132.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.387] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xc73w.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.387] GetFileType (hFile=0x154) returned 0x1 [0132.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.387] GetFileType (hFile=0x154) returned 0x1 [0132.387] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x27d6 [0132.388] ReadFile (in: hFile=0x154, lpBuffer=0x1a97dac, nNumberOfBytesToRead=0x27d6, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a97dac*, lpNumberOfBytesRead=0x2ae560*=0x27d6, lpOverlapped=0x0) returned 1 [0132.388] CloseHandle (hObject=0x154) returned 1 [0132.402] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf", lpFilePart=0x0) returned 0x2a [0132.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.402] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xc73w.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.404] GetFileType (hFile=0x154) returned 0x1 [0132.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.404] GetFileType (hFile=0x154) returned 0x1 [0132.404] WriteFile (in: hFile=0x154, lpBuffer=0x1af12f8*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1af12f8*, lpNumberOfBytesWritten=0x2ae554*=0x27e0, lpOverlapped=0x0) returned 1 [0132.405] CloseHandle (hObject=0x154) returned 1 [0132.405] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf", lpFilePart=0x0) returned 0x2a [0132.405] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf.anonymous", lpFilePart=0x0) returned 0x34 [0132.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xc73w.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf362b1c0, ftCreationTime.dwHighDateTime=0x1d4132b, ftLastAccessTime.dwLowDateTime=0xe2eb5d70, ftLastAccessTime.dwHighDateTime=0x1d41d4d, ftLastWriteTime.dwLowDateTime=0xeddc95d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27e0)) returned 1 [0132.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.406] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xc73w.rtf"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xc73W.rtf.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xc73w.rtf.anonymous")) returned 1 [0132.407] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx", lpFilePart=0x0) returned 0x2f [0132.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.407] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xwelhsmo2.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.407] GetFileType (hFile=0x154) returned 0x1 [0132.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.407] GetFileType (hFile=0x154) returned 0x1 [0132.407] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xaac5 [0132.407] ReadFile (in: hFile=0x154, lpBuffer=0x1af3e20, nNumberOfBytesToRead=0xaac5, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af3e20*, lpNumberOfBytesRead=0x2ae560*=0xaac5, lpOverlapped=0x0) returned 1 [0132.408] CloseHandle (hObject=0x154) returned 1 [0132.424] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx", lpFilePart=0x0) returned 0x2f [0132.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.424] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xwelhsmo2.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.425] GetFileType (hFile=0x154) returned 0x1 [0132.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.425] GetFileType (hFile=0x154) returned 0x1 [0132.425] WriteFile (in: hFile=0x154, lpBuffer=0x1b60c90*, nNumberOfBytesToWrite=0xaad0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b60c90*, lpNumberOfBytesWritten=0x2ae554*=0xaad0, lpOverlapped=0x0) returned 1 [0132.427] CloseHandle (hObject=0x154) returned 1 [0132.427] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx", lpFilePart=0x0) returned 0x2f [0132.427] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx.anonymous", lpFilePart=0x0) returned 0x39 [0132.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xwelhsmo2.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x789ee2e0, ftCreationTime.dwHighDateTime=0x1d41468, ftLastAccessTime.dwLowDateTime=0x324887a0, ftLastAccessTime.dwHighDateTime=0x1d41617, ftLastWriteTime.dwLowDateTime=0xeddef730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaad0)) returned 1 [0132.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.427] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xwelhsmo2.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\xwElHSMO2.docx.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\xwelhsmo2.docx.anonymous")) returned 1 [0132.428] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png", lpFilePart=0x0) returned 0x37 [0132.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0132.428] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ymdy6-fayslj4bgwkx.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.428] GetFileType (hFile=0x154) returned 0x1 [0132.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0132.428] GetFileType (hFile=0x154) returned 0x1 [0132.428] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2274 [0132.428] ReadFile (in: hFile=0x154, lpBuffer=0x1b6bb0c, nNumberOfBytesToRead=0x2274, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b6bb0c*, lpNumberOfBytesRead=0x2ae560*=0x2274, lpOverlapped=0x0) returned 1 [0132.429] CloseHandle (hObject=0x154) returned 1 [0132.468] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png", lpFilePart=0x0) returned 0x37 [0132.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0132.469] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ymdy6-fayslj4bgwkx.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.470] GetFileType (hFile=0x154) returned 0x1 [0132.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0132.470] GetFileType (hFile=0x154) returned 0x1 [0132.470] WriteFile (in: hFile=0x154, lpBuffer=0x19b2ca8*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19b2ca8*, lpNumberOfBytesWritten=0x2ae554*=0x2280, lpOverlapped=0x0) returned 1 [0132.471] CloseHandle (hObject=0x154) returned 1 [0132.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png", lpFilePart=0x0) returned 0x37 [0132.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png.anonymous", lpFilePart=0x0) returned 0x41 [0132.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0132.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ymdy6-fayslj4bgwkx.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ca59ae0, ftCreationTime.dwHighDateTime=0x1d416ae, ftLastAccessTime.dwLowDateTime=0xaeb717c0, ftLastAccessTime.dwHighDateTime=0x1d41734, ftLastWriteTime.dwLowDateTime=0xede61b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2280)) returned 1 [0132.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.472] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ymdy6-fayslj4bgwkx.png"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\YmDy6-faysLJ4bgWkX.png.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\ymdy6-fayslj4bgwkx.png.anonymous")) returned 1 [0132.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.473] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x26 [0132.473] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x27 [0132.473] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.474] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.474] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.474] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.474] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.474] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.474] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.475] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.475] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.476] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x26 [0132.476] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x27 [0132.476] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.477] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.477] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.477] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.477] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.477] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.477] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.478] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.478] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.479] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2e [0132.479] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x2f [0132.479] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.480] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.480] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.480] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.480] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.481] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2e [0132.481] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x2f [0132.481] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.481] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.481] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.481] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.481] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.482] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x33 [0132.482] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x34 [0132.482] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.482] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.482] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.482] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.482] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.482] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.483] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.483] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.483] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x33 [0132.483] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x34 [0132.483] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.483] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.483] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.483] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.483] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.483] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.484] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.484] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.484] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3a [0132.484] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x3b [0132.484] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.484] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.484] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.484] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.485] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3a [0132.485] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x3b [0132.485] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.485] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.485] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.485] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.485] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x39 [0132.485] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x3a [0132.485] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.486] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.486] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.486] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.486] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x39 [0132.486] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x3a [0132.486] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.486] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.486] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.486] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x3f [0132.487] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x40 [0132.487] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.487] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.487] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.487] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.487] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.487] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x3f [0132.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x40 [0132.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.488] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.488] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.488] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.488] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.488] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x3c [0132.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x3d [0132.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.489] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.489] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.489] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.489] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.489] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x3c [0132.491] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x3d [0132.491] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.491] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.491] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.491] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.491] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.491] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.491] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x45 [0132.491] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x46 [0132.491] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0132.492] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.492] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.492] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.492] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.492] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.492] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x45 [0132.492] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x46 [0132.492] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0132.493] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.493] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.493] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.493] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.493] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.493] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x33 [0132.493] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x34 [0132.493] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.494] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.494] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.495] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.495] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x33 [0132.495] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x34 [0132.495] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.495] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.495] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.495] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.495] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3e [0132.496] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x3f [0132.496] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.496] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.496] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.496] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3e [0132.496] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x3f [0132.496] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.497] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.497] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.497] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.497] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x31 [0132.497] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x32 [0132.497] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.498] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.498] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.498] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x31 [0132.498] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x32 [0132.498] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.498] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.498] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.498] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.499] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x32 [0132.499] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x33 [0132.499] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.499] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.499] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.499] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.499] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.500] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x32 [0132.500] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x33 [0132.500] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.500] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.500] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.500] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.500] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.500] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x3f [0132.500] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x40 [0132.500] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.501] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.501] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.501] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.501] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x3f [0132.501] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x40 [0132.501] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.501] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.502] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.502] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.502] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x34 [0132.502] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x35 [0132.502] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.502] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.502] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.502] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.503] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x34 [0132.503] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x35 [0132.503] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.503] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.503] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.503] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.503] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b [0132.503] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c [0132.503] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.504] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.504] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.504] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.504] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.504] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b [0132.504] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c [0132.504] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.505] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.505] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.505] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.505] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.505] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpFilePart=0x0) returned 0x52 [0132.505] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", lpFilePart=0x0) returned 0x53 [0132.505] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.505] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.505] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.505] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.505] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}", lpFilePart=0x0) returned 0x52 [0132.505] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\", lpFilePart=0x0) returned 0x53 [0132.505] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Identities\\{74A13782-B361-4204-9DAA-0A3D49DA4337}\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.505] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.506] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.506] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.506] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2b [0132.506] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x2c [0132.506] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.506] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.506] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.506] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.506] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.506] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2b [0132.506] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x2c [0132.507] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.507] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.507] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.507] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.507] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.507] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x38 [0132.507] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x39 [0132.507] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.508] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.508] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.508] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.508] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.508] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x38 [0132.508] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x39 [0132.508] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.508] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.508] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.508] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.508] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.508] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x47 [0132.508] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x48 [0132.509] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.509] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.509] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.509] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.509] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.509] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x47 [0132.509] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x48 [0132.509] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.510] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.510] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.510] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.510] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.510] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x4f [0132.510] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x50 [0132.510] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.510] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.510] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.510] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.510] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.510] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x4f [0132.510] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x50 [0132.511] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.511] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.511] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.511] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.511] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.511] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5b [0132.511] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x5c [0132.511] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0132.512] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.512] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.512] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.512] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.512] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5b [0132.512] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x5c [0132.512] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed98 [0132.512] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.512] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.512] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.512] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0132.512] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x5f [0132.512] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x60 [0132.513] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbed98 [0132.513] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0132.513] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0132.513] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0132.513] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0132.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0132.513] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x5f [0132.513] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x60 [0132.513] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbed98 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0132.514] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0132.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.514] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0132.514] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b [0132.514] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.514] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.515] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0132.515] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0132.515] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b [0132.515] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed98 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.515] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0132.516] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0132.516] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0132.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0132.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.517] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x31 [0132.517] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x32 [0132.517] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.517] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.517] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.517] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.517] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x31 [0132.517] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x32 [0132.517] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.517] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.518] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.518] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.518] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36 [0132.518] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37 [0132.518] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.518] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.518] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.518] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.518] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36 [0132.518] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37 [0132.518] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.518] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.518] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.518] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.519] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x31 [0132.519] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x32 [0132.519] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.519] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.519] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.519] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.519] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.519] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x31 [0132.519] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x32 [0132.519] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.519] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.520] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.520] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.520] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.520] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x35 [0132.520] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x36 [0132.520] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.520] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.520] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.520] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.520] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.520] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x35 [0132.520] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x36 [0132.520] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.521] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.521] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.521] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.521] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.521] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000", lpFilePart=0x0) returned 0x63 [0132.521] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000\\", lpFilePart=0x0) returned 0x64 [0132.521] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.561] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.561] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.561] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.561] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.561] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.562] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000", lpFilePart=0x0) returned 0x63 [0132.562] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000\\", lpFilePart=0x0) returned 0x64 [0132.562] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3785418085-2572485238-895829336-1000\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.563] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.563] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.563] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.563] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.563] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x43 [0132.564] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x44 [0132.564] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.565] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.565] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.565] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.565] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x43 [0132.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x44 [0132.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.566] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.566] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.566] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.566] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x48 [0132.566] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x49 [0132.566] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.566] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.566] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.566] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.566] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x48 [0132.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x49 [0132.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.567] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.567] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.567] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.567] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x4b [0132.567] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x4c [0132.567] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.567] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.567] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.567] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.567] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x4b [0132.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x4c [0132.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0132.568] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.568] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.568] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.568] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x30 [0132.568] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x31 [0132.568] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.569] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.569] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.569] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.569] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x30 [0132.569] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x31 [0132.569] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.569] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.569] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0132.569] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0132.569] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x38 [0132.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x39 [0132.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.570] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.570] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x38 [0132.570] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x39 [0132.570] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.570] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.570] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help", lpFilePart=0x0) returned 0x34 [0132.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help\\", lpFilePart=0x0) returned 0x35 [0132.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.571] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help", lpFilePart=0x0) returned 0x34 [0132.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help\\", lpFilePart=0x0) returned 0x35 [0132.571] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\HTML Help\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.571] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x30 [0132.571] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x31 [0132.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.572] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x30 [0132.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x31 [0132.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.572] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.572] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x31 [0132.572] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x32 [0132.572] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.573] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x31 [0132.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x32 [0132.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.573] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.573] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x32 [0132.573] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x33 [0132.573] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.574] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x32 [0132.574] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x33 [0132.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.574] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x32 [0132.574] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x33 [0132.574] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.575] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.575] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x32 [0132.575] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x33 [0132.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.575] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.575] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0132.575] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d [0132.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.575] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0132.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0132.576] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d [0132.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0132.576] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0132.576] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a [0132.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.576] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0132.576] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a [0132.576] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0132.577] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0132.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFilePart=0x0) returned 0x5b [0132.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0132.577] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.577] GetFileType (hFile=0x154) returned 0x1 [0132.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0132.577] GetFileType (hFile=0x154) returned 0x1 [0132.577] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x8af [0132.579] CloseHandle (hObject=0x154) returned 1 [0132.590] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFilePart=0x0) returned 0x5b [0132.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0132.590] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.592] GetFileType (hFile=0x154) returned 0x1 [0132.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0132.592] GetFileType (hFile=0x154) returned 0x1 [0132.592] WriteFile (in: hFile=0x154, lpBuffer=0x1a46544*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a46544*, lpNumberOfBytesWritten=0x2ae3cc*=0x8b0, lpOverlapped=0x0) returned 1 [0132.593] CloseHandle (hObject=0x154) returned 1 [0132.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFilePart=0x0) returned 0x5b [0132.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.anonymous", lpFilePart=0x0) returned 0x65 [0132.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0132.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21b3df0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe21b3df0, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xedf92650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1 [0132.593] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.anonymous")) returned 1 [0132.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFilePart=0x0) returned 0x6e [0132.594] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.595] GetFileType (hFile=0x154) returned 0x1 [0132.595] GetFileType (hFile=0x154) returned 0x1 [0132.595] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x585 [0132.614] CloseHandle (hObject=0x154) returned 1 [0132.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFilePart=0x0) returned 0x6e [0132.626] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.627] GetFileType (hFile=0x154) returned 0x1 [0132.627] GetFileType (hFile=0x154) returned 0x1 [0132.627] WriteFile (in: hFile=0x154, lpBuffer=0x1a97a7c*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a97a7c*, lpNumberOfBytesWritten=0x2ae3cc*=0x590, lpOverlapped=0x0) returned 1 [0132.628] CloseHandle (hObject=0x154) returned 1 [0132.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFilePart=0x0) returned 0x6e [0132.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.anonymous", lpFilePart=0x0) returned 0x78 [0132.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x756ed8d0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x756ed8d0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xedfde910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0132.628] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.anonymous")) returned 1 [0132.629] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", lpFilePart=0x0) returned 0x5f [0132.629] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.631] GetFileType (hFile=0x154) returned 0x1 [0132.631] GetFileType (hFile=0x154) returned 0x1 [0132.631] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x453 [0132.632] CloseHandle (hObject=0x154) returned 1 [0132.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", lpFilePart=0x0) returned 0x5f [0132.644] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.646] GetFileType (hFile=0x154) returned 0x1 [0132.646] GetFileType (hFile=0x154) returned 0x1 [0132.646] WriteFile (in: hFile=0x154, lpBuffer=0x1ae888c*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae888c*, lpNumberOfBytesWritten=0x2ae3cc*=0x460, lpOverlapped=0x0) returned 1 [0132.647] CloseHandle (hObject=0x154) returned 1 [0132.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", lpFilePart=0x0) returned 0x5f [0132.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.anonymous", lpFilePart=0x0) returned 0x69 [0132.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a75020, ftCreationTime.dwHighDateTime=0x1d2fb32, ftLastAccessTime.dwLowDateTime=0x77a75020, ftLastAccessTime.dwHighDateTime=0x1d2fb32, ftLastWriteTime.dwLowDateTime=0xee004a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0132.647] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.anonymous")) returned 1 [0132.648] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x5b [0132.648] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.648] GetFileType (hFile=0x154) returned 0x1 [0132.648] GetFileType (hFile=0x154) returned 0x1 [0132.649] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x122 [0132.650] CloseHandle (hObject=0x154) returned 1 [0132.661] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x5b [0132.661] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.663] GetFileType (hFile=0x154) returned 0x1 [0132.663] GetFileType (hFile=0x154) returned 0x1 [0132.663] WriteFile (in: hFile=0x154, lpBuffer=0x1b382fc*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b382fc*, lpNumberOfBytesWritten=0x2ae3cc*=0x130, lpOverlapped=0x0) returned 1 [0132.664] CloseHandle (hObject=0x154) returned 1 [0132.664] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x5b [0132.664] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.anonymous", lpFilePart=0x0) returned 0x65 [0132.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57110, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f57110, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee02abd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1 [0132.664] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.anonymous")) returned 1 [0132.665] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x5d [0132.665] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.666] GetFileType (hFile=0x154) returned 0x1 [0132.666] GetFileType (hFile=0x154) returned 0x1 [0132.666] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x110 [0132.667] CloseHandle (hObject=0x154) returned 1 [0132.679] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x5d [0132.679] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.680] GetFileType (hFile=0x154) returned 0x1 [0132.680] GetFileType (hFile=0x154) returned 0x1 [0132.680] WriteFile (in: hFile=0x154, lpBuffer=0x1b87d00*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b87d00*, lpNumberOfBytesWritten=0x2ae3cc*=0x120, lpOverlapped=0x0) returned 1 [0132.681] CloseHandle (hObject=0x154) returned 1 [0132.682] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x5d [0132.682] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.anonymous", lpFilePart=0x0) returned 0x67 [0132.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57110, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f57110, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee050d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0132.682] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.anonymous")) returned 1 [0132.683] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55 [0132.683] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56 [0132.683] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0132.686] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.686] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.686] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.686] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0132.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.686] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55 [0132.686] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56 [0132.687] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0132.687] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.687] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.687] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.687] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.687] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0132.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.687] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a [0132.687] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b [0132.687] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0132.688] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.688] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.688] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0132.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a [0132.688] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b [0132.688] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0132.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.689] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0132.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.689] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d [0132.689] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e [0132.689] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0132.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.690] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0132.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.691] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d [0132.691] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e [0132.691] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0132.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.692] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0132.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.692] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFilePart=0x0) returned 0x6f [0132.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.692] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.693] GetFileType (hFile=0x154) returned 0x1 [0132.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.693] GetFileType (hFile=0x154) returned 0x1 [0132.693] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x8a3 [0132.693] ReadFile (in: hFile=0x154, lpBuffer=0x199032c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x199032c*, lpNumberOfBytesRead=0x2ae31c*=0x8a3, lpOverlapped=0x0) returned 1 [0132.694] CloseHandle (hObject=0x154) returned 1 [0132.729] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFilePart=0x0) returned 0x6f [0132.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.729] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.730] GetFileType (hFile=0x154) returned 0x1 [0132.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.731] GetFileType (hFile=0x154) returned 0x1 [0132.732] CloseHandle (hObject=0x154) returned 1 [0132.732] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFilePart=0x0) returned 0x6f [0132.732] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.anonymous", lpFilePart=0x0) returned 0x79 [0132.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.732] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe224c370, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe224c370, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xee0e92b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1 [0132.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.732] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.anonymous")) returned 1 [0132.734] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFilePart=0x0) returned 0x77 [0132.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.734] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.734] GetFileType (hFile=0x154) returned 0x1 [0132.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.734] GetFileType (hFile=0x154) returned 0x1 [0132.734] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x58b [0132.734] ReadFile (in: hFile=0x154, lpBuffer=0x19e29b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19e29b0*, lpNumberOfBytesRead=0x2ae31c*=0x58b, lpOverlapped=0x0) returned 1 [0132.735] CloseHandle (hObject=0x154) returned 1 [0132.747] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFilePart=0x0) returned 0x77 [0132.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.747] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.748] GetFileType (hFile=0x154) returned 0x1 [0132.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.749] GetFileType (hFile=0x154) returned 0x1 [0132.749] WriteFile (in: hFile=0x154, lpBuffer=0x1a32514*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a32514*, lpNumberOfBytesWritten=0x2ae2e4*=0x590, lpOverlapped=0x0) returned 1 [0132.750] CloseHandle (hObject=0x154) returned 1 [0132.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFilePart=0x0) returned 0x77 [0132.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.anonymous", lpFilePart=0x0) returned 0x81 [0132.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.750] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64e0f0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0xd64e0f0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee10f410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0132.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.750] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.anonymous")) returned 1 [0132.751] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x73 [0132.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.752] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.752] GetFileType (hFile=0x154) returned 0x1 [0132.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.752] GetFileType (hFile=0x154) returned 0x1 [0132.752] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x58b [0132.752] ReadFile (in: hFile=0x154, lpBuffer=0x1a33f70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a33f70*, lpNumberOfBytesRead=0x2ae31c*=0x58b, lpOverlapped=0x0) returned 1 [0132.784] CloseHandle (hObject=0x154) returned 1 [0132.795] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x73 [0132.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.796] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.797] GetFileType (hFile=0x154) returned 0x1 [0132.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.797] GetFileType (hFile=0x154) returned 0x1 [0132.798] CloseHandle (hObject=0x154) returned 1 [0132.798] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x73 [0132.798] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x7d [0132.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57110, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f57110, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee181830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0132.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.798] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.anonymous")) returned 1 [0132.799] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x71 [0132.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.800] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.800] GetFileType (hFile=0x154) returned 0x1 [0132.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.800] GetFileType (hFile=0x154) returned 0x1 [0132.800] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x463 [0132.800] ReadFile (in: hFile=0x154, lpBuffer=0x1a853d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a853d8*, lpNumberOfBytesRead=0x2ae31c*=0x463, lpOverlapped=0x0) returned 1 [0132.801] CloseHandle (hObject=0x154) returned 1 [0132.812] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x71 [0132.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.813] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.814] GetFileType (hFile=0x154) returned 0x1 [0132.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.814] GetFileType (hFile=0x154) returned 0x1 [0132.814] WriteFile (in: hFile=0x154, lpBuffer=0x1ad498c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1ad498c*, lpNumberOfBytesWritten=0x2ae2e4*=0x470, lpOverlapped=0x0) returned 1 [0132.815] CloseHandle (hObject=0x154) returned 1 [0132.815] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x71 [0132.815] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.anonymous", lpFilePart=0x0) returned 0x7b [0132.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773778f0, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x86d6a600, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xee1a7990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x470)) returned 1 [0132.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.815] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.anonymous")) returned 1 [0132.816] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFilePart=0x0) returned 0x76 [0132.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.816] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.817] GetFileType (hFile=0x154) returned 0x1 [0132.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.817] GetFileType (hFile=0x154) returned 0x1 [0132.817] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x4cc [0132.817] ReadFile (in: hFile=0x154, lpBuffer=0x1ad6314, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1ad6314*, lpNumberOfBytesRead=0x2ae31c*=0x4cc, lpOverlapped=0x0) returned 1 [0132.818] CloseHandle (hObject=0x154) returned 1 [0132.830] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFilePart=0x0) returned 0x76 [0132.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.830] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.832] GetFileType (hFile=0x154) returned 0x1 [0132.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.832] GetFileType (hFile=0x154) returned 0x1 [0132.833] CloseHandle (hObject=0x154) returned 1 [0132.833] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFilePart=0x0) returned 0x76 [0132.833] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.anonymous", lpFilePart=0x0) returned 0x80 [0132.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd674250, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0xd674250, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee1cdaf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0132.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.833] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.anonymous")) returned 1 [0132.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x72 [0132.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.835] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.835] GetFileType (hFile=0x154) returned 0x1 [0132.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.835] GetFileType (hFile=0x154) returned 0x1 [0132.835] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x4cc [0132.835] ReadFile (in: hFile=0x154, lpBuffer=0x1b27450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b27450*, lpNumberOfBytesRead=0x2ae31c*=0x4cc, lpOverlapped=0x0) returned 1 [0132.837] CloseHandle (hObject=0x154) returned 1 [0132.849] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x72 [0132.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.849] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.850] GetFileType (hFile=0x154) returned 0x1 [0132.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.850] GetFileType (hFile=0x154) returned 0x1 [0132.850] WriteFile (in: hFile=0x154, lpBuffer=0x1b76be0*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1b76be0*, lpNumberOfBytesWritten=0x2ae2e4*=0x4d0, lpOverlapped=0x0) returned 1 [0132.851] CloseHandle (hObject=0x154) returned 1 [0132.852] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x72 [0132.852] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x7c [0132.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57110, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f57110, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee1f3c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0132.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.852] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.anonymous")) returned 1 [0132.853] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFilePart=0x0) returned 0x7a [0132.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.853] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.853] GetFileType (hFile=0x154) returned 0x1 [0132.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.853] GetFileType (hFile=0x154) returned 0x1 [0132.853] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x5eb [0132.853] ReadFile (in: hFile=0x154, lpBuffer=0x1b786a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b786a4*, lpNumberOfBytesRead=0x2ae31c*=0x5eb, lpOverlapped=0x0) returned 1 [0132.854] CloseHandle (hObject=0x154) returned 1 [0132.908] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFilePart=0x0) returned 0x7a [0132.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.908] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.909] GetFileType (hFile=0x154) returned 0x1 [0132.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.910] GetFileType (hFile=0x154) returned 0x1 [0132.910] WriteFile (in: hFile=0x154, lpBuffer=0x19c9684*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19c9684*, lpNumberOfBytesWritten=0x2ae2e4*=0x5f0, lpOverlapped=0x0) returned 1 [0132.911] CloseHandle (hObject=0x154) returned 1 [0132.911] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFilePart=0x0) returned 0x7a [0132.911] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.anonymous", lpFilePart=0x0) returned 0x84 [0132.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69a3b0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0xd69a3b0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee28c1d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f0)) returned 1 [0132.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.912] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.anonymous")) returned 1 [0132.913] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x76 [0132.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.913] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.914] GetFileType (hFile=0x154) returned 0x1 [0132.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.914] GetFileType (hFile=0x154) returned 0x1 [0132.914] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x5eb [0132.914] ReadFile (in: hFile=0x154, lpBuffer=0x19cb168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19cb168*, lpNumberOfBytesRead=0x2ae31c*=0x5eb, lpOverlapped=0x0) returned 1 [0132.921] CloseHandle (hObject=0x154) returned 1 [0132.934] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x76 [0132.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0132.935] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.936] GetFileType (hFile=0x154) returned 0x1 [0132.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0132.936] GetFileType (hFile=0x154) returned 0x1 [0132.936] WriteFile (in: hFile=0x154, lpBuffer=0x1a1b008*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a1b008*, lpNumberOfBytesWritten=0x2ae2e4*=0x5f0, lpOverlapped=0x0) returned 1 [0132.937] CloseHandle (hObject=0x154) returned 1 [0132.937] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x76 [0132.937] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.anonymous", lpFilePart=0x0) returned 0x80 [0132.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0132.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f57110, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f57110, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xee2d8490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5f0)) returned 1 [0132.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0132.938] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.anonymous")) returned 1 [0132.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.939] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x45 [0132.939] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x46 [0132.939] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0132.941] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.941] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.941] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.941] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.941] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.941] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.942] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.942] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.942] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0132.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0132.942] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x45 [0132.942] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x46 [0132.942] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea98 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.943] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0132.944] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0132.944] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0132.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0132.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0132.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.944] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH", lpFilePart=0x0) returned 0x4e [0132.944] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\", lpFilePart=0x0) returned 0x4f [0132.944] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0132.945] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.945] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.945] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.945] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0132.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.946] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH", lpFilePart=0x0) returned 0x4e [0132.946] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\", lpFilePart=0x0) returned 0x4f [0132.946] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea98 [0132.946] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.946] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.946] FindNextFileW (in: hFindFile=0xbea98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.946] FindClose (in: hFindFile=0xbea98 | out: hFindFile=0xbea98) returned 1 [0132.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml", lpFilePart=0x0) returned 0x58 [0132.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0132.947] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\l3dk0kah\\id[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.947] GetFileType (hFile=0x154) returned 0x1 [0132.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0132.948] GetFileType (hFile=0x154) returned 0x1 [0132.948] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x56 [0132.948] ReadFile (in: hFile=0x154, lpBuffer=0x1a20a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a20a28*, lpNumberOfBytesRead=0x2ae390*=0x56, lpOverlapped=0x0) returned 1 [0132.949] CloseHandle (hObject=0x154) returned 1 [0132.978] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml", lpFilePart=0x0) returned 0x58 [0132.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0132.986] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\l3dk0kah\\id[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.987] GetFileType (hFile=0x154) returned 0x1 [0132.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0132.987] GetFileType (hFile=0x154) returned 0x1 [0132.988] WriteFile (in: hFile=0x154, lpBuffer=0x1a6eb48*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a6eb48*, lpNumberOfBytesWritten=0x2ae358*=0x60, lpOverlapped=0x0) returned 1 [0132.989] CloseHandle (hObject=0x154) returned 1 [0132.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml", lpFilePart=0x0) returned 0x58 [0132.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml.anonymous", lpFilePart=0x0) returned 0x62 [0132.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0132.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\l3dk0kah\\id[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9f2c960, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9f2c960, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee34a8b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0132.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.989] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\l3dk0kah\\id[1].xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\L3DK0KAH\\id[1].xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\l3dk0kah\\id[1].xml.anonymous")) returned 1 [0132.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.990] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x49 [0132.990] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x4a [0132.990] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0132.990] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.990] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.990] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.990] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.990] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.991] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.991] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.991] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0132.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0132.991] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x49 [0132.991] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x4a [0132.991] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed58 [0132.991] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.991] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.991] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.992] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.992] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.992] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0132.992] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0132.992] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0132.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0132.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0132.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.992] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB", lpFilePart=0x0) returned 0x52 [0132.992] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB\\", lpFilePart=0x0) returned 0x53 [0132.992] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0132.993] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.993] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.993] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0132.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.993] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB", lpFilePart=0x0) returned 0x52 [0132.993] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB\\", lpFilePart=0x0) returned 0x53 [0132.993] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\05P2C0FB\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0132.993] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.994] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.994] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0132.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF", lpFilePart=0x0) returned 0x52 [0132.994] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\", lpFilePart=0x0) returned 0x53 [0132.994] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0132.994] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.994] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.994] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.994] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0132.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0132.995] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbed58 [0132.995] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.995] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0132.995] FindNextFileW (in: hFindFile=0xbed58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0132.995] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0132.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0132.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0132.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0132.995] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\3q4bcxjf\\id[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0132.996] GetFileType (hFile=0x154) returned 0x1 [0132.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0132.996] GetFileType (hFile=0x154) returned 0x1 [0132.996] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x56 [0132.996] ReadFile (in: hFile=0x154, lpBuffer=0x1a75c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a75c38*, lpNumberOfBytesRead=0x2ae31c*=0x56, lpOverlapped=0x0) returned 1 [0132.997] CloseHandle (hObject=0x154) returned 1 [0133.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0133.017] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\3q4bcxjf\\id[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.019] GetFileType (hFile=0x154) returned 0x1 [0133.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0133.019] GetFileType (hFile=0x154) returned 0x1 [0133.019] WriteFile (in: hFile=0x154, lpBuffer=0x1ac3d60*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1ac3d60*, lpNumberOfBytesWritten=0x2ae2e4*=0x60, lpOverlapped=0x0) returned 1 [0133.020] CloseHandle (hObject=0x154) returned 1 [0133.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0133.020] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\3q4bcxjf\\id[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d6b95f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d6b95f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xee396b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0133.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0133.021] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\id[1].xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\3q4bcxjf\\id[1].xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\3Q4BCXJF\\id[1].xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\3q4bcxjf\\id[1].xml.anonymous")) returned 1 [0133.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0133.021] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\SFX4RKM5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbedd8 [0133.021] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.022] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0133.022] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0133.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0133.022] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\SFX4RKM5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbedd8 [0133.022] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.022] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0133.022] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0133.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0133.022] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\T9DX4T6Q\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbedd8 [0133.023] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.023] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0133.024] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0133.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0133.025] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\T9DX4T6Q\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbedd8 [0133.025] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.025] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0133.026] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0133.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.026] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\PB5UWKXI\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.026] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.027] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.027] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.027] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\PB5UWKXI\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.027] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.027] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.027] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.027] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\TIIZUCFY\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.028] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.028] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.028] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.028] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\TIIZUCFY\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.029] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.029] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.029] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.029] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\ZQH8NGYD\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.031] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.031] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.031] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.031] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\ZQH8NGYD\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.031] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.031] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.031] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.032] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.042] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.042] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.042] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.043] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.043] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.043] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.043] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.043] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.043] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.044] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.044] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.044] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.044] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.044] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.044] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.045] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.046] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.046] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0133.048] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.048] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.048] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.052] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.052] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0133.052] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.052] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.052] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.052] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.052] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.053] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.053] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.053] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.053] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.053] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.053] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.053] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.054] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.054] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.054] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.055] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.056] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.056] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.056] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.056] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.056] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.056] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.056] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.056] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.057] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0133.057] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.057] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.057] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.057] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.057] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0133.057] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.057] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.057] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.057] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.058] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.058] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.058] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.058] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.058] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.058] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbedd8 [0133.058] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.058] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.058] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.058] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0133.071] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbedd8 [0133.071] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.071] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.071] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0133.071] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0133.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0133.071] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbedd8 [0133.071] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.071] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0133.071] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0133.071] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0133.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.071] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.072] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.072] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.072] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.072] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.073] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.074] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.074] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbedd8 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.074] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.075] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.075] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.081] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.081] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.081] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.081] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.081] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.081] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbedd8 [0133.082] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.082] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.082] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.082] FindNextFileW (in: hFindFile=0xbedd8, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.085] FindClose (in: hFindFile=0xbedd8 | out: hFindFile=0xbedd8) returned 1 [0133.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0133.085] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.086] GetFileType (hFile=0x154) returned 0x1 [0133.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0133.086] GetFileType (hFile=0x154) returned 0x1 [0133.086] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x912 [0133.086] ReadFile (in: hFile=0x154, lpBuffer=0x1add04c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1add04c*, lpNumberOfBytesRead=0x2ae478*=0x912, lpOverlapped=0x0) returned 1 [0133.105] CloseHandle (hObject=0x154) returned 1 [0133.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0133.121] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.123] GetFileType (hFile=0x154) returned 0x1 [0133.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0133.123] GetFileType (hFile=0x154) returned 0x1 [0133.123] WriteFile (in: hFile=0x154, lpBuffer=0x1b2dcfc*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b2dcfc*, lpNumberOfBytesWritten=0x2ae440*=0x920, lpOverlapped=0x0) returned 1 [0133.124] CloseHandle (hObject=0x154) returned 1 [0133.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0133.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c002f00, ftCreationTime.dwHighDateTime=0x1d2fb32, ftLastAccessTime.dwLowDateTime=0x9c002f00, ftLastAccessTime.dwHighDateTime=0x1d2fb32, ftLastWriteTime.dwLowDateTime=0xee4a1510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x920)) returned 1 [0133.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.125] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.anonymous")) returned 1 [0133.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.126] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.126] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.128] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.128] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.128] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.129] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.129] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.129] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.130] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.130] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.130] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.131] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.131] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.131] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.131] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.131] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.131] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.131] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0133.150] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.150] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.150] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.150] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.150] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.151] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3149542145-3322839065-4058237693-500\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0133.152] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.152] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.152] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.152] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.153] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.154] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3785418085-2572485238-895829336-1000\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.154] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.154] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3785418085-2572485238-895829336-1000\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.154] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.155] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.155] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.155] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.155] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.155] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.155] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.155] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.155] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.156] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.156] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.157] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.157] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.158] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.158] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.158] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0133.158] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.158] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.158] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.158] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0133.158] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.158] GetFileType (hFile=0x154) returned 0x1 [0133.158] GetFileType (hFile=0x154) returned 0x1 [0133.158] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa8 [0133.159] ReadFile (in: hFile=0x154, lpBuffer=0x1b3bd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b3bd80*, lpNumberOfBytesRead=0x2ae478*=0xa8, lpOverlapped=0x0) returned 1 [0133.160] CloseHandle (hObject=0x154) returned 1 [0133.180] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x55 [0133.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0133.180] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.181] GetFileType (hFile=0x154) returned 0x1 [0133.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0133.181] GetFileType (hFile=0x154) returned 0x1 [0133.181] WriteFile (in: hFile=0x154, lpBuffer=0x198873c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x198873c*, lpNumberOfBytesWritten=0x2ae440*=0xb0, lpOverlapped=0x0) returned 1 [0133.182] CloseHandle (hObject=0x154) returned 1 [0133.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x55 [0133.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.anonymous", lpFilePart=0x0) returned 0x5f [0133.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0133.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe1e17df0, ftCreationTime.dwHighDateTime=0x1d2da1a, ftLastAccessTime.dwLowDateTime=0xe1e17df0, ftLastAccessTime.dwHighDateTime=0x1d2da1a, ftLastWriteTime.dwLowDateTime=0xee513930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0133.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.183] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.anonymous")) returned 1 [0133.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.184] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x31 [0133.184] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x32 [0133.184] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.185] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.185] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.185] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.185] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x31 [0133.185] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x32 [0133.185] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.185] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.185] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.185] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.186] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3d [0133.186] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x3e [0133.186] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.186] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.186] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.186] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.187] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.187] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3d [0133.187] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x3e [0133.187] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.187] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.187] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.187] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.187] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.187] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x40 [0133.188] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x41 [0133.188] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0133.188] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.188] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.188] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.188] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.188] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.188] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x40 [0133.189] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x41 [0133.189] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0133.189] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.189] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.189] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.189] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.189] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.189] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4d [0133.189] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x4e [0133.190] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0133.190] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.190] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.190] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4d [0133.190] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x4e [0133.190] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0133.190] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.191] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.191] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x45 [0133.191] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x46 [0133.191] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0133.191] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.191] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.191] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x45 [0133.192] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x46 [0133.192] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0133.192] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.192] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.192] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.192] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x45 [0133.192] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x46 [0133.192] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0133.193] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.193] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.193] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x45 [0133.193] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x46 [0133.193] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbed98 [0133.193] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.193] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.194] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.194] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x34 [0133.194] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x35 [0133.194] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.196] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.196] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.196] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.196] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.196] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.197] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x34 [0133.197] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x35 [0133.197] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.198] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.199] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.199] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.199] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.199] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x31 [0133.200] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x32 [0133.200] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.201] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.201] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.201] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.201] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.201] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x31 [0133.201] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x32 [0133.201] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.201] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.201] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.202] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.202] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.202] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32 [0133.202] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x33 [0133.202] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.202] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.202] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.202] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.202] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.203] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.204] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.204] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.204] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0133.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x33 [0133.204] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed98 [0133.204] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.204] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.204] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.205] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0133.206] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0133.206] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0133.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0133.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.206] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3a [0133.206] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x3b [0133.206] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0133.207] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.207] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.207] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.207] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.208] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.209] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.210] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.210] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.210] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.210] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.210] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0133.210] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3a [0133.210] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x3b [0133.210] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed98 [0133.210] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.211] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.212] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.213] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0133.214] FindNextFileW (in: hFindFile=0xbed98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0133.214] FindClose (in: hFindFile=0xbed98 | out: hFindFile=0xbed98) returned 1 [0133.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0133.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0133.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x5e [0133.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.214] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.215] GetFileType (hFile=0x154) returned 0x1 [0133.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.215] GetFileType (hFile=0x154) returned 0x1 [0133.215] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x59 [0133.215] ReadFile (in: hFile=0x154, lpBuffer=0x199fab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x199fab0*, lpNumberOfBytesRead=0x2ae404*=0x59, lpOverlapped=0x0) returned 1 [0133.216] CloseHandle (hObject=0x154) returned 1 [0133.243] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x5e [0133.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.244] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.245] GetFileType (hFile=0x154) returned 0x1 [0133.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.245] GetFileType (hFile=0x154) returned 0x1 [0133.245] WriteFile (in: hFile=0x154, lpBuffer=0x19edd68*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19edd68*, lpNumberOfBytesWritten=0x2ae3cc*=0x60, lpOverlapped=0x0) returned 1 [0133.246] CloseHandle (hObject=0x154) returned 1 [0133.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x5e [0133.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt.anonymous", lpFilePart=0x0) returned 0x68 [0133.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@ad13.adfarm1.adition[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb95cd2c0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb95cd2c0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee5d2010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0133.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.247] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@ad13.adfarm1.adition[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@ad13.adfarm1.adition[1].txt.anonymous")) returned 1 [0133.250] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x59 [0133.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.250] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.251] GetFileType (hFile=0x154) returned 0x1 [0133.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.251] GetFileType (hFile=0x154) returned 0x1 [0133.251] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x65 [0133.251] ReadFile (in: hFile=0x154, lpBuffer=0x19ef1f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ef1f0*, lpNumberOfBytesRead=0x2ae404*=0x65, lpOverlapped=0x0) returned 1 [0133.252] CloseHandle (hObject=0x154) returned 1 [0133.264] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x59 [0133.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.264] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adfarm1.adition[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.265] GetFileType (hFile=0x154) returned 0x1 [0133.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.265] GetFileType (hFile=0x154) returned 0x1 [0133.266] CloseHandle (hObject=0x154) returned 1 [0133.266] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x59 [0133.267] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt.anonymous", lpFilePart=0x0) returned 0x63 [0133.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adfarm1.adition[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9534d40, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9534d40, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee5f8170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0133.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.267] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adfarm1.adition[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adfarm1.adition[1].txt.anonymous")) returned 1 [0133.268] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt", lpFilePart=0x0) returned 0x50 [0133.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.268] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.269] GetFileType (hFile=0x154) returned 0x1 [0133.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.269] GetFileType (hFile=0x154) returned 0x1 [0133.269] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x49 [0133.269] ReadFile (in: hFile=0x154, lpBuffer=0x1a3e780, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3e780*, lpNumberOfBytesRead=0x2ae404*=0x49, lpOverlapped=0x0) returned 1 [0133.270] CloseHandle (hObject=0x154) returned 1 [0133.281] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt", lpFilePart=0x0) returned 0x50 [0133.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.282] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adform[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.283] GetFileType (hFile=0x154) returned 0x1 [0133.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.283] GetFileType (hFile=0x154) returned 0x1 [0133.284] CloseHandle (hObject=0x154) returned 1 [0133.284] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt", lpFilePart=0x0) returned 0x50 [0133.284] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt.anonymous", lpFilePart=0x0) returned 0x5a [0133.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adform[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9581000, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9581000, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee61e2d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0133.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.284] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adform[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adform[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adform[1].txt.anonymous")) returned 1 [0133.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt", lpFilePart=0x0) returned 0x4f [0133.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.286] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.287] GetFileType (hFile=0x154) returned 0x1 [0133.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.287] GetFileType (hFile=0x154) returned 0x1 [0133.287] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x22a [0133.287] ReadFile (in: hFile=0x154, lpBuffer=0x1a8de54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8de54*, lpNumberOfBytesRead=0x2ae404*=0x22a, lpOverlapped=0x0) returned 1 [0133.288] CloseHandle (hObject=0x154) returned 1 [0133.300] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt", lpFilePart=0x0) returned 0x4f [0133.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.300] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adnxs[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.301] GetFileType (hFile=0x154) returned 0x1 [0133.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.301] GetFileType (hFile=0x154) returned 0x1 [0133.302] CloseHandle (hObject=0x154) returned 1 [0133.302] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt", lpFilePart=0x0) returned 0x4f [0133.302] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt.anonymous", lpFilePart=0x0) returned 0x59 [0133.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adnxs[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9581000, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xba37d140, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee644430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0133.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.303] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adnxs[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adnxs[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adnxs[1].txt.anonymous")) returned 1 [0133.303] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt", lpFilePart=0x0) returned 0x50 [0133.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.303] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.304] GetFileType (hFile=0x154) returned 0x1 [0133.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.304] GetFileType (hFile=0x154) returned 0x1 [0133.304] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x66 [0133.304] ReadFile (in: hFile=0x154, lpBuffer=0x1addc84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1addc84*, lpNumberOfBytesRead=0x2ae404*=0x66, lpOverlapped=0x0) returned 1 [0133.305] CloseHandle (hObject=0x154) returned 1 [0133.318] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt", lpFilePart=0x0) returned 0x50 [0133.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.318] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adtech[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.319] GetFileType (hFile=0x154) returned 0x1 [0133.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.319] GetFileType (hFile=0x154) returned 0x1 [0133.319] WriteFile (in: hFile=0x154, lpBuffer=0x1b2bdcc*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b2bdcc*, lpNumberOfBytesWritten=0x2ae3cc*=0x70, lpOverlapped=0x0) returned 1 [0133.320] CloseHandle (hObject=0x154) returned 1 [0133.320] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt", lpFilePart=0x0) returned 0x50 [0133.320] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt.anonymous", lpFilePart=0x0) returned 0x5a [0133.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.321] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adtech[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8ea90c0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb8ea90c0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee66a590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0133.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.321] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adtech[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@adtech[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@adtech[2].txt.anonymous")) returned 1 [0133.322] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt", lpFilePart=0x0) returned 0x55 [0133.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.322] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.323] GetFileType (hFile=0x154) returned 0x1 [0133.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.323] GetFileType (hFile=0x154) returned 0x1 [0133.323] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x11a [0133.323] ReadFile (in: hFile=0x154, lpBuffer=0x1b2d2a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b2d2a4*, lpNumberOfBytesRead=0x2ae404*=0x11a, lpOverlapped=0x0) returned 1 [0133.324] CloseHandle (hObject=0x154) returned 1 [0133.335] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt", lpFilePart=0x0) returned 0x55 [0133.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.335] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@advertising[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.337] GetFileType (hFile=0x154) returned 0x1 [0133.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.337] GetFileType (hFile=0x154) returned 0x1 [0133.338] CloseHandle (hObject=0x154) returned 1 [0133.338] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt", lpFilePart=0x0) returned 0x55 [0133.338] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt.anonymous", lpFilePart=0x0) returned 0x5f [0133.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@advertising[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4cdb360, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb955aea0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee6906f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0133.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.338] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@advertising[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@advertising[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@advertising[1].txt.anonymous")) returned 1 [0133.340] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt", lpFilePart=0x0) returned 0x52 [0133.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.340] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.341] GetFileType (hFile=0x154) returned 0x1 [0133.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.341] GetFileType (hFile=0x154) returned 0x1 [0133.341] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xdf [0133.341] ReadFile (in: hFile=0x154, lpBuffer=0x1b7cc40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7cc40*, lpNumberOfBytesRead=0x2ae404*=0xdf, lpOverlapped=0x0) returned 1 [0133.342] CloseHandle (hObject=0x154) returned 1 [0133.379] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt", lpFilePart=0x0) returned 0x52 [0133.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.380] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@api.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.381] GetFileType (hFile=0x154) returned 0x1 [0133.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.382] GetFileType (hFile=0x154) returned 0x1 [0133.382] WriteFile (in: hFile=0x154, lpBuffer=0x19cc638*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19cc638*, lpNumberOfBytesWritten=0x2ae3cc*=0xe0, lpOverlapped=0x0) returned 1 [0133.383] CloseHandle (hObject=0x154) returned 1 [0133.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt", lpFilePart=0x0) returned 0x52 [0133.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt.anonymous", lpFilePart=0x0) returned 0x5c [0133.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@api.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9c58f40, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9c58f40, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee702b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0133.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.384] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@api.bing[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@api.bing[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@api.bing[2].txt.anonymous")) returned 1 [0133.385] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt", lpFilePart=0x0) returned 0x53 [0133.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.385] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@at.atwola[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.387] GetFileType (hFile=0x154) returned 0x1 [0133.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.387] GetFileType (hFile=0x154) returned 0x1 [0133.387] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x203 [0133.387] ReadFile (in: hFile=0x154, lpBuffer=0x19cdbfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cdbfc*, lpNumberOfBytesRead=0x2ae404*=0x203, lpOverlapped=0x0) returned 1 [0133.388] CloseHandle (hObject=0x154) returned 1 [0133.401] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt", lpFilePart=0x0) returned 0x53 [0133.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.401] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@at.atwola[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.402] GetFileType (hFile=0x154) returned 0x1 [0133.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.402] GetFileType (hFile=0x154) returned 0x1 [0133.402] WriteFile (in: hFile=0x154, lpBuffer=0x1a1c6fc*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1c6fc*, lpNumberOfBytesWritten=0x2ae3cc*=0x210, lpOverlapped=0x0) returned 1 [0133.403] CloseHandle (hObject=0x154) returned 1 [0133.404] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt", lpFilePart=0x0) returned 0x53 [0133.404] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt.anonymous", lpFilePart=0x0) returned 0x5d [0133.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@at.atwola[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8f1b4e0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb8f41640, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee74edd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0133.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.404] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@at.atwola[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@at.atwola[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@at.atwola[2].txt.anonymous")) returned 1 [0133.405] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt", lpFilePart=0x0) returned 0x4e [0133.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.405] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.406] GetFileType (hFile=0x154) returned 0x1 [0133.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.406] GetFileType (hFile=0x154) returned 0x1 [0133.406] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x108 [0133.406] ReadFile (in: hFile=0x154, lpBuffer=0x1a1dbb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1dbb0*, lpNumberOfBytesRead=0x2ae404*=0x108, lpOverlapped=0x0) returned 1 [0133.407] CloseHandle (hObject=0x154) returned 1 [0133.425] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt", lpFilePart=0x0) returned 0x4e [0133.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.425] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.426] GetFileType (hFile=0x154) returned 0x1 [0133.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.426] GetFileType (hFile=0x154) returned 0x1 [0133.427] WriteFile (in: hFile=0x154, lpBuffer=0x1a6c038*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6c038*, lpNumberOfBytesWritten=0x2ae3cc*=0x110, lpOverlapped=0x0) returned 1 [0133.428] CloseHandle (hObject=0x154) returned 1 [0133.428] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt", lpFilePart=0x0) returned 0x4e [0133.428] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt.anonymous", lpFilePart=0x0) returned 0x58 [0133.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8d52460, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb98a0ce0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee774f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0133.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.428] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bing[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bing[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bing[1].txt.anonymous")) returned 1 [0133.429] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt", lpFilePart=0x0) returned 0x58 [0133.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.429] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.430] GetFileType (hFile=0x154) returned 0x1 [0133.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.430] GetFileType (hFile=0x154) returned 0x1 [0133.430] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x70 [0133.430] ReadFile (in: hFile=0x154, lpBuffer=0x1a6d464, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6d464*, lpNumberOfBytesRead=0x2ae404*=0x70, lpOverlapped=0x0) returned 1 [0133.431] CloseHandle (hObject=0x154) returned 1 [0133.443] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt", lpFilePart=0x0) returned 0x58 [0133.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.443] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.445] GetFileType (hFile=0x154) returned 0x1 [0133.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.445] GetFileType (hFile=0x154) returned 0x1 [0133.445] WriteFile (in: hFile=0x154, lpBuffer=0x1abb5f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1abb5f0*, lpNumberOfBytesWritten=0x2ae3cc*=0x80, lpOverlapped=0x0) returned 1 [0133.446] CloseHandle (hObject=0x154) returned 1 [0133.446] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt", lpFilePart=0x0) returned 0x58 [0133.446] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt.anonymous", lpFilePart=0x0) returned 0x62 [0133.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9eba540, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9eba540, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee79b090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0133.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.446] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[1].txt.anonymous")) returned 1 [0133.447] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt", lpFilePart=0x0) returned 0x58 [0133.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.447] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.449] GetFileType (hFile=0x154) returned 0x1 [0133.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.449] GetFileType (hFile=0x154) returned 0x1 [0133.449] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5c [0133.449] ReadFile (in: hFile=0x154, lpBuffer=0x1abca44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1abca44*, lpNumberOfBytesRead=0x2ae404*=0x5c, lpOverlapped=0x0) returned 1 [0133.450] CloseHandle (hObject=0x154) returned 1 [0133.462] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt", lpFilePart=0x0) returned 0x58 [0133.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.462] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.463] GetFileType (hFile=0x154) returned 0x1 [0133.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.463] GetFileType (hFile=0x154) returned 0x1 [0133.464] WriteFile (in: hFile=0x154, lpBuffer=0x1b0ab84*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b0ab84*, lpNumberOfBytesWritten=0x2ae3cc*=0x60, lpOverlapped=0x0) returned 1 [0133.465] CloseHandle (hObject=0x154) returned 1 [0133.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt", lpFilePart=0x0) returned 0x58 [0133.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt.anonymous", lpFilePart=0x0) returned 0x62 [0133.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbe1e760, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xbbe1e760, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee7e7350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0133.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.465] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@bs.serving-sys[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@bs.serving-sys[2].txt.anonymous")) returned 1 [0133.466] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt", lpFilePart=0x0) returned 0x50 [0133.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.466] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.467] GetFileType (hFile=0x154) returned 0x1 [0133.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.467] GetFileType (hFile=0x154) returned 0x1 [0133.467] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c8 [0133.467] ReadFile (in: hFile=0x154, lpBuffer=0x1b0c124, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b0c124*, lpNumberOfBytesRead=0x2ae404*=0x1c8, lpOverlapped=0x0) returned 1 [0133.468] CloseHandle (hObject=0x154) returned 1 [0133.480] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt", lpFilePart=0x0) returned 0x50 [0133.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.480] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.481] GetFileType (hFile=0x154) returned 0x1 [0133.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.481] GetFileType (hFile=0x154) returned 0x1 [0133.481] WriteFile (in: hFile=0x154, lpBuffer=0x1b5a974*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b5a974*, lpNumberOfBytesWritten=0x2ae3cc*=0x1d0, lpOverlapped=0x0) returned 1 [0133.482] CloseHandle (hObject=0x154) returned 1 [0133.483] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt", lpFilePart=0x0) returned 0x50 [0133.483] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt.anonymous", lpFilePart=0x0) returned 0x5a [0133.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8d52460, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9391e20, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee80d4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1 [0133.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.483] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.bing[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.bing[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.bing[2].txt.anonymous")) returned 1 [0133.484] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt", lpFilePart=0x0) returned 0x4f [0133.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.484] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.485] GetFileType (hFile=0x154) returned 0x1 [0133.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.485] GetFileType (hFile=0x154) returned 0x1 [0133.485] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x82 [0133.485] ReadFile (in: hFile=0x154, lpBuffer=0x1b5bd9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b5bd9c*, lpNumberOfBytesRead=0x2ae404*=0x82, lpOverlapped=0x0) returned 1 [0133.486] CloseHandle (hObject=0x154) returned 1 [0133.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt", lpFilePart=0x0) returned 0x4f [0133.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.522] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.msn[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.523] GetFileType (hFile=0x154) returned 0x1 [0133.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.523] GetFileType (hFile=0x154) returned 0x1 [0133.523] WriteFile (in: hFile=0x154, lpBuffer=0x19a9e8c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a9e8c*, lpNumberOfBytesWritten=0x2ae3cc*=0x90, lpOverlapped=0x0) returned 1 [0133.524] CloseHandle (hObject=0x154) returned 1 [0133.524] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt", lpFilePart=0x0) returned 0x4f [0133.524] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt.anonymous", lpFilePart=0x0) returned 0x59 [0133.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.msn[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8ea90c0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb8ea90c0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee859770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1 [0133.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.525] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.msn[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@c.msn[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@c.msn[2].txt.anonymous")) returned 1 [0133.525] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt", lpFilePart=0x0) returned 0x50 [0133.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.526] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.532] GetFileType (hFile=0x154) returned 0x1 [0133.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.532] GetFileType (hFile=0x154) returned 0x1 [0133.532] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x119 [0133.532] ReadFile (in: hFile=0x154, lpBuffer=0x19ab344, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ab344*, lpNumberOfBytesRead=0x2ae404*=0x119, lpOverlapped=0x0) returned 1 [0133.533] CloseHandle (hObject=0x154) returned 1 [0133.545] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt", lpFilePart=0x0) returned 0x50 [0133.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.545] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@google[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.547] GetFileType (hFile=0x154) returned 0x1 [0133.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.547] GetFileType (hFile=0x154) returned 0x1 [0133.547] WriteFile (in: hFile=0x154, lpBuffer=0x19f9980*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19f9980*, lpNumberOfBytesWritten=0x2ae3cc*=0x120, lpOverlapped=0x0) returned 1 [0133.548] CloseHandle (hObject=0x154) returned 1 [0133.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt", lpFilePart=0x0) returned 0x50 [0133.548] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt.anonymous", lpFilePart=0x0) returned 0x5a [0133.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@google[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3869500, ftCreationTime.dwHighDateTime=0x1d35e26, ftLastAccessTime.dwLowDateTime=0xf4476460, ftLastAccessTime.dwHighDateTime=0x1d35e26, ftLastWriteTime.dwLowDateTime=0xee8a5a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0133.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.548] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@google[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@google[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@google[2].txt.anonymous")) returned 1 [0133.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt", lpFilePart=0x0) returned 0x52 [0133.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.549] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@linkedin[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.550] GetFileType (hFile=0x154) returned 0x1 [0133.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.550] GetFileType (hFile=0x154) returned 0x1 [0133.550] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x10f [0133.550] ReadFile (in: hFile=0x154, lpBuffer=0x19fae40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fae40*, lpNumberOfBytesRead=0x2ae404*=0x10f, lpOverlapped=0x0) returned 1 [0133.551] CloseHandle (hObject=0x154) returned 1 [0133.563] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt", lpFilePart=0x0) returned 0x52 [0133.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.563] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@linkedin[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.565] GetFileType (hFile=0x154) returned 0x1 [0133.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.565] GetFileType (hFile=0x154) returned 0x1 [0133.565] WriteFile (in: hFile=0x154, lpBuffer=0x1a492d4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a492d4*, lpNumberOfBytesWritten=0x2ae3cc*=0x110, lpOverlapped=0x0) returned 1 [0133.566] CloseHandle (hObject=0x154) returned 1 [0133.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt", lpFilePart=0x0) returned 0x52 [0133.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt.anonymous", lpFilePart=0x0) returned 0x5c [0133.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@linkedin[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba037300, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xba037300, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee8cbb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0133.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.566] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@linkedin[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@linkedin[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@linkedin[2].txt.anonymous")) returned 1 [0133.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt", lpFilePart=0x0) returned 0x4d [0133.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.567] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.568] GetFileType (hFile=0x154) returned 0x1 [0133.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.568] GetFileType (hFile=0x154) returned 0x1 [0133.568] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x216 [0133.568] ReadFile (in: hFile=0x154, lpBuffer=0x1a4a894, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a4a894*, lpNumberOfBytesRead=0x2ae404*=0x216, lpOverlapped=0x0) returned 1 [0133.570] CloseHandle (hObject=0x154) returned 1 [0133.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt", lpFilePart=0x0) returned 0x4d [0133.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.582] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.583] GetFileType (hFile=0x154) returned 0x1 [0133.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.583] GetFileType (hFile=0x154) returned 0x1 [0133.583] WriteFile (in: hFile=0x154, lpBuffer=0x1a9926c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a9926c*, lpNumberOfBytesWritten=0x2ae3cc*=0x220, lpOverlapped=0x0) returned 1 [0133.584] CloseHandle (hObject=0x154) returned 1 [0133.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt", lpFilePart=0x0) returned 0x4d [0133.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt.anonymous", lpFilePart=0x0) returned 0x57 [0133.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa41158a0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9a43c00, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee8f1cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0133.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.585] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@msn[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@msn[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@msn[1].txt.anonymous")) returned 1 [0133.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x5b [0133.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.586] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.587] GetFileType (hFile=0x154) returned 0x1 [0133.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.587] GetFileType (hFile=0x154) returned 0x1 [0133.587] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xca [0133.587] ReadFile (in: hFile=0x154, lpBuffer=0x1a9a6f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a9a6f4*, lpNumberOfBytesRead=0x2ae404*=0xca, lpOverlapped=0x0) returned 1 [0133.588] CloseHandle (hObject=0x154) returned 1 [0133.600] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x5b [0133.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.600] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@scorecardresearch[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.601] GetFileType (hFile=0x154) returned 0x1 [0133.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.601] GetFileType (hFile=0x154) returned 0x1 [0133.601] WriteFile (in: hFile=0x154, lpBuffer=0x1ae8924*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae8924*, lpNumberOfBytesWritten=0x2ae3cc*=0xd0, lpOverlapped=0x0) returned 1 [0133.603] CloseHandle (hObject=0x154) returned 1 [0133.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x5b [0133.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt.anonymous", lpFilePart=0x0) returned 0x65 [0133.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@scorecardresearch[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb94c2920, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb94c2920, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee917e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0133.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.603] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@scorecardresearch[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@scorecardresearch[2].txt.anonymous")) returned 1 [0133.604] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt", lpFilePart=0x0) returned 0x55 [0133.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.604] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@serving-sys[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.605] GetFileType (hFile=0x154) returned 0x1 [0133.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.605] GetFileType (hFile=0x154) returned 0x1 [0133.605] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x17f [0133.605] ReadFile (in: hFile=0x154, lpBuffer=0x1ae9e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ae9e9c*, lpNumberOfBytesRead=0x2ae404*=0x17f, lpOverlapped=0x0) returned 1 [0133.606] CloseHandle (hObject=0x154) returned 1 [0133.618] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt", lpFilePart=0x0) returned 0x55 [0133.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.618] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@serving-sys[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.620] GetFileType (hFile=0x154) returned 0x1 [0133.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.620] GetFileType (hFile=0x154) returned 0x1 [0133.620] WriteFile (in: hFile=0x154, lpBuffer=0x1b3856c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3856c*, lpNumberOfBytesWritten=0x2ae3cc*=0x180, lpOverlapped=0x0) returned 1 [0133.621] CloseHandle (hObject=0x154) returned 1 [0133.621] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt", lpFilePart=0x0) returned 0x55 [0133.621] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt.anonymous", lpFilePart=0x0) returned 0x5f [0133.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@serving-sys[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9cf14c0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xbbe1e760, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee964110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0133.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.621] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@serving-sys[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@serving-sys[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@serving-sys[1].txt.anonymous")) returned 1 [0133.622] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt", lpFilePart=0x0) returned 0x56 [0133.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.622] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@track.adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.623] GetFileType (hFile=0x154) returned 0x1 [0133.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.623] GetFileType (hFile=0x154) returned 0x1 [0133.623] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4b [0133.623] ReadFile (in: hFile=0x154, lpBuffer=0x1b39990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b39990*, lpNumberOfBytesRead=0x2ae404*=0x4b, lpOverlapped=0x0) returned 1 [0133.624] CloseHandle (hObject=0x154) returned 1 [0133.636] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt", lpFilePart=0x0) returned 0x56 [0133.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.636] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@track.adform[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.638] GetFileType (hFile=0x154) returned 0x1 [0133.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.638] GetFileType (hFile=0x154) returned 0x1 [0133.638] WriteFile (in: hFile=0x154, lpBuffer=0x1b87aac*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b87aac*, lpNumberOfBytesWritten=0x2ae3cc*=0x50, lpOverlapped=0x0) returned 1 [0133.639] CloseHandle (hObject=0x154) returned 1 [0133.639] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt", lpFilePart=0x0) returned 0x56 [0133.639] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt.anonymous", lpFilePart=0x0) returned 0x60 [0133.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@track.adform[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9581000, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb9581000, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee98a270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0133.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.639] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@track.adform[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@track.adform[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@track.adform[1].txt.anonymous")) returned 1 [0133.640] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt", lpFilePart=0x0) returned 0x52 [0133.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.640] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.641] GetFileType (hFile=0x154) returned 0x1 [0133.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.641] GetFileType (hFile=0x154) returned 0x1 [0133.641] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x75 [0133.642] ReadFile (in: hFile=0x154, lpBuffer=0x1b88ef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b88ef8*, lpNumberOfBytesRead=0x2ae404*=0x75, lpOverlapped=0x0) returned 1 [0133.643] CloseHandle (hObject=0x154) returned 1 [0133.681] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt", lpFilePart=0x0) returned 0x52 [0133.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.681] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.683] GetFileType (hFile=0x154) returned 0x1 [0133.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.683] GetFileType (hFile=0x154) returned 0x1 [0133.683] WriteFile (in: hFile=0x154, lpBuffer=0x19d5eb8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19d5eb8*, lpNumberOfBytesWritten=0x2ae3cc*=0x80, lpOverlapped=0x0) returned 1 [0133.684] CloseHandle (hObject=0x154) returned 1 [0133.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt", lpFilePart=0x0) returned 0x52 [0133.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt.anonymous", lpFilePart=0x0) returned 0x5c [0133.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb98a0ce0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xb98a0ce0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xee9fc690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0133.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.684] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.bing[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.bing[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.bing[1].txt.anonymous")) returned 1 [0133.685] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt", lpFilePart=0x0) returned 0x56 [0133.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.685] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.686] GetFileType (hFile=0x154) returned 0x1 [0133.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.686] GetFileType (hFile=0x154) returned 0x1 [0133.686] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa8 [0133.686] ReadFile (in: hFile=0x154, lpBuffer=0x19d732c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19d732c*, lpNumberOfBytesRead=0x2ae404*=0xa8, lpOverlapped=0x0) returned 1 [0133.687] CloseHandle (hObject=0x154) returned 1 [0133.699] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt", lpFilePart=0x0) returned 0x56 [0133.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.700] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.701] GetFileType (hFile=0x154) returned 0x1 [0133.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.701] GetFileType (hFile=0x154) returned 0x1 [0133.701] WriteFile (in: hFile=0x154, lpBuffer=0x1a25508*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a25508*, lpNumberOfBytesWritten=0x2ae3cc*=0xb0, lpOverlapped=0x0) returned 1 [0133.702] CloseHandle (hObject=0x154) returned 1 [0133.702] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt", lpFilePart=0x0) returned 0x56 [0133.702] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt.anonymous", lpFilePart=0x0) returned 0x60 [0133.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba037300, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xba037300, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xeea227f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0133.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.703] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.linkedin[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.linkedin[1].txt.anonymous")) returned 1 [0133.703] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt", lpFilePart=0x0) returned 0x51 [0133.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0133.703] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.704] GetFileType (hFile=0x154) returned 0x1 [0133.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0133.704] GetFileType (hFile=0x154) returned 0x1 [0133.704] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3ee [0133.705] ReadFile (in: hFile=0x154, lpBuffer=0x1a26cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a26cc8*, lpNumberOfBytesRead=0x2ae404*=0x3ee, lpOverlapped=0x0) returned 1 [0133.718] CloseHandle (hObject=0x154) returned 1 [0133.737] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt", lpFilePart=0x0) returned 0x51 [0133.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0133.738] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.msn[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.739] GetFileType (hFile=0x154) returned 0x1 [0133.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0133.739] GetFileType (hFile=0x154) returned 0x1 [0133.739] WriteFile (in: hFile=0x154, lpBuffer=0x1a75fb8*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a75fb8*, lpNumberOfBytesWritten=0x2ae3cc*=0x3f0, lpOverlapped=0x0) returned 1 [0133.740] CloseHandle (hObject=0x154) returned 1 [0133.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt", lpFilePart=0x0) returned 0x51 [0133.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt.anonymous", lpFilePart=0x0) returned 0x5b [0133.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0133.740] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.msn[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa41158a0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xbbd13dc0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xeea6eab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0133.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.740] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.msn[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\eebsym5@www.msn[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\eebsym5@www.msn[2].txt.anonymous")) returned 1 [0133.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3e [0133.741] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpFilePart=0x0) returned 0x3f [0133.742] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0133.743] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.744] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.744] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.744] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.744] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.745] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.746] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.747] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.747] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.747] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.747] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.747] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.747] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0133.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0133.748] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3e [0133.748] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpFilePart=0x0) returned 0x3f [0133.748] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0133.749] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.750] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.751] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.752] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.753] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.753] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.753] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.753] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.753] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0133.753] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0133.753] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0133.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0133.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0133.754] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x62 [0133.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.755] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad13.adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.756] GetFileType (hFile=0x154) returned 0x1 [0133.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.756] GetFileType (hFile=0x154) returned 0x1 [0133.756] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x5a [0133.756] ReadFile (in: hFile=0x154, lpBuffer=0x1a7f954, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a7f954*, lpNumberOfBytesRead=0x2ae390*=0x5a, lpOverlapped=0x0) returned 1 [0133.757] CloseHandle (hObject=0x154) returned 1 [0133.769] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x62 [0133.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.769] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad13.adfarm1.adition[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.770] GetFileType (hFile=0x154) returned 0x1 [0133.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.770] GetFileType (hFile=0x154) returned 0x1 [0133.770] WriteFile (in: hFile=0x154, lpBuffer=0x1acdab8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1acdab8*, lpNumberOfBytesWritten=0x2ae358*=0x60, lpOverlapped=0x0) returned 1 [0133.771] CloseHandle (hObject=0x154) returned 1 [0133.772] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x62 [0133.772] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt.anonymous", lpFilePart=0x0) returned 0x6c [0133.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad13.adfarm1.adition[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b69b8a0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7b69b8a0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeeabad70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0133.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.772] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad13.adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad13.adfarm1.adition[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad13.adfarm1.adition[2].txt.anonymous")) returned 1 [0133.773] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x61 [0133.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.773] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad2.adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.773] GetFileType (hFile=0x154) returned 0x1 [0133.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.773] GetFileType (hFile=0x154) returned 0x1 [0133.773] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x58 [0133.773] ReadFile (in: hFile=0x154, lpBuffer=0x1acef60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1acef60*, lpNumberOfBytesRead=0x2ae390*=0x58, lpOverlapped=0x0) returned 1 [0133.774] CloseHandle (hObject=0x154) returned 1 [0133.787] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x61 [0133.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.787] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad2.adfarm1.adition[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.789] GetFileType (hFile=0x154) returned 0x1 [0133.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.789] GetFileType (hFile=0x154) returned 0x1 [0133.789] WriteFile (in: hFile=0x154, lpBuffer=0x1b1d0c0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b1d0c0*, lpNumberOfBytesWritten=0x2ae358*=0x60, lpOverlapped=0x0) returned 1 [0133.790] CloseHandle (hObject=0x154) returned 1 [0133.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x61 [0133.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt.anonymous", lpFilePart=0x0) returned 0x6b [0133.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad2.adfarm1.adition[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bac5f20, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7bac5f20, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeeae0ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0133.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.790] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad2.adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@ad2.adfarm1.adition[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@ad2.adfarm1.adition[2].txt.anonymous")) returned 1 [0133.791] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x5d [0133.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.791] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.792] GetFileType (hFile=0x154) returned 0x1 [0133.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.792] GetFileType (hFile=0x154) returned 0x1 [0133.792] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xd2 [0133.792] ReadFile (in: hFile=0x154, lpBuffer=0x1b1e5c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b1e5c8*, lpNumberOfBytesRead=0x2ae390*=0xd2, lpOverlapped=0x0) returned 1 [0133.793] CloseHandle (hObject=0x154) returned 1 [0133.805] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x5d [0133.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.805] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adfarm1.adition[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.806] GetFileType (hFile=0x154) returned 0x1 [0133.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.806] GetFileType (hFile=0x154) returned 0x1 [0133.806] WriteFile (in: hFile=0x154, lpBuffer=0x1b6c820*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b6c820*, lpNumberOfBytesWritten=0x2ae358*=0xe0, lpOverlapped=0x0) returned 1 [0133.808] CloseHandle (hObject=0x154) returned 1 [0133.808] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x5d [0133.808] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt.anonymous", lpFilePart=0x0) returned 0x67 [0133.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adfarm1.adition[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a092170, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7ba53b00, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeeb2d190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0133.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.808] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adfarm1.adition[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adfarm1.adition[2].txt.anonymous")) returned 1 [0133.809] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt", lpFilePart=0x0) returned 0x57 [0133.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.809] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.809] GetFileType (hFile=0x154) returned 0x1 [0133.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.809] GetFileType (hFile=0x154) returned 0x1 [0133.809] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x5d [0133.809] ReadFile (in: hFile=0x154, lpBuffer=0x1b6dc84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b6dc84*, lpNumberOfBytesRead=0x2ae390*=0x5d, lpOverlapped=0x0) returned 1 [0133.811] CloseHandle (hObject=0x154) returned 1 [0133.848] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt", lpFilePart=0x0) returned 0x57 [0133.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.848] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adformdsp[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.849] GetFileType (hFile=0x154) returned 0x1 [0133.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.849] GetFileType (hFile=0x154) returned 0x1 [0133.849] WriteFile (in: hFile=0x154, lpBuffer=0x19bd45c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19bd45c*, lpNumberOfBytesWritten=0x2ae358*=0x60, lpOverlapped=0x0) returned 1 [0133.850] CloseHandle (hObject=0x154) returned 1 [0133.851] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt", lpFilePart=0x0) returned 0x57 [0133.851] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt.anonymous", lpFilePart=0x0) returned 0x61 [0133.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.851] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adformdsp[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7be31ec0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7be31ec0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeeb79450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0133.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.851] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adformdsp[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adformdsp[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adformdsp[1].txt.anonymous")) returned 1 [0133.851] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt", lpFilePart=0x0) returned 0x54 [0133.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.852] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.865] GetFileType (hFile=0x154) returned 0x1 [0133.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.865] GetFileType (hFile=0x154) returned 0x1 [0133.865] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xea [0133.865] ReadFile (in: hFile=0x154, lpBuffer=0x19be91c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19be91c*, lpNumberOfBytesRead=0x2ae390*=0xea, lpOverlapped=0x0) returned 1 [0133.866] CloseHandle (hObject=0x154) returned 1 [0133.893] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt", lpFilePart=0x0) returned 0x54 [0133.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.893] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adform[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.894] GetFileType (hFile=0x154) returned 0x1 [0133.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.895] GetFileType (hFile=0x154) returned 0x1 [0133.895] WriteFile (in: hFile=0x154, lpBuffer=0x1a0ccc4*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a0ccc4*, lpNumberOfBytesWritten=0x2ae358*=0xf0, lpOverlapped=0x0) returned 1 [0133.896] CloseHandle (hObject=0x154) returned 1 [0133.896] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt", lpFilePart=0x0) returned 0x54 [0133.896] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt.anonymous", lpFilePart=0x0) returned 0x5e [0133.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.896] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adform[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b87e60, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7bef05a0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeebeb870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0133.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.896] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adform[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adform[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adform[1].txt.anonymous")) returned 1 [0133.936] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt", lpFilePart=0x0) returned 0x53 [0133.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.937] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adnxs[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.937] GetFileType (hFile=0x154) returned 0x1 [0133.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.937] GetFileType (hFile=0x154) returned 0x1 [0133.937] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x2ed [0133.937] ReadFile (in: hFile=0x154, lpBuffer=0x1a0e378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a0e378*, lpNumberOfBytesRead=0x2ae390*=0x2ed, lpOverlapped=0x0) returned 1 [0133.947] CloseHandle (hObject=0x154) returned 1 [0133.958] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt", lpFilePart=0x0) returned 0x53 [0133.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.958] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adnxs[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.960] GetFileType (hFile=0x154) returned 0x1 [0133.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.960] GetFileType (hFile=0x154) returned 0x1 [0133.960] WriteFile (in: hFile=0x154, lpBuffer=0x1a5d168*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a5d168*, lpNumberOfBytesWritten=0x2ae358*=0x2f0, lpOverlapped=0x0) returned 1 [0133.961] CloseHandle (hObject=0x154) returned 1 [0133.961] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt", lpFilePart=0x0) returned 0x53 [0133.961] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt.anonymous", lpFilePart=0x0) returned 0x5d [0133.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adnxs[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e905f10, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7d293b20, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeec83df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0133.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.961] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adnxs[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adnxs[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adnxs[2].txt.anonymous")) returned 1 [0133.962] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt", lpFilePart=0x0) returned 0x56 [0133.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.962] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adspirit[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.962] GetFileType (hFile=0x154) returned 0x1 [0133.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.962] GetFileType (hFile=0x154) returned 0x1 [0133.962] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x166 [0133.962] ReadFile (in: hFile=0x154, lpBuffer=0x1a5e694, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a5e694*, lpNumberOfBytesRead=0x2ae390*=0x166, lpOverlapped=0x0) returned 1 [0133.964] CloseHandle (hObject=0x154) returned 1 [0133.976] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt", lpFilePart=0x0) returned 0x56 [0133.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.976] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adspirit[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.977] GetFileType (hFile=0x154) returned 0x1 [0133.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.977] GetFileType (hFile=0x154) returned 0x1 [0133.977] WriteFile (in: hFile=0x154, lpBuffer=0x1aacd18*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1aacd18*, lpNumberOfBytesWritten=0x2ae358*=0x170, lpOverlapped=0x0) returned 1 [0133.979] CloseHandle (hObject=0x154) returned 1 [0133.979] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt", lpFilePart=0x0) returned 0x56 [0133.979] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt.anonymous", lpFilePart=0x0) returned 0x60 [0133.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adspirit[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x791b17f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x812d4170, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeecd00b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1 [0133.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.979] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adspirit[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adspirit[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adspirit[2].txt.anonymous")) returned 1 [0133.980] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt", lpFilePart=0x0) returned 0x54 [0133.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0133.980] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.980] GetFileType (hFile=0x154) returned 0x1 [0133.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0133.981] GetFileType (hFile=0x154) returned 0x1 [0133.981] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x66 [0133.981] ReadFile (in: hFile=0x154, lpBuffer=0x1aae154, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aae154*, lpNumberOfBytesRead=0x2ae390*=0x66, lpOverlapped=0x0) returned 1 [0133.982] CloseHandle (hObject=0x154) returned 1 [0133.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt", lpFilePart=0x0) returned 0x54 [0133.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0133.994] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adtech[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0133.995] GetFileType (hFile=0x154) returned 0x1 [0133.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0133.996] GetFileType (hFile=0x154) returned 0x1 [0133.996] WriteFile (in: hFile=0x154, lpBuffer=0x1afc2a4*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1afc2a4*, lpNumberOfBytesWritten=0x2ae358*=0x70, lpOverlapped=0x0) returned 1 [0133.997] CloseHandle (hObject=0x154) returned 1 [0133.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt", lpFilePart=0x0) returned 0x54 [0133.997] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt.anonymous", lpFilePart=0x0) returned 0x5e [0133.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0133.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adtech[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78a67490, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x78a67490, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeecf6210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0133.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0133.997] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adtech[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@adtech[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@adtech[2].txt.anonymous")) returned 1 [0134.001] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt", lpFilePart=0x0) returned 0x59 [0134.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.001] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@advertising[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.013] GetFileType (hFile=0x154) returned 0x1 [0134.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.013] GetFileType (hFile=0x154) returned 0x1 [0134.013] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x122 [0134.013] ReadFile (in: hFile=0x154, lpBuffer=0x1afd7a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1afd7a4*, lpNumberOfBytesRead=0x2ae390*=0x122, lpOverlapped=0x0) returned 1 [0134.015] CloseHandle (hObject=0x154) returned 1 [0134.027] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt", lpFilePart=0x0) returned 0x59 [0134.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.027] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@advertising[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.028] GetFileType (hFile=0x154) returned 0x1 [0134.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.028] GetFileType (hFile=0x154) returned 0x1 [0134.028] WriteFile (in: hFile=0x154, lpBuffer=0x1b4bcf8*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b4bcf8*, lpNumberOfBytesWritten=0x2ae358*=0x130, lpOverlapped=0x0) returned 1 [0134.029] CloseHandle (hObject=0x154) returned 1 [0134.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt", lpFilePart=0x0) returned 0x59 [0134.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt.anonymous", lpFilePart=0x0) returned 0x63 [0134.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@advertising[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7850c310, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7dae8820, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeed424d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1 [0134.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.029] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@advertising[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@advertising[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@advertising[2].txt.anonymous")) returned 1 [0134.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt", lpFilePart=0x0) returned 0x56 [0134.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.030] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.030] GetFileType (hFile=0x154) returned 0x1 [0134.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.030] GetFileType (hFile=0x154) returned 0x1 [0134.030] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xdf [0134.030] ReadFile (in: hFile=0x154, lpBuffer=0x1b4d1c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b4d1c0*, lpNumberOfBytesRead=0x2ae390*=0xdf, lpOverlapped=0x0) returned 1 [0134.031] CloseHandle (hObject=0x154) returned 1 [0134.077] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt", lpFilePart=0x0) returned 0x56 [0134.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.078] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@api.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.080] GetFileType (hFile=0x154) returned 0x1 [0134.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.080] GetFileType (hFile=0x154) returned 0x1 [0134.080] WriteFile (in: hFile=0x154, lpBuffer=0x199b49c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x199b49c*, lpNumberOfBytesWritten=0x2ae358*=0xe0, lpOverlapped=0x0) returned 1 [0134.081] CloseHandle (hObject=0x154) returned 1 [0134.081] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt", lpFilePart=0x0) returned 0x56 [0134.081] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt.anonymous", lpFilePart=0x0) returned 0x60 [0134.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@api.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cb6f920, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7cb6f920, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeedb48f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0134.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.082] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@api.bing[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@api.bing[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@api.bing[2].txt.anonymous")) returned 1 [0134.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt", lpFilePart=0x0) returned 0x57 [0134.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.083] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.083] GetFileType (hFile=0x154) returned 0x1 [0134.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.083] GetFileType (hFile=0x154) returned 0x1 [0134.083] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x200 [0134.083] ReadFile (in: hFile=0x154, lpBuffer=0x199ca7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x199ca7c*, lpNumberOfBytesRead=0x2ae390*=0x200, lpOverlapped=0x0) returned 1 [0134.085] CloseHandle (hObject=0x154) returned 1 [0134.098] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt", lpFilePart=0x0) returned 0x57 [0134.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.098] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@at.atwola[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.100] GetFileType (hFile=0x154) returned 0x1 [0134.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.100] GetFileType (hFile=0x154) returned 0x1 [0134.100] WriteFile (in: hFile=0x154, lpBuffer=0x19eb584*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19eb584*, lpNumberOfBytesWritten=0x2ae358*=0x210, lpOverlapped=0x0) returned 1 [0134.101] CloseHandle (hObject=0x154) returned 1 [0134.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt", lpFilePart=0x0) returned 0x57 [0134.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt.anonymous", lpFilePart=0x0) returned 0x61 [0134.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@at.atwola[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a31200, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7c4bdb40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeeddaa50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0134.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.101] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@at.atwola[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@at.atwola[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@at.atwola[1].txt.anonymous")) returned 1 [0134.102] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt", lpFilePart=0x0) returned 0x52 [0134.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.102] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.113] GetFileType (hFile=0x154) returned 0x1 [0134.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.113] GetFileType (hFile=0x154) returned 0x1 [0134.113] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x108 [0134.113] ReadFile (in: hFile=0x154, lpBuffer=0x19eca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19eca58*, lpNumberOfBytesRead=0x2ae390*=0x108, lpOverlapped=0x0) returned 1 [0134.114] CloseHandle (hObject=0x154) returned 1 [0134.127] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt", lpFilePart=0x0) returned 0x52 [0134.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.128] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.129] GetFileType (hFile=0x154) returned 0x1 [0134.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.129] GetFileType (hFile=0x154) returned 0x1 [0134.129] WriteFile (in: hFile=0x154, lpBuffer=0x1a3aee8*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a3aee8*, lpNumberOfBytesWritten=0x2ae358*=0x110, lpOverlapped=0x0) returned 1 [0134.130] CloseHandle (hObject=0x154) returned 1 [0134.130] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt", lpFilePart=0x0) returned 0x52 [0134.130] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt.anonymous", lpFilePart=0x0) returned 0x5c [0134.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a4e2950, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x82b3a2f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xeee26d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0134.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.131] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bing[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bing[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bing[1].txt.anonymous")) returned 1 [0134.131] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt", lpFilePart=0x0) returned 0x5c [0134.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.132] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.132] GetFileType (hFile=0x154) returned 0x1 [0134.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.132] GetFileType (hFile=0x154) returned 0x1 [0134.132] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x6f [0134.133] ReadFile (in: hFile=0x154, lpBuffer=0x1a3c334, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a3c334*, lpNumberOfBytesRead=0x2ae390*=0x6f, lpOverlapped=0x0) returned 1 [0134.134] CloseHandle (hObject=0x154) returned 1 [0134.151] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt", lpFilePart=0x0) returned 0x5c [0134.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.151] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.153] GetFileType (hFile=0x154) returned 0x1 [0134.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.153] GetFileType (hFile=0x154) returned 0x1 [0134.153] WriteFile (in: hFile=0x154, lpBuffer=0x1a8a49c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a8a49c*, lpNumberOfBytesWritten=0x2ae358*=0x70, lpOverlapped=0x0) returned 1 [0134.155] CloseHandle (hObject=0x154) returned 1 [0134.155] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt", lpFilePart=0x0) returned 0x5c [0134.155] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt.anonymous", lpFilePart=0x0) returned 0x66 [0134.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a36a740, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7a36a740, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeee72fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0134.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.155] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[1].txt.anonymous")) returned 1 [0134.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt", lpFilePart=0x0) returned 0x5c [0134.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.156] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.156] GetFileType (hFile=0x154) returned 0x1 [0134.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.157] GetFileType (hFile=0x154) returned 0x1 [0134.157] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x5d [0134.157] ReadFile (in: hFile=0x154, lpBuffer=0x1a8b914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a8b914*, lpNumberOfBytesRead=0x2ae390*=0x5d, lpOverlapped=0x0) returned 1 [0134.158] CloseHandle (hObject=0x154) returned 1 [0134.175] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt", lpFilePart=0x0) returned 0x5c [0134.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.175] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.177] GetFileType (hFile=0x154) returned 0x1 [0134.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.177] GetFileType (hFile=0x154) returned 0x1 [0134.177] WriteFile (in: hFile=0x154, lpBuffer=0x1ad9a5c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ad9a5c*, lpNumberOfBytesWritten=0x2ae358*=0x60, lpOverlapped=0x0) returned 1 [0134.179] CloseHandle (hObject=0x154) returned 1 [0134.179] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt", lpFilePart=0x0) returned 0x5c [0134.179] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt.anonymous", lpFilePart=0x0) returned 0x66 [0134.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a879600, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7a879600, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeee99130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0134.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.179] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@bs.serving-sys[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@bs.serving-sys[2].txt.anonymous")) returned 1 [0134.180] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt", lpFilePart=0x0) returned 0x54 [0134.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.180] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.181] GetFileType (hFile=0x154) returned 0x1 [0134.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.182] GetFileType (hFile=0x154) returned 0x1 [0134.182] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x17e [0134.182] ReadFile (in: hFile=0x154, lpBuffer=0x1adafd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1adafd4*, lpNumberOfBytesRead=0x2ae390*=0x17e, lpOverlapped=0x0) returned 1 [0134.184] CloseHandle (hObject=0x154) returned 1 [0134.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt", lpFilePart=0x0) returned 0x54 [0134.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.201] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.202] GetFileType (hFile=0x154) returned 0x1 [0134.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.202] GetFileType (hFile=0x154) returned 0x1 [0134.202] WriteFile (in: hFile=0x154, lpBuffer=0x1b29698*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b29698*, lpNumberOfBytesWritten=0x2ae358*=0x180, lpOverlapped=0x0) returned 1 [0134.203] CloseHandle (hObject=0x154) returned 1 [0134.203] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt", lpFilePart=0x0) returned 0x54 [0134.203] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt.anonymous", lpFilePart=0x0) returned 0x5e [0134.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.203] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e75aa0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3e75aa0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xeeee53f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1 [0134.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.204] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.bing[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.bing[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.bing[1].txt.anonymous")) returned 1 [0134.207] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt", lpFilePart=0x0) returned 0x53 [0134.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.207] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.208] GetFileType (hFile=0x154) returned 0x1 [0134.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.208] GetFileType (hFile=0x154) returned 0x1 [0134.208] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3f [0134.208] ReadFile (in: hFile=0x154, lpBuffer=0x1b2aa9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b2aa9c*, lpNumberOfBytesRead=0x2ae390*=0x3f, lpOverlapped=0x0) returned 1 [0134.209] CloseHandle (hObject=0x154) returned 1 [0134.223] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt", lpFilePart=0x0) returned 0x53 [0134.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.223] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.225] GetFileType (hFile=0x154) returned 0x1 [0134.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.225] GetFileType (hFile=0x154) returned 0x1 [0134.225] WriteFile (in: hFile=0x154, lpBuffer=0x1b78b80*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b78b80*, lpNumberOfBytesWritten=0x2ae358*=0x40, lpOverlapped=0x0) returned 1 [0134.226] CloseHandle (hObject=0x154) returned 1 [0134.226] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt", lpFilePart=0x0) returned 0x53 [0134.226] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt.anonymous", lpFilePart=0x0) returned 0x5d [0134.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.227] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e781b0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3e781b0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xeef0b550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0134.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.227] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.msn[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@c.msn[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@c.msn[1].txt.anonymous")) returned 1 [0134.228] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt", lpFilePart=0x0) returned 0x56 [0134.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.228] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.229] GetFileType (hFile=0x154) returned 0x1 [0134.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.229] GetFileType (hFile=0x154) returned 0x1 [0134.229] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x10f [0134.229] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b7a054*, lpNumberOfBytesRead=0x2ae390*=0x10f, lpOverlapped=0x0) returned 1 [0134.231] CloseHandle (hObject=0x154) returned 1 [0134.308] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt", lpFilePart=0x0) returned 0x56 [0134.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.308] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.310] GetFileType (hFile=0x154) returned 0x1 [0134.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.310] GetFileType (hFile=0x154) returned 0x1 [0134.310] WriteFile (in: hFile=0x154, lpBuffer=0x19c8500*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19c8500*, lpNumberOfBytesWritten=0x2ae358*=0x110, lpOverlapped=0x0) returned 1 [0134.311] CloseHandle (hObject=0x154) returned 1 [0134.311] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt", lpFilePart=0x0) returned 0x56 [0134.311] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt.anonymous", lpFilePart=0x0) returned 0x60 [0134.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d7a29e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7d7a29e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xeefefd90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0134.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.311] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@linkedin[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@linkedin[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@linkedin[1].txt.anonymous")) returned 1 [0134.312] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt", lpFilePart=0x0) returned 0x57 [0134.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.312] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.313] GetFileType (hFile=0x154) returned 0x1 [0134.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.313] GetFileType (hFile=0x154) returned 0x1 [0134.313] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x77 [0134.313] ReadFile (in: hFile=0x154, lpBuffer=0x19c9958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19c9958*, lpNumberOfBytesRead=0x2ae390*=0x77, lpOverlapped=0x0) returned 1 [0134.314] CloseHandle (hObject=0x154) returned 1 [0134.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt", lpFilePart=0x0) returned 0x57 [0134.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.327] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@m.exactag[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.328] GetFileType (hFile=0x154) returned 0x1 [0134.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.328] GetFileType (hFile=0x154) returned 0x1 [0134.328] WriteFile (in: hFile=0x154, lpBuffer=0x1a17c30*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a17c30*, lpNumberOfBytesWritten=0x2ae358*=0x80, lpOverlapped=0x0) returned 1 [0134.329] CloseHandle (hObject=0x154) returned 1 [0134.329] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt", lpFilePart=0x0) returned 0x57 [0134.329] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt.anonymous", lpFilePart=0x0) returned 0x61 [0134.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@m.exactag[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7d07e7e0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7d07e7e0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xef015ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0134.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.329] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@m.exactag[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@m.exactag[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@m.exactag[1].txt.anonymous")) returned 1 [0134.330] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt", lpFilePart=0x0) returned 0x51 [0134.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.330] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.330] GetFileType (hFile=0x154) returned 0x1 [0134.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.330] GetFileType (hFile=0x154) returned 0x1 [0134.331] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x337 [0134.331] ReadFile (in: hFile=0x154, lpBuffer=0x1a19330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a19330*, lpNumberOfBytesRead=0x2ae390*=0x337, lpOverlapped=0x0) returned 1 [0134.355] CloseHandle (hObject=0x154) returned 1 [0134.368] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt", lpFilePart=0x0) returned 0x51 [0134.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.368] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.370] GetFileType (hFile=0x154) returned 0x1 [0134.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.375] GetFileType (hFile=0x154) returned 0x1 [0134.375] WriteFile (in: hFile=0x154, lpBuffer=0x1a682b0*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a682b0*, lpNumberOfBytesWritten=0x2ae358*=0x340, lpOverlapped=0x0) returned 1 [0134.376] CloseHandle (hObject=0x154) returned 1 [0134.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt", lpFilePart=0x0) returned 0x51 [0134.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt.anonymous", lpFilePart=0x0) returned 0x5b [0134.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84699ff0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7c84fc40, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xef088310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0134.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.377] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@msn[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@msn[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@msn[1].txt.anonymous")) returned 1 [0134.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x5f [0134.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.378] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.379] GetFileType (hFile=0x154) returned 0x1 [0134.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.379] GetFileType (hFile=0x154) returned 0x1 [0134.379] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xca [0134.379] ReadFile (in: hFile=0x154, lpBuffer=0x1a69758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a69758*, lpNumberOfBytesRead=0x2ae390*=0xca, lpOverlapped=0x0) returned 1 [0134.380] CloseHandle (hObject=0x154) returned 1 [0134.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x5f [0134.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.392] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@scorecardresearch[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.394] GetFileType (hFile=0x154) returned 0x1 [0134.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.394] GetFileType (hFile=0x154) returned 0x1 [0134.394] WriteFile (in: hFile=0x154, lpBuffer=0x1ab7990*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ab7990*, lpNumberOfBytesWritten=0x2ae358*=0xd0, lpOverlapped=0x0) returned 1 [0134.395] CloseHandle (hObject=0x154) returned 1 [0134.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x5f [0134.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt.anonymous", lpFilePart=0x0) returned 0x69 [0134.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@scorecardresearch[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7df0e2f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7df0e2f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xef0ae470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0134.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.395] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@scorecardresearch[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@scorecardresearch[2].txt.anonymous")) returned 1 [0134.396] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x5e [0134.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.396] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.397] GetFileType (hFile=0x154) returned 0x1 [0134.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.397] GetFileType (hFile=0x154) returned 0x1 [0134.397] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x6c [0134.397] ReadFile (in: hFile=0x154, lpBuffer=0x1ab8e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1ab8e28*, lpNumberOfBytesRead=0x2ae390*=0x6c, lpOverlapped=0x0) returned 1 [0134.398] CloseHandle (hObject=0x154) returned 1 [0134.410] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x5e [0134.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.410] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@server.adformdsp[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.412] GetFileType (hFile=0x154) returned 0x1 [0134.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.412] GetFileType (hFile=0x154) returned 0x1 [0134.412] WriteFile (in: hFile=0x154, lpBuffer=0x1b06f98*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b06f98*, lpNumberOfBytesWritten=0x2ae358*=0x70, lpOverlapped=0x0) returned 1 [0134.413] CloseHandle (hObject=0x154) returned 1 [0134.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x5e [0134.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt.anonymous", lpFilePart=0x0) returned 0x68 [0134.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@server.adformdsp[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7be31ec0, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7be31ec0, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xef0d45d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0134.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.413] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@server.adformdsp[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@server.adformdsp[1].txt.anonymous")) returned 1 [0134.414] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt", lpFilePart=0x0) returned 0x59 [0134.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.414] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@serving-sys[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.429] GetFileType (hFile=0x154) returned 0x1 [0134.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.429] GetFileType (hFile=0x154) returned 0x1 [0134.429] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x19b [0134.429] ReadFile (in: hFile=0x154, lpBuffer=0x1b0854c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b0854c*, lpNumberOfBytesRead=0x2ae390*=0x19b, lpOverlapped=0x0) returned 1 [0134.431] CloseHandle (hObject=0x154) returned 1 [0134.444] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt", lpFilePart=0x0) returned 0x59 [0134.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.444] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@serving-sys[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.446] GetFileType (hFile=0x154) returned 0x1 [0134.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.446] GetFileType (hFile=0x154) returned 0x1 [0134.446] WriteFile (in: hFile=0x154, lpBuffer=0x1b56cc8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b56cc8*, lpNumberOfBytesWritten=0x2ae358*=0x1a0, lpOverlapped=0x0) returned 1 [0134.447] CloseHandle (hObject=0x154) returned 1 [0134.447] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt", lpFilePart=0x0) returned 0x59 [0134.447] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt.anonymous", lpFilePart=0x0) returned 0x63 [0134.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.447] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@serving-sys[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f98ae0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3f98ae0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xef1469f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0134.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.447] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@serving-sys[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@serving-sys[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@serving-sys[2].txt.anonymous")) returned 1 [0134.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt", lpFilePart=0x0) returned 0x5a [0134.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.448] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.449] GetFileType (hFile=0x154) returned 0x1 [0134.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.449] GetFileType (hFile=0x154) returned 0x1 [0134.449] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb3 [0134.449] ReadFile (in: hFile=0x154, lpBuffer=0x1b58174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b58174*, lpNumberOfBytesRead=0x2ae390*=0xb3, lpOverlapped=0x0) returned 1 [0134.450] CloseHandle (hObject=0x154) returned 1 [0134.494] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt", lpFilePart=0x0) returned 0x5a [0134.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.494] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@track.adform[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.496] GetFileType (hFile=0x154) returned 0x1 [0134.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.496] GetFileType (hFile=0x154) returned 0x1 [0134.496] WriteFile (in: hFile=0x154, lpBuffer=0x19a62dc*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19a62dc*, lpNumberOfBytesWritten=0x2ae358*=0xc0, lpOverlapped=0x0) returned 1 [0134.497] CloseHandle (hObject=0x154) returned 1 [0134.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt", lpFilePart=0x0) returned 0x5a [0134.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt.anonymous", lpFilePart=0x0) returned 0x64 [0134.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@track.adform[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bac5f20, ftCreationTime.dwHighDateTime=0x1d2f584, ftLastAccessTime.dwLowDateTime=0x7bac5f20, ftLastAccessTime.dwHighDateTime=0x1d2f584, ftLastWriteTime.dwLowDateTime=0xef1b8e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0134.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.498] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@track.adform[2].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@track.adform[2].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@track.adform[2].txt.anonymous")) returned 1 [0134.499] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt", lpFilePart=0x0) returned 0x56 [0134.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.499] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.500] GetFileType (hFile=0x154) returned 0x1 [0134.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.500] GetFileType (hFile=0x154) returned 0x1 [0134.500] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x75 [0134.500] ReadFile (in: hFile=0x154, lpBuffer=0x19a7748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19a7748*, lpNumberOfBytesRead=0x2ae390*=0x75, lpOverlapped=0x0) returned 1 [0134.501] CloseHandle (hObject=0x154) returned 1 [0134.513] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt", lpFilePart=0x0) returned 0x56 [0134.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.513] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.514] GetFileType (hFile=0x154) returned 0x1 [0134.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.514] GetFileType (hFile=0x154) returned 0x1 [0134.514] WriteFile (in: hFile=0x154, lpBuffer=0x19f5a1c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x19f5a1c*, lpNumberOfBytesWritten=0x2ae358*=0x80, lpOverlapped=0x0) returned 1 [0134.515] CloseHandle (hObject=0x154) returned 1 [0134.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt", lpFilePart=0x0) returned 0x56 [0134.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt.anonymous", lpFilePart=0x0) returned 0x60 [0134.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82b3a2f0, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x82b3a2f0, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xef1def70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0134.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.516] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.bing[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.bing[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.bing[1].txt.anonymous")) returned 1 [0134.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt", lpFilePart=0x0) returned 0x5a [0134.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.517] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.517] GetFileType (hFile=0x154) returned 0x1 [0134.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.517] GetFileType (hFile=0x154) returned 0x1 [0134.517] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa8 [0134.518] ReadFile (in: hFile=0x154, lpBuffer=0x19f6eb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19f6eb0*, lpNumberOfBytesRead=0x2ae390*=0xa8, lpOverlapped=0x0) returned 1 [0134.519] CloseHandle (hObject=0x154) returned 1 [0134.530] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt", lpFilePart=0x0) returned 0x5a [0134.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.530] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.532] GetFileType (hFile=0x154) returned 0x1 [0134.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.532] GetFileType (hFile=0x154) returned 0x1 [0134.532] WriteFile (in: hFile=0x154, lpBuffer=0x1a45094*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a45094*, lpNumberOfBytesWritten=0x2ae358*=0xb0, lpOverlapped=0x0) returned 1 [0134.533] CloseHandle (hObject=0x154) returned 1 [0134.533] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt", lpFilePart=0x0) returned 0x5a [0134.533] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt.anonymous", lpFilePart=0x0) returned 0x64 [0134.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f2b1870, ftCreationTime.dwHighDateTime=0x1d2da19, ftLastAccessTime.dwLowDateTime=0x7f2b1870, ftLastAccessTime.dwHighDateTime=0x1d2da19, ftLastWriteTime.dwLowDateTime=0xef2050d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0134.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.533] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.linkedin[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.linkedin[1].txt.anonymous")) returned 1 [0134.534] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt", lpFilePart=0x0) returned 0x55 [0134.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0134.534] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.534] GetFileType (hFile=0x154) returned 0x1 [0134.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0134.534] GetFileType (hFile=0x154) returned 0x1 [0134.534] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x3f6 [0134.534] ReadFile (in: hFile=0x154, lpBuffer=0x1a4687c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a4687c*, lpNumberOfBytesRead=0x2ae390*=0x3f6, lpOverlapped=0x0) returned 1 [0134.564] CloseHandle (hObject=0x154) returned 1 [0134.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt", lpFilePart=0x0) returned 0x55 [0134.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0134.577] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.579] GetFileType (hFile=0x154) returned 0x1 [0134.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0134.579] GetFileType (hFile=0x154) returned 0x1 [0134.579] WriteFile (in: hFile=0x154, lpBuffer=0x1a95bcc*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a95bcc*, lpNumberOfBytesWritten=0x2ae358*=0x400, lpOverlapped=0x0) returned 1 [0134.580] CloseHandle (hObject=0x154) returned 1 [0134.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt", lpFilePart=0x0) returned 0x55 [0134.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt.anonymous", lpFilePart=0x0) returned 0x5f [0134.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0134.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3de32e0, ftCreationTime.dwHighDateTime=0x1d2f587, ftLastAccessTime.dwLowDateTime=0xa3de32e0, ftLastAccessTime.dwHighDateTime=0x1d2f587, ftLastWriteTime.dwLowDateTime=0xef2774f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x400)) returned 1 [0134.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0134.580] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.msn[1].txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\eebsym5@www.msn[1].txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\eebsym5@www.msn[1].txt.anonymous")) returned 1 [0134.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.581] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x40 [0134.581] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x41 [0134.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.582] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.582] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.582] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.582] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x40 [0134.582] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x41 [0134.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.583] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.583] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.583] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.583] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0134.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x44 [0134.583] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x45 [0134.583] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0134.583] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0134.584] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0134.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0134.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x44 [0134.584] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x45 [0134.584] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0134.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0134.584] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0134.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3d [0134.585] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x3e [0134.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.585] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3d [0134.585] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x3e [0134.585] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.586] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.586] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.586] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.586] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.586] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0134.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x41 [0134.586] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x42 [0134.586] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0134.587] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.587] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.587] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0134.587] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0134.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0134.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x41 [0134.587] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x42 [0134.587] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0134.588] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.588] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.588] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0134.588] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0134.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.588] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3c [0134.588] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x3d [0134.588] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.588] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.589] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.589] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.589] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.589] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.589] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.589] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.589] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.589] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3c [0134.589] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x3d [0134.590] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.590] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.591] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.591] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44 [0134.591] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x45 [0134.591] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.591] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.591] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.592] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.592] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44 [0134.592] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x45 [0134.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.592] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.592] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.592] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.592] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44 [0134.592] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x45 [0134.592] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.593] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.593] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.593] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.593] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44 [0134.593] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x45 [0134.593] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.593] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.593] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.593] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3b [0134.594] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x3c [0134.594] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.594] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.594] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.594] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.595] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.595] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.595] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3b [0134.595] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x3c [0134.595] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.595] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.595] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.595] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.595] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.596] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0134.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x3f [0134.596] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x40 [0134.596] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0134.596] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.596] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.596] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0134.596] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0134.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0134.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x3f [0134.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x40 [0134.597] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf158 [0134.597] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.597] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0134.597] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0134.597] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0134.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39 [0134.597] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x3a [0134.598] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.598] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.598] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.598] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.598] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.598] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.598] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.599] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.600] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.601] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.602] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.603] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.603] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.603] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.603] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.603] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.604] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.605] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.606] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.607] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.608] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.609] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0134.609] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0134.609] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39 [0134.609] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x3a [0134.609] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.610] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0134.611] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0134.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0134.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0134.611] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk", lpFilePart=0x0) returned 0x42 [0134.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.612] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-q6z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.612] GetFileType (hFile=0x154) returned 0x1 [0134.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.612] GetFileType (hFile=0x154) returned 0x1 [0134.612] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x38d [0134.613] CloseHandle (hObject=0x154) returned 1 [0134.625] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk", lpFilePart=0x0) returned 0x42 [0134.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.625] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-q6z.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.627] GetFileType (hFile=0x154) returned 0x1 [0134.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.627] GetFileType (hFile=0x154) returned 0x1 [0134.627] WriteFile (in: hFile=0x154, lpBuffer=0x1b173c4*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b173c4*, lpNumberOfBytesWritten=0x2ae3cc*=0x390, lpOverlapped=0x0) returned 1 [0134.628] CloseHandle (hObject=0x154) returned 1 [0134.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk", lpFilePart=0x0) returned 0x42 [0134.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk.anonymous", lpFilePart=0x0) returned 0x4c [0134.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-q6z.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f77b50, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9f77b50, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef2e9910, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x390)) returned 1 [0134.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.628] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-q6z.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Q6z.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-q6z.lnk.anonymous")) returned 1 [0134.630] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk", lpFilePart=0x0) returned 0x50 [0134.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.630] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-uniza 3w56yedg6l4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.630] GetFileType (hFile=0x154) returned 0x1 [0134.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.630] GetFileType (hFile=0x154) returned 0x1 [0134.630] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x986 [0134.631] CloseHandle (hObject=0x154) returned 1 [0134.643] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk", lpFilePart=0x0) returned 0x50 [0134.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.643] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-uniza 3w56yedg6l4.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.645] GetFileType (hFile=0x154) returned 0x1 [0134.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.645] GetFileType (hFile=0x154) returned 0x1 [0134.645] WriteFile (in: hFile=0x154, lpBuffer=0x1b69fbc*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b69fbc*, lpNumberOfBytesWritten=0x2ae3cc*=0x990, lpOverlapped=0x0) returned 1 [0134.646] CloseHandle (hObject=0x154) returned 1 [0134.646] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk", lpFilePart=0x0) returned 0x50 [0134.646] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0134.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-uniza 3w56yedg6l4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa829b090, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad9c9650, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef30fa70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1 [0134.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.646] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-uniza 3w56yedg6l4.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-unIZa 3w56yEdG6L4.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-uniza 3w56yedg6l4.lnk.anonymous")) returned 1 [0134.647] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk", lpFilePart=0x0) returned 0x51 [0134.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.647] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-xs1a3ez59p4fx94hmc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.647] GetFileType (hFile=0x154) returned 0x1 [0134.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.648] GetFileType (hFile=0x154) returned 0x1 [0134.648] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xf2e [0134.649] CloseHandle (hObject=0x154) returned 1 [0134.689] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk", lpFilePart=0x0) returned 0x51 [0134.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.689] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-xs1a3ez59p4fx94hmc.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.691] GetFileType (hFile=0x154) returned 0x1 [0134.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.691] GetFileType (hFile=0x154) returned 0x1 [0134.691] WriteFile (in: hFile=0x154, lpBuffer=0x19c36fc*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c36fc*, lpNumberOfBytesWritten=0x2ae3cc*=0xf30, lpOverlapped=0x0) returned 1 [0134.692] CloseHandle (hObject=0x154) returned 1 [0134.693] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk", lpFilePart=0x0) returned 0x51 [0134.693] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0134.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-xs1a3ez59p4fx94hmc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b88310, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa8b88310, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef381e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf30)) returned 1 [0134.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.693] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-xs1a3ez59p4fx94hmc.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-xS1a3Ez59p4Fx94HMc.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\-xs1a3ez59p4fx94hmc.lnk.anonymous")) returned 1 [0134.694] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk", lpFilePart=0x0) returned 0x52 [0134.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.694] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\085nrmhl2tuwcqb1 jch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.695] GetFileType (hFile=0x154) returned 0x1 [0134.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.695] GetFileType (hFile=0x154) returned 0x1 [0134.695] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3e1 [0134.695] ReadFile (in: hFile=0x154, lpBuffer=0x19c4e94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c4e94*, lpNumberOfBytesRead=0x2ae404*=0x3e1, lpOverlapped=0x0) returned 1 [0134.696] CloseHandle (hObject=0x154) returned 1 [0134.714] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk", lpFilePart=0x0) returned 0x52 [0134.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.714] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\085nrmhl2tuwcqb1 jch.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.716] GetFileType (hFile=0x154) returned 0x1 [0134.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.716] GetFileType (hFile=0x154) returned 0x1 [0134.716] WriteFile (in: hFile=0x154, lpBuffer=0x1a142f4*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a142f4*, lpNumberOfBytesWritten=0x2ae3cc*=0x3f0, lpOverlapped=0x0) returned 1 [0134.717] CloseHandle (hObject=0x154) returned 1 [0134.717] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk", lpFilePart=0x0) returned 0x52 [0134.718] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk.anonymous", lpFilePart=0x0) returned 0x5c [0134.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\085nrmhl2tuwcqb1 jch.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad494630, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad494630, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef3ce150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0134.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.718] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\085nrmhl2tuwcqb1 jch.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\085Nrmhl2TUwcqB1 jCh.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\085nrmhl2tuwcqb1 jch.lnk.anonymous")) returned 1 [0134.719] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk", lpFilePart=0x0) returned 0x45 [0134.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.719] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0brz6sq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.719] GetFileType (hFile=0x154) returned 0x1 [0134.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.719] GetFileType (hFile=0x154) returned 0x1 [0134.720] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1f7f [0134.720] ReadFile (in: hFile=0x154, lpBuffer=0x1a15670, nNumberOfBytesToRead=0x1f7f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a15670*, lpNumberOfBytesRead=0x2ae404*=0x1f7f, lpOverlapped=0x0) returned 1 [0134.721] CloseHandle (hObject=0x154) returned 1 [0134.739] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk", lpFilePart=0x0) returned 0x45 [0134.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.739] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0brz6sq.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.741] GetFileType (hFile=0x154) returned 0x1 [0134.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.741] GetFileType (hFile=0x154) returned 0x1 [0134.741] WriteFile (in: hFile=0x154, lpBuffer=0x1a6c1dc*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a6c1dc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1f80, lpOverlapped=0x0) returned 1 [0134.743] CloseHandle (hObject=0x154) returned 1 [0134.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk", lpFilePart=0x0) returned 0x45 [0134.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0134.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0brz6sq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8e4e10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad8e4e10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef3f42b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f80)) returned 1 [0134.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.744] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0brz6sq.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BrZ6Sq.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0brz6sq.lnk.anonymous")) returned 1 [0134.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk", lpFilePart=0x0) returned 0x4a [0134.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.745] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0jj-hysinhkl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.745] GetFileType (hFile=0x154) returned 0x1 [0134.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.745] GetFileType (hFile=0x154) returned 0x1 [0134.745] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x18ca [0134.745] ReadFile (in: hFile=0x154, lpBuffer=0x1a6e5b4, nNumberOfBytesToRead=0x18ca, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6e5b4*, lpNumberOfBytesRead=0x2ae404*=0x18ca, lpOverlapped=0x0) returned 1 [0134.746] CloseHandle (hObject=0x154) returned 1 [0134.758] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk", lpFilePart=0x0) returned 0x4a [0134.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.758] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0jj-hysinhkl.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.760] GetFileType (hFile=0x154) returned 0x1 [0134.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.760] GetFileType (hFile=0x154) returned 0x1 [0134.760] WriteFile (in: hFile=0x154, lpBuffer=0x1ac2fb0*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ac2fb0*, lpNumberOfBytesWritten=0x2ae3f8*=0x18d0, lpOverlapped=0x0) returned 1 [0134.761] CloseHandle (hObject=0x154) returned 1 [0134.761] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk", lpFilePart=0x0) returned 0x4a [0134.761] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0134.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0jj-hysinhkl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79d3f70, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad90af70, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef440570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18d0)) returned 1 [0134.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.762] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0jj-hysinhkl.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0jJ-HySiNHkl.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0jj-hysinhkl.lnk.anonymous")) returned 1 [0134.763] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk", lpFilePart=0x0) returned 0x47 [0134.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.763] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0k2xuwtnv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.763] GetFileType (hFile=0x154) returned 0x1 [0134.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.763] GetFileType (hFile=0x154) returned 0x1 [0134.763] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3aa [0134.763] ReadFile (in: hFile=0x154, lpBuffer=0x1ac50bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac50bc*, lpNumberOfBytesRead=0x2ae404*=0x3aa, lpOverlapped=0x0) returned 1 [0134.764] CloseHandle (hObject=0x154) returned 1 [0134.780] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk", lpFilePart=0x0) returned 0x47 [0134.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.780] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0k2xuwtnv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.782] GetFileType (hFile=0x154) returned 0x1 [0134.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.782] GetFileType (hFile=0x154) returned 0x1 [0134.782] WriteFile (in: hFile=0x154, lpBuffer=0x1b14248*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b14248*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0134.784] CloseHandle (hObject=0x154) returned 1 [0134.784] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk", lpFilePart=0x0) returned 0x47 [0134.784] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0134.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0k2xuwtnv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad363b30, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad363b30, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef4666d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0134.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.785] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0k2xuwtnv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0K2XUWTNV.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0k2xuwtnv.lnk.anonymous")) returned 1 [0134.786] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk", lpFilePart=0x0) returned 0x55 [0134.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.786] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0x_otpawow yzysm9a5.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.786] GetFileType (hFile=0x154) returned 0x1 [0134.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.786] GetFileType (hFile=0x154) returned 0x1 [0134.786] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13f4 [0134.786] ReadFile (in: hFile=0x154, lpBuffer=0x1b155bc, nNumberOfBytesToRead=0x13f4, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b155bc*, lpNumberOfBytesRead=0x2ae404*=0x13f4, lpOverlapped=0x0) returned 1 [0134.788] CloseHandle (hObject=0x154) returned 1 [0134.804] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk", lpFilePart=0x0) returned 0x55 [0134.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.804] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0x_otpawow yzysm9a5.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.806] GetFileType (hFile=0x154) returned 0x1 [0134.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.806] GetFileType (hFile=0x154) returned 0x1 [0134.806] WriteFile (in: hFile=0x154, lpBuffer=0x1b687a4*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b687a4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1400, lpOverlapped=0x0) returned 1 [0134.807] CloseHandle (hObject=0x154) returned 1 [0134.807] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk", lpFilePart=0x0) returned 0x55 [0134.807] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x5f [0134.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0x_otpawow yzysm9a5.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8607030, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa8607030, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef4b2990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1 [0134.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.807] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0x_otpawow yzysm9a5.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0X_OTpawOw yzYsm9a5.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\0x_otpawow yzysm9a5.mkv.lnk.anonymous")) returned 1 [0134.827] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk", lpFilePart=0x0) returned 0x51 [0134.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.827] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\23zhi8ojjbnzsjadj_x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.827] GetFileType (hFile=0x154) returned 0x1 [0134.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.827] GetFileType (hFile=0x154) returned 0x1 [0134.827] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1854 [0134.828] ReadFile (in: hFile=0x154, lpBuffer=0x1b6a0b4, nNumberOfBytesToRead=0x1854, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6a0b4*, lpNumberOfBytesRead=0x2ae404*=0x1854, lpOverlapped=0x0) returned 1 [0134.829] CloseHandle (hObject=0x154) returned 1 [0134.897] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk", lpFilePart=0x0) returned 0x51 [0134.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.897] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\23zhi8ojjbnzsjadj_x.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.903] GetFileType (hFile=0x154) returned 0x1 [0134.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.903] GetFileType (hFile=0x154) returned 0x1 [0134.903] WriteFile (in: hFile=0x154, lpBuffer=0x19bf18c*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19bf18c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1860, lpOverlapped=0x0) returned 1 [0134.905] CloseHandle (hObject=0x154) returned 1 [0134.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk", lpFilePart=0x0) returned 0x51 [0134.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0134.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\23zhi8ojjbnzsjadj_x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac247d10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad826730, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef5971d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1860)) returned 1 [0134.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.905] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\23zhi8ojjbnzsjadj_x.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\23zHI8OjJbnZsjAdj_x.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\23zhi8ojjbnzsjadj_x.lnk.anonymous")) returned 1 [0134.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk", lpFilePart=0x0) returned 0x47 [0134.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.906] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2a86ykumh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.907] GetFileType (hFile=0x154) returned 0x1 [0134.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.907] GetFileType (hFile=0x154) returned 0x1 [0134.907] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3aa [0134.907] ReadFile (in: hFile=0x154, lpBuffer=0x19c1264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c1264*, lpNumberOfBytesRead=0x2ae404*=0x3aa, lpOverlapped=0x0) returned 1 [0134.908] CloseHandle (hObject=0x154) returned 1 [0134.944] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk", lpFilePart=0x0) returned 0x47 [0134.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.944] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2a86ykumh.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.945] GetFileType (hFile=0x154) returned 0x1 [0134.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.945] GetFileType (hFile=0x154) returned 0x1 [0134.945] WriteFile (in: hFile=0x154, lpBuffer=0x1a1054c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a1054c*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0134.946] CloseHandle (hObject=0x154) returned 1 [0134.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk", lpFilePart=0x0) returned 0x47 [0134.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0134.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2a86ykumh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8ad830, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac8ad830, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef5e3490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0134.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.947] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2a86ykumh.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2A86YKUMH.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2a86ykumh.lnk.anonymous")) returned 1 [0134.948] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk", lpFilePart=0x0) returned 0x4a [0134.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.948] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2ccc6nbaza1o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.948] GetFileType (hFile=0x154) returned 0x1 [0134.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.948] GetFileType (hFile=0x154) returned 0x1 [0134.948] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3b9 [0134.948] ReadFile (in: hFile=0x154, lpBuffer=0x1a11c60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a11c60*, lpNumberOfBytesRead=0x2ae404*=0x3b9, lpOverlapped=0x0) returned 1 [0134.949] CloseHandle (hObject=0x154) returned 1 [0134.961] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk", lpFilePart=0x0) returned 0x4a [0134.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.961] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2ccc6nbaza1o.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.963] GetFileType (hFile=0x154) returned 0x1 [0134.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.963] GetFileType (hFile=0x154) returned 0x1 [0134.963] WriteFile (in: hFile=0x154, lpBuffer=0x1a60e4c*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a60e4c*, lpNumberOfBytesWritten=0x2ae3cc*=0x3c0, lpOverlapped=0x0) returned 1 [0134.964] CloseHandle (hObject=0x154) returned 1 [0134.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk", lpFilePart=0x0) returned 0x4a [0134.964] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0134.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.964] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2ccc6nbaza1o.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc50db0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadc50db0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef62f750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0134.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.964] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2ccc6nbaza1o.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ccC6NBAzA1O.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2ccc6nbaza1o.lnk.anonymous")) returned 1 [0134.967] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk", lpFilePart=0x0) returned 0x4e [0134.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.968] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2wnco77emnpf.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.968] GetFileType (hFile=0x154) returned 0x1 [0134.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.968] GetFileType (hFile=0x154) returned 0x1 [0134.968] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x126f [0134.968] ReadFile (in: hFile=0x154, lpBuffer=0x1a621c0, nNumberOfBytesToRead=0x126f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a621c0*, lpNumberOfBytesRead=0x2ae404*=0x126f, lpOverlapped=0x0) returned 1 [0134.969] CloseHandle (hObject=0x154) returned 1 [0134.986] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk", lpFilePart=0x0) returned 0x4e [0134.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0134.986] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2wnco77emnpf.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.987] GetFileType (hFile=0x154) returned 0x1 [0134.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0134.987] GetFileType (hFile=0x154) returned 0x1 [0134.987] WriteFile (in: hFile=0x154, lpBuffer=0x1ab4bdc*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ab4bdc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1270, lpOverlapped=0x0) returned 1 [0134.990] CloseHandle (hObject=0x154) returned 1 [0134.990] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk", lpFilePart=0x0) returned 0x4e [0134.990] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0134.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0134.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2wnco77emnpf.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccfe010, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaccfe010, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef6558b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1270)) returned 1 [0134.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0134.990] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2wnco77emnpf.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wnCO77eMNpF.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\2wnco77emnpf.mkv.lnk.anonymous")) returned 1 [0134.991] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk", lpFilePart=0x0) returned 0x52 [0134.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0134.991] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3dpyj5ry0zjbd9ivqibd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0134.991] GetFileType (hFile=0x154) returned 0x1 [0134.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0134.991] GetFileType (hFile=0x154) returned 0x1 [0134.991] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1eb7 [0134.991] ReadFile (in: hFile=0x154, lpBuffer=0x1ab6328, nNumberOfBytesToRead=0x1eb7, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab6328*, lpNumberOfBytesRead=0x2ae404*=0x1eb7, lpOverlapped=0x0) returned 1 [0134.992] CloseHandle (hObject=0x154) returned 1 [0135.004] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk", lpFilePart=0x0) returned 0x52 [0135.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.004] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3dpyj5ry0zjbd9ivqibd.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.006] GetFileType (hFile=0x154) returned 0x1 [0135.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.006] GetFileType (hFile=0x154) returned 0x1 [0135.006] WriteFile (in: hFile=0x154, lpBuffer=0x1b0cad4*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b0cad4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1ec0, lpOverlapped=0x0) returned 1 [0135.007] CloseHandle (hObject=0x154) returned 1 [0135.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk", lpFilePart=0x0) returned 0x52 [0135.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk.anonymous", lpFilePart=0x0) returned 0x5c [0135.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3dpyj5ry0zjbd9ivqibd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8900bb0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad8becb0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef67ba10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ec0)) returned 1 [0135.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.007] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3dpyj5ry0zjbd9ivqibd.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3DpYj5ry0ZjBd9iVQIBD.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3dpyj5ry0zjbd9ivqibd.lnk.anonymous")) returned 1 [0135.009] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk", lpFilePart=0x0) returned 0x51 [0135.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.009] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3ieij6rt82yif3 vfeu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.009] GetFileType (hFile=0x154) returned 0x1 [0135.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.009] GetFileType (hFile=0x154) returned 0x1 [0135.009] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3dc [0135.009] ReadFile (in: hFile=0x154, lpBuffer=0x1b0f278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b0f278*, lpNumberOfBytesRead=0x2ae404*=0x3dc, lpOverlapped=0x0) returned 1 [0135.010] CloseHandle (hObject=0x154) returned 1 [0135.022] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk", lpFilePart=0x0) returned 0x51 [0135.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.022] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3ieij6rt82yif3 vfeu.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.023] GetFileType (hFile=0x154) returned 0x1 [0135.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.023] GetFileType (hFile=0x154) returned 0x1 [0135.023] WriteFile (in: hFile=0x154, lpBuffer=0x1b5e518*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b5e518*, lpNumberOfBytesWritten=0x2ae3cc*=0x3e0, lpOverlapped=0x0) returned 1 [0135.025] CloseHandle (hObject=0x154) returned 1 [0135.025] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk", lpFilePart=0x0) returned 0x51 [0135.025] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0135.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3ieij6rt82yif3 vfeu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc8bbf0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xacc8bbf0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef6c7cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0135.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.025] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3ieij6rt82yif3 vfeu.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ieIJ6rt82yiF3 vfEU.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3ieij6rt82yif3 vfeu.lnk.anonymous")) returned 1 [0135.026] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk", lpFilePart=0x0) returned 0x4a [0135.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.026] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3pkviisc4r3h.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.026] GetFileType (hFile=0x154) returned 0x1 [0135.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.026] GetFileType (hFile=0x154) returned 0x1 [0135.026] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe81 [0135.026] ReadFile (in: hFile=0x154, lpBuffer=0x1b60730, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b60730*, lpNumberOfBytesRead=0x2ae404*=0xe81, lpOverlapped=0x0) returned 1 [0135.027] CloseHandle (hObject=0x154) returned 1 [0135.064] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk", lpFilePart=0x0) returned 0x4a [0135.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.064] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3pkviisc4r3h.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.065] GetFileType (hFile=0x154) returned 0x1 [0135.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.065] GetFileType (hFile=0x154) returned 0x1 [0135.066] CloseHandle (hObject=0x154) returned 1 [0135.066] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk", lpFilePart=0x0) returned 0x4a [0135.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0135.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3pkviisc4r3h.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73482f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa73482f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef713f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe90)) returned 1 [0135.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.067] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3pkviisc4r3h.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PkviIsC4r3h.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\3pkviisc4r3h.lnk.anonymous")) returned 1 [0135.068] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk", lpFilePart=0x0) returned 0x4f [0135.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.068] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\5lnut-tpw5jxtx02v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.068] GetFileType (hFile=0x154) returned 0x1 [0135.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.068] GetFileType (hFile=0x154) returned 0x1 [0135.068] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x244 [0135.068] ReadFile (in: hFile=0x154, lpBuffer=0x19b3b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19b3b08*, lpNumberOfBytesRead=0x2ae404*=0x244, lpOverlapped=0x0) returned 1 [0135.069] CloseHandle (hObject=0x154) returned 1 [0135.081] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk", lpFilePart=0x0) returned 0x4f [0135.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.081] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\5lnut-tpw5jxtx02v.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.082] GetFileType (hFile=0x154) returned 0x1 [0135.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.083] GetFileType (hFile=0x154) returned 0x1 [0135.084] CloseHandle (hObject=0x154) returned 1 [0135.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk", lpFilePart=0x0) returned 0x4f [0135.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0135.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\5lnut-tpw5jxtx02v.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad14e7f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad14e7f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef73a0f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0135.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.084] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\5lnut-tpw5jxtx02v.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lnut-TPW5jxtX02V.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\5lnut-tpw5jxtx02v.lnk.anonymous")) returned 1 [0135.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk", lpFilePart=0x0) returned 0x4b [0135.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.085] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\6hwrivnjo6io9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.085] GetFileType (hFile=0x154) returned 0x1 [0135.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.085] GetFileType (hFile=0x154) returned 0x1 [0135.085] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xedd [0135.085] ReadFile (in: hFile=0x154, lpBuffer=0x1a0499c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a0499c*, lpNumberOfBytesRead=0x2ae404*=0xedd, lpOverlapped=0x0) returned 1 [0135.087] CloseHandle (hObject=0x154) returned 1 [0135.098] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk", lpFilePart=0x0) returned 0x4b [0135.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.099] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\6hwrivnjo6io9.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.100] GetFileType (hFile=0x154) returned 0x1 [0135.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.100] GetFileType (hFile=0x154) returned 0x1 [0135.100] WriteFile (in: hFile=0x154, lpBuffer=0x1a57324*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a57324*, lpNumberOfBytesWritten=0x2ae3cc*=0xee0, lpOverlapped=0x0) returned 1 [0135.101] CloseHandle (hObject=0x154) returned 1 [0135.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk", lpFilePart=0x0) returned 0x4b [0135.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0135.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\6hwrivnjo6io9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59efd0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad59efd0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef760250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xee0)) returned 1 [0135.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.102] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\6hwrivnjo6io9.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6hwRiVNjo6io9.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\6hwrivnjo6io9.lnk.anonymous")) returned 1 [0135.103] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk", lpFilePart=0x0) returned 0x4e [0135.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.103] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8hmartu-2lka3 p9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.103] GetFileType (hFile=0x154) returned 0x1 [0135.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.103] GetFileType (hFile=0x154) returned 0x1 [0135.103] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x93f [0135.103] ReadFile (in: hFile=0x154, lpBuffer=0x1a58fe4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a58fe4*, lpNumberOfBytesRead=0x2ae404*=0x93f, lpOverlapped=0x0) returned 1 [0135.104] CloseHandle (hObject=0x154) returned 1 [0135.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk", lpFilePart=0x0) returned 0x4e [0135.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.116] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8hmartu-2lka3 p9.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.118] GetFileType (hFile=0x154) returned 0x1 [0135.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.118] GetFileType (hFile=0x154) returned 0x1 [0135.119] CloseHandle (hObject=0x154) returned 1 [0135.119] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk", lpFilePart=0x0) returned 0x4e [0135.119] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0135.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8hmartu-2lka3 p9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa355f10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaca9ca10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef7ac510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x940)) returned 1 [0135.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.119] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8hmartu-2lka3 p9.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8HMaRtU-2LKA3 p9.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8hmartu-2lka3 p9.lnk.anonymous")) returned 1 [0135.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk", lpFilePart=0x0) returned 0x51 [0135.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.121] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8o jt3mgjchjyd6tlti.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.121] GetFileType (hFile=0x154) returned 0x1 [0135.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.121] GetFileType (hFile=0x154) returned 0x1 [0135.121] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3dc [0135.121] ReadFile (in: hFile=0x154, lpBuffer=0x1aab4d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aab4d8*, lpNumberOfBytesRead=0x2ae404*=0x3dc, lpOverlapped=0x0) returned 1 [0135.122] CloseHandle (hObject=0x154) returned 1 [0135.134] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk", lpFilePart=0x0) returned 0x51 [0135.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.134] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8o jt3mgjchjyd6tlti.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.135] GetFileType (hFile=0x154) returned 0x1 [0135.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.135] GetFileType (hFile=0x154) returned 0x1 [0135.136] CloseHandle (hObject=0x154) returned 1 [0135.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk", lpFilePart=0x0) returned 0x51 [0135.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0135.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8o jt3mgjchjyd6tlti.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad78e1b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad78e1b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef7d2670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0135.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.137] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8o jt3mgjchjyd6tlti.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8o JT3mgJChJyD6tLTi.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8o jt3mgjchjyd6tlti.lnk.anonymous")) returned 1 [0135.138] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk", lpFilePart=0x0) returned 0x54 [0135.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.138] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8uz0b aifstokotc2h.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.138] GetFileType (hFile=0x154) returned 0x1 [0135.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.138] GetFileType (hFile=0x154) returned 0x1 [0135.138] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13c5 [0135.138] ReadFile (in: hFile=0x154, lpBuffer=0x1afbb28, nNumberOfBytesToRead=0x13c5, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1afbb28*, lpNumberOfBytesRead=0x2ae404*=0x13c5, lpOverlapped=0x0) returned 1 [0135.139] CloseHandle (hObject=0x154) returned 1 [0135.154] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk", lpFilePart=0x0) returned 0x54 [0135.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.154] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8uz0b aifstokotc2h.ots.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.155] GetFileType (hFile=0x154) returned 0x1 [0135.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.155] GetFileType (hFile=0x154) returned 0x1 [0135.155] WriteFile (in: hFile=0x154, lpBuffer=0x1b4ec24*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b4ec24*, lpNumberOfBytesWritten=0x2ae3f8*=0x13d0, lpOverlapped=0x0) returned 1 [0135.156] CloseHandle (hObject=0x154) returned 1 [0135.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk", lpFilePart=0x0) returned 0x54 [0135.156] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk.anonymous", lpFilePart=0x0) returned 0x5e [0135.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.157] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8uz0b aifstokotc2h.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa76da3f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa76da3f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef7f87d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13d0)) returned 1 [0135.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.157] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8uz0b aifstokotc2h.ots.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8UZ0B AifStoKOtC2h.ots.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8uz0b aifstokotc2h.ots.lnk.anonymous")) returned 1 [0135.158] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk", lpFilePart=0x0) returned 0x53 [0135.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.158] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8vvzfh-hhidgi9oqn.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.158] GetFileType (hFile=0x154) returned 0x1 [0135.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.158] GetFileType (hFile=0x154) returned 0x1 [0135.158] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x19a3 [0135.158] ReadFile (in: hFile=0x154, lpBuffer=0x1b5050c, nNumberOfBytesToRead=0x19a3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b5050c*, lpNumberOfBytesRead=0x2ae404*=0x19a3, lpOverlapped=0x0) returned 1 [0135.159] CloseHandle (hObject=0x154) returned 1 [0135.195] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk", lpFilePart=0x0) returned 0x53 [0135.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.195] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8vvzfh-hhidgi9oqn.ots.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.197] GetFileType (hFile=0x154) returned 0x1 [0135.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.197] GetFileType (hFile=0x154) returned 0x1 [0135.197] WriteFile (in: hFile=0x154, lpBuffer=0x19a5ec8*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19a5ec8*, lpNumberOfBytesWritten=0x2ae3f8*=0x19b0, lpOverlapped=0x0) returned 1 [0135.198] CloseHandle (hObject=0x154) returned 1 [0135.198] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk", lpFilePart=0x0) returned 0x53 [0135.198] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk.anonymous", lpFilePart=0x0) returned 0x5d [0135.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8vvzfh-hhidgi9oqn.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c57e70, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9c57e70, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef86abf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19b0)) returned 1 [0135.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.198] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8vvzfh-hhidgi9oqn.ots.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8VVzfh-HHiDGI9oQn.ots.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\8vvzfh-hhidgi9oqn.ots.lnk.anonymous")) returned 1 [0135.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk", lpFilePart=0x0) returned 0x48 [0135.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.200] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9-xcdq4eqe.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.200] GetFileType (hFile=0x154) returned 0x1 [0135.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.200] GetFileType (hFile=0x154) returned 0x1 [0135.200] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xdd7 [0135.200] ReadFile (in: hFile=0x154, lpBuffer=0x19a8b38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a8b38*, lpNumberOfBytesRead=0x2ae404*=0xdd7, lpOverlapped=0x0) returned 1 [0135.201] CloseHandle (hObject=0x154) returned 1 [0135.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk", lpFilePart=0x0) returned 0x48 [0135.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.213] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9-xcdq4eqe.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.215] GetFileType (hFile=0x154) returned 0x1 [0135.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.215] GetFileType (hFile=0x154) returned 0x1 [0135.215] WriteFile (in: hFile=0x154, lpBuffer=0x19fb11c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19fb11c*, lpNumberOfBytesWritten=0x2ae3cc*=0xde0, lpOverlapped=0x0) returned 1 [0135.216] CloseHandle (hObject=0x154) returned 1 [0135.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk", lpFilePart=0x0) returned 0x48 [0135.216] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0135.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9-xcdq4eqe.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7e96b70, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad9ef7b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef890d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xde0)) returned 1 [0135.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.216] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9-xcdq4eqe.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-XcDQ4eQE.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9-xcdq4eqe.lnk.anonymous")) returned 1 [0135.217] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk", lpFilePart=0x0) returned 0x46 [0135.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.217] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9joqd5ex.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.218] GetFileType (hFile=0x154) returned 0x1 [0135.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.218] GetFileType (hFile=0x154) returned 0x1 [0135.218] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3a5 [0135.218] ReadFile (in: hFile=0x154, lpBuffer=0x19fc818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fc818*, lpNumberOfBytesRead=0x2ae404*=0x3a5, lpOverlapped=0x0) returned 1 [0135.219] CloseHandle (hObject=0x154) returned 1 [0135.231] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk", lpFilePart=0x0) returned 0x46 [0135.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.231] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9joqd5ex.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.232] GetFileType (hFile=0x154) returned 0x1 [0135.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.232] GetFileType (hFile=0x154) returned 0x1 [0135.232] WriteFile (in: hFile=0x154, lpBuffer=0x1a4b9a8*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a4b9a8*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0135.233] CloseHandle (hObject=0x154) returned 1 [0135.233] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk", lpFilePart=0x0) returned 0x46 [0135.233] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0135.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.234] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9joqd5ex.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9c9650, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad9c9650, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef8b6eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0135.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.234] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9joqd5ex.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9joQD5eX.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9joqd5ex.lnk.anonymous")) returned 1 [0135.235] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk", lpFilePart=0x0) returned 0x50 [0135.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.235] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9lnlju7r5rujvak78b.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.235] GetFileType (hFile=0x154) returned 0x1 [0135.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.235] GetFileType (hFile=0x154) returned 0x1 [0135.235] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa00 [0135.235] ReadFile (in: hFile=0x154, lpBuffer=0x1a4d718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a4d718*, lpNumberOfBytesRead=0x2ae404*=0xa00, lpOverlapped=0x0) returned 1 [0135.236] CloseHandle (hObject=0x154) returned 1 [0135.248] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk", lpFilePart=0x0) returned 0x50 [0135.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.248] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9lnlju7r5rujvak78b.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.249] GetFileType (hFile=0x154) returned 0x1 [0135.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.249] GetFileType (hFile=0x154) returned 0x1 [0135.250] WriteFile (in: hFile=0x154, lpBuffer=0x1a9e8b4*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a9e8b4*, lpNumberOfBytesWritten=0x2ae3cc*=0xa10, lpOverlapped=0x0) returned 1 [0135.251] CloseHandle (hObject=0x154) returned 1 [0135.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk", lpFilePart=0x0) returned 0x50 [0135.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0135.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9lnlju7r5rujvak78b.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab90e7d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xab90e7d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef8dd010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa10)) returned 1 [0135.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.251] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9lnlju7r5rujvak78b.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Lnlju7R5rujvAK78B.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9lnlju7r5rujvak78b.lnk.anonymous")) returned 1 [0135.252] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk", lpFilePart=0x0) returned 0x49 [0135.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.252] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9nohbkfhzpn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.252] GetFileType (hFile=0x154) returned 0x1 [0135.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.252] GetFileType (hFile=0x154) returned 0x1 [0135.252] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x221 [0135.252] ReadFile (in: hFile=0x154, lpBuffer=0x1a9fe64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a9fe64*, lpNumberOfBytesRead=0x2ae404*=0x221, lpOverlapped=0x0) returned 1 [0135.253] CloseHandle (hObject=0x154) returned 1 [0135.266] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk", lpFilePart=0x0) returned 0x49 [0135.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.266] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9nohbkfhzpn.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.267] GetFileType (hFile=0x154) returned 0x1 [0135.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.267] GetFileType (hFile=0x154) returned 0x1 [0135.267] WriteFile (in: hFile=0x154, lpBuffer=0x1aee880*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aee880*, lpNumberOfBytesWritten=0x2ae3cc*=0x230, lpOverlapped=0x0) returned 1 [0135.268] CloseHandle (hObject=0x154) returned 1 [0135.268] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk", lpFilePart=0x0) returned 0x49 [0135.269] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0135.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.269] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9nohbkfhzpn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7da470, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad7da470, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef903170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0135.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.269] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9nohbkfhzpn.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9NoHbkFHzpn.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9nohbkfhzpn.lnk.anonymous")) returned 1 [0135.270] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk", lpFilePart=0x0) returned 0x4c [0135.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.270] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9vsthmg8wfp0cb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.270] GetFileType (hFile=0x154) returned 0x1 [0135.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.270] GetFileType (hFile=0x154) returned 0x1 [0135.270] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x230 [0135.270] ReadFile (in: hFile=0x154, lpBuffer=0x1aefe1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aefe1c*, lpNumberOfBytesRead=0x2ae404*=0x230, lpOverlapped=0x0) returned 1 [0135.271] CloseHandle (hObject=0x154) returned 1 [0135.283] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk", lpFilePart=0x0) returned 0x4c [0135.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.283] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9vsthmg8wfp0cb.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.285] GetFileType (hFile=0x154) returned 0x1 [0135.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.285] GetFileType (hFile=0x154) returned 0x1 [0135.285] WriteFile (in: hFile=0x154, lpBuffer=0x1b3e898*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3e898*, lpNumberOfBytesWritten=0x2ae3cc*=0x240, lpOverlapped=0x0) returned 1 [0135.286] CloseHandle (hObject=0x154) returned 1 [0135.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk", lpFilePart=0x0) returned 0x4c [0135.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0135.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9vsthmg8wfp0cb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc50db0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadc50db0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xef9292d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0135.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.286] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9vsthmg8wfp0cb.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9vstHmg8wFp0Cb.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\9vsthmg8wfp0cb.lnk.anonymous")) returned 1 [0135.358] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk", lpFilePart=0x0) returned 0x53 [0135.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.358] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\a2v 4wgq14jfsqrcp.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.358] GetFileType (hFile=0x154) returned 0x1 [0135.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.358] GetFileType (hFile=0x154) returned 0x1 [0135.358] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23f [0135.358] ReadFile (in: hFile=0x154, lpBuffer=0x1b3fe74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3fe74*, lpNumberOfBytesRead=0x2ae404*=0x23f, lpOverlapped=0x0) returned 1 [0135.359] CloseHandle (hObject=0x154) returned 1 [0135.371] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk", lpFilePart=0x0) returned 0x53 [0135.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.371] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\a2v 4wgq14jfsqrcp.ots.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.372] GetFileType (hFile=0x154) returned 0x1 [0135.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.372] GetFileType (hFile=0x154) returned 0x1 [0135.372] WriteFile (in: hFile=0x154, lpBuffer=0x1b8e8fc*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b8e8fc*, lpNumberOfBytesWritten=0x2ae3cc*=0x240, lpOverlapped=0x0) returned 1 [0135.373] CloseHandle (hObject=0x154) returned 1 [0135.374] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk", lpFilePart=0x0) returned 0x53 [0135.374] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk.anonymous", lpFilePart=0x0) returned 0x5d [0135.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\a2v 4wgq14jfsqrcp.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9310d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad9310d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefa0db10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0135.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.374] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\a2v 4wgq14jfsqrcp.ots.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a2V 4Wgq14jFsqrCP.ots.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\a2v 4wgq14jfsqrcp.ots.lnk.anonymous")) returned 1 [0135.375] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk", lpFilePart=0x0) returned 0x4a [0135.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.378] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ar8pecl2bnhm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.378] GetFileType (hFile=0x154) returned 0x1 [0135.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.378] GetFileType (hFile=0x154) returned 0x1 [0135.379] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x226 [0135.379] ReadFile (in: hFile=0x154, lpBuffer=0x198decc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x198decc*, lpNumberOfBytesRead=0x2ae404*=0x226, lpOverlapped=0x0) returned 1 [0135.379] CloseHandle (hObject=0x154) returned 1 [0135.415] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk", lpFilePart=0x0) returned 0x4a [0135.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.415] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ar8pecl2bnhm.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.416] GetFileType (hFile=0x154) returned 0x1 [0135.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.416] GetFileType (hFile=0x154) returned 0x1 [0135.416] WriteFile (in: hFile=0x154, lpBuffer=0x19dca48*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19dca48*, lpNumberOfBytesWritten=0x2ae3cc*=0x230, lpOverlapped=0x0) returned 1 [0135.417] CloseHandle (hObject=0x154) returned 1 [0135.417] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk", lpFilePart=0x0) returned 0x4a [0135.417] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0135.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ar8pecl2bnhm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad494630, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad494630, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefa7ff30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0135.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.418] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ar8pecl2bnhm.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AR8pECl2BnhM.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ar8pecl2bnhm.lnk.anonymous")) returned 1 [0135.418] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk", lpFilePart=0x0) returned 0x4b [0135.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.419] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\b9tcuamsn.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.419] GetFileType (hFile=0x154) returned 0x1 [0135.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.419] GetFileType (hFile=0x154) returned 0x1 [0135.419] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3aa [0135.419] ReadFile (in: hFile=0x154, lpBuffer=0x19de164, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19de164*, lpNumberOfBytesRead=0x2ae404*=0x3aa, lpOverlapped=0x0) returned 1 [0135.420] CloseHandle (hObject=0x154) returned 1 [0135.432] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk", lpFilePart=0x0) returned 0x4b [0135.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.432] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\b9tcuamsn.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.433] GetFileType (hFile=0x154) returned 0x1 [0135.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.433] GetFileType (hFile=0x154) returned 0x1 [0135.433] WriteFile (in: hFile=0x154, lpBuffer=0x1a2d300*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a2d300*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0135.434] CloseHandle (hObject=0x154) returned 1 [0135.434] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk", lpFilePart=0x0) returned 0x4b [0135.435] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0135.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\b9tcuamsn.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad174950, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad174950, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefaa6090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0135.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.435] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\b9tcuamsn.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b9TcUAMSn.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\b9tcuamsn.flv.lnk.anonymous")) returned 1 [0135.436] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk", lpFilePart=0x0) returned 0x46 [0135.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.436] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bglz.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.436] GetFileType (hFile=0x154) returned 0x1 [0135.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.436] GetFileType (hFile=0x154) returned 0x1 [0135.436] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x134f [0135.436] ReadFile (in: hFile=0x154, lpBuffer=0x1a2e654, nNumberOfBytesToRead=0x134f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a2e654*, lpNumberOfBytesRead=0x2ae404*=0x134f, lpOverlapped=0x0) returned 1 [0135.437] CloseHandle (hObject=0x154) returned 1 [0135.449] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk", lpFilePart=0x0) returned 0x46 [0135.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.449] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bglz.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.451] GetFileType (hFile=0x154) returned 0x1 [0135.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.451] GetFileType (hFile=0x154) returned 0x1 [0135.451] WriteFile (in: hFile=0x154, lpBuffer=0x1a814d0*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a814d0*, lpNumberOfBytesWritten=0x2ae3f8*=0x1350, lpOverlapped=0x0) returned 1 [0135.452] CloseHandle (hObject=0x154) returned 1 [0135.452] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk", lpFilePart=0x0) returned 0x46 [0135.452] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0135.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bglz.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae0c210, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaae0c210, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefacc1f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1350)) returned 1 [0135.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.453] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bglz.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bglz.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bglz.flv.lnk.anonymous")) returned 1 [0135.453] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk", lpFilePart=0x0) returned 0x51 [0135.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.454] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bv2g72jduqxbisfhnl8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.454] GetFileType (hFile=0x154) returned 0x1 [0135.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.454] GetFileType (hFile=0x154) returned 0x1 [0135.454] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3dc [0135.454] ReadFile (in: hFile=0x154, lpBuffer=0x1a8308c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8308c*, lpNumberOfBytesRead=0x2ae404*=0x3dc, lpOverlapped=0x0) returned 1 [0135.455] CloseHandle (hObject=0x154) returned 1 [0135.468] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk", lpFilePart=0x0) returned 0x51 [0135.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.468] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bv2g72jduqxbisfhnl8.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.469] GetFileType (hFile=0x154) returned 0x1 [0135.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.470] GetFileType (hFile=0x154) returned 0x1 [0135.470] WriteFile (in: hFile=0x154, lpBuffer=0x1ad232c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ad232c*, lpNumberOfBytesWritten=0x2ae3cc*=0x3e0, lpOverlapped=0x0) returned 1 [0135.471] CloseHandle (hObject=0x154) returned 1 [0135.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk", lpFilePart=0x0) returned 0x51 [0135.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0135.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bv2g72jduqxbisfhnl8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb202b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadb202b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefaf2350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0135.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.471] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bv2g72jduqxbisfhnl8.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BV2g72JDuqxBisfhNl8.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\bv2g72jduqxbisfhnl8.lnk.anonymous")) returned 1 [0135.472] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk", lpFilePart=0x0) returned 0x43 [0135.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.472] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\cdtof.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.472] GetFileType (hFile=0x154) returned 0x1 [0135.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.472] GetFileType (hFile=0x154) returned 0x1 [0135.472] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd24 [0135.472] ReadFile (in: hFile=0x154, lpBuffer=0x1ad43c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad43c4*, lpNumberOfBytesRead=0x2ae404*=0xd24, lpOverlapped=0x0) returned 1 [0135.473] CloseHandle (hObject=0x154) returned 1 [0135.485] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk", lpFilePart=0x0) returned 0x43 [0135.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.485] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\cdtof.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.487] GetFileType (hFile=0x154) returned 0x1 [0135.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.487] GetFileType (hFile=0x154) returned 0x1 [0135.487] WriteFile (in: hFile=0x154, lpBuffer=0x1b264c4*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b264c4*, lpNumberOfBytesWritten=0x2ae3cc*=0xd30, lpOverlapped=0x0) returned 1 [0135.488] CloseHandle (hObject=0x154) returned 1 [0135.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk", lpFilePart=0x0) returned 0x43 [0135.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0135.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\cdtof.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b50d30, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaccfe010, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefb184b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd30)) returned 1 [0135.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.489] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\cdtof.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cDtOF.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\cdtof.lnk.anonymous")) returned 1 [0135.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk", lpFilePart=0x0) returned 0x50 [0135.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.490] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dd5uzuigdkdv9cuxtb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.490] GetFileType (hFile=0x154) returned 0x1 [0135.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.490] GetFileType (hFile=0x154) returned 0x1 [0135.490] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9e0 [0135.490] ReadFile (in: hFile=0x154, lpBuffer=0x1b281fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b281fc*, lpNumberOfBytesRead=0x2ae404*=0x9e0, lpOverlapped=0x0) returned 1 [0135.491] CloseHandle (hObject=0x154) returned 1 [0135.503] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk", lpFilePart=0x0) returned 0x50 [0135.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.503] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dd5uzuigdkdv9cuxtb.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.505] GetFileType (hFile=0x154) returned 0x1 [0135.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.505] GetFileType (hFile=0x154) returned 0x1 [0135.505] WriteFile (in: hFile=0x154, lpBuffer=0x1b792f8*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b792f8*, lpNumberOfBytesWritten=0x2ae3cc*=0x9f0, lpOverlapped=0x0) returned 1 [0135.506] CloseHandle (hObject=0x154) returned 1 [0135.506] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk", lpFilePart=0x0) returned 0x50 [0135.506] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0135.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.506] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dd5uzuigdkdv9cuxtb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc76f10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadc76f10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefb3e610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9f0)) returned 1 [0135.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.507] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dd5uzuigdkdv9cuxtb.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dD5UZUigDkdV9CuxtB.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dd5uzuigdkdv9cuxtb.lnk.anonymous")) returned 1 [0135.508] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk", lpFilePart=0x0) returned 0x42 [0135.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.508] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\diou.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.508] GetFileType (hFile=0x154) returned 0x1 [0135.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.508] GetFileType (hFile=0x154) returned 0x1 [0135.508] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x962 [0135.508] ReadFile (in: hFile=0x154, lpBuffer=0x1b7afe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7afe8*, lpNumberOfBytesRead=0x2ae404*=0x962, lpOverlapped=0x0) returned 1 [0135.509] CloseHandle (hObject=0x154) returned 1 [0135.546] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk", lpFilePart=0x0) returned 0x42 [0135.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.546] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\diou.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.548] GetFileType (hFile=0x154) returned 0x1 [0135.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.548] GetFileType (hFile=0x154) returned 0x1 [0135.548] WriteFile (in: hFile=0x154, lpBuffer=0x19cca34*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19cca34*, lpNumberOfBytesWritten=0x2ae3cc*=0x970, lpOverlapped=0x0) returned 1 [0135.549] CloseHandle (hObject=0x154) returned 1 [0135.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk", lpFilePart=0x0) returned 0x42 [0135.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk.anonymous", lpFilePart=0x0) returned 0x4c [0135.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\diou.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9edf5d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9edf5d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefbb0a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0135.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.549] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\diou.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dIOu.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\diou.lnk.anonymous")) returned 1 [0135.550] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk", lpFilePart=0x0) returned 0x4a [0135.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.550] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dnfyt-4h0rjw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.550] GetFileType (hFile=0x154) returned 0x1 [0135.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.551] GetFileType (hFile=0x154) returned 0x1 [0135.551] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xeda [0135.551] ReadFile (in: hFile=0x154, lpBuffer=0x19cec50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cec50*, lpNumberOfBytesRead=0x2ae404*=0xeda, lpOverlapped=0x0) returned 1 [0135.552] CloseHandle (hObject=0x154) returned 1 [0135.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk", lpFilePart=0x0) returned 0x4a [0135.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.564] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dnfyt-4h0rjw.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.565] GetFileType (hFile=0x154) returned 0x1 [0135.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.565] GetFileType (hFile=0x154) returned 0x1 [0135.565] WriteFile (in: hFile=0x154, lpBuffer=0x1a21738*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a21738*, lpNumberOfBytesWritten=0x2ae3cc*=0xee0, lpOverlapped=0x0) returned 1 [0135.566] CloseHandle (hObject=0x154) returned 1 [0135.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk", lpFilePart=0x0) returned 0x4a [0135.566] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0135.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dnfyt-4h0rjw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cca290, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9cca290, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefbd6b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xee0)) returned 1 [0135.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.567] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dnfyt-4h0rjw.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DnfYT-4h0rjw.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dnfyt-4h0rjw.lnk.anonymous")) returned 1 [0135.568] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk", lpFilePart=0x0) returned 0x4e [0135.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.568] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dpvcqnsvdx40nlin.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.568] GetFileType (hFile=0x154) returned 0x1 [0135.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.568] GetFileType (hFile=0x154) returned 0x1 [0135.568] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xead [0135.568] ReadFile (in: hFile=0x154, lpBuffer=0x1a23968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a23968*, lpNumberOfBytesRead=0x2ae404*=0xead, lpOverlapped=0x0) returned 1 [0135.569] CloseHandle (hObject=0x154) returned 1 [0135.581] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk", lpFilePart=0x0) returned 0x4e [0135.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.581] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dpvcqnsvdx40nlin.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.583] GetFileType (hFile=0x154) returned 0x1 [0135.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.583] GetFileType (hFile=0x154) returned 0x1 [0135.583] WriteFile (in: hFile=0x154, lpBuffer=0x1a76210*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a76210*, lpNumberOfBytesWritten=0x2ae3cc*=0xeb0, lpOverlapped=0x0) returned 1 [0135.584] CloseHandle (hObject=0x154) returned 1 [0135.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk", lpFilePart=0x0) returned 0x4e [0135.584] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0135.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.584] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dpvcqnsvdx40nlin.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2a1bf0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaf2a1bf0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefbfccf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xeb0)) returned 1 [0135.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.584] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dpvcqnsvdx40nlin.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dpVcqNsvdX40nLIn.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dpvcqnsvdx40nlin.lnk.anonymous")) returned 1 [0135.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk", lpFilePart=0x0) returned 0x44 [0135.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.585] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dqlfmx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.585] GetFileType (hFile=0x154) returned 0x1 [0135.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.585] GetFileType (hFile=0x154) returned 0x1 [0135.586] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1e9b [0135.586] ReadFile (in: hFile=0x154, lpBuffer=0x1a77574, nNumberOfBytesToRead=0x1e9b, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a77574*, lpNumberOfBytesRead=0x2ae404*=0x1e9b, lpOverlapped=0x0) returned 1 [0135.586] CloseHandle (hObject=0x154) returned 1 [0135.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk", lpFilePart=0x0) returned 0x44 [0135.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.600] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dqlfmx.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.601] GetFileType (hFile=0x154) returned 0x1 [0135.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.601] GetFileType (hFile=0x154) returned 0x1 [0135.601] WriteFile (in: hFile=0x154, lpBuffer=0x1acdc80*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1acdc80*, lpNumberOfBytesWritten=0x2ae3f8*=0x1ea0, lpOverlapped=0x0) returned 1 [0135.602] CloseHandle (hObject=0x154) returned 1 [0135.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk", lpFilePart=0x0) returned 0x44 [0135.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk.anonymous", lpFilePart=0x0) returned 0x4e [0135.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dqlfmx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7452c90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad128690, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefc48fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ea0)) returned 1 [0135.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.603] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dqlfmx.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DQLFmX.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\dqlfmx.lnk.anonymous")) returned 1 [0135.604] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk", lpFilePart=0x0) returned 0x51 [0135.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.604] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\efnezqs-f2_fzq2l6d0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.604] GetFileType (hFile=0x154) returned 0x1 [0135.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.604] GetFileType (hFile=0x154) returned 0x1 [0135.604] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa07 [0135.604] ReadFile (in: hFile=0x154, lpBuffer=0x1ad09a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad09a4*, lpNumberOfBytesRead=0x2ae404*=0xa07, lpOverlapped=0x0) returned 1 [0135.605] CloseHandle (hObject=0x154) returned 1 [0135.617] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk", lpFilePart=0x0) returned 0x51 [0135.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.617] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\efnezqs-f2_fzq2l6d0.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.619] GetFileType (hFile=0x154) returned 0x1 [0135.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.619] GetFileType (hFile=0x154) returned 0x1 [0135.619] WriteFile (in: hFile=0x154, lpBuffer=0x1b21b3c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b21b3c*, lpNumberOfBytesWritten=0x2ae3cc*=0xa10, lpOverlapped=0x0) returned 1 [0135.620] CloseHandle (hObject=0x154) returned 1 [0135.620] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk", lpFilePart=0x0) returned 0x51 [0135.620] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0135.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\efnezqs-f2_fzq2l6d0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f8c830, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa8f8c830, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefc6f110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa10)) returned 1 [0135.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.620] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\efnezqs-f2_fzq2l6d0.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efnEzQs-f2_fzq2l6D0.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\efnezqs-f2_fzq2l6d0.lnk.anonymous")) returned 1 [0135.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk", lpFilePart=0x0) returned 0x43 [0135.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.628] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ehvhs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.628] GetFileType (hFile=0x154) returned 0x1 [0135.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.628] GetFileType (hFile=0x154) returned 0x1 [0135.628] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x193c [0135.628] ReadFile (in: hFile=0x154, lpBuffer=0x1b22ea4, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b22ea4*, lpNumberOfBytesRead=0x2ae404*=0x193c, lpOverlapped=0x0) returned 1 [0135.629] CloseHandle (hObject=0x154) returned 1 [0135.642] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk", lpFilePart=0x0) returned 0x43 [0135.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.642] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ehvhs.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.644] GetFileType (hFile=0x154) returned 0x1 [0135.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.644] GetFileType (hFile=0x154) returned 0x1 [0135.644] WriteFile (in: hFile=0x154, lpBuffer=0x1b77acc*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b77acc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1940, lpOverlapped=0x0) returned 1 [0135.645] CloseHandle (hObject=0x154) returned 1 [0135.645] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk", lpFilePart=0x0) returned 0x43 [0135.645] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0135.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.645] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ehvhs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6a9970, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6a9970, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefc95270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0135.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.645] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ehvhs.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ehvHS.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ehvhs.lnk.anonymous")) returned 1 [0135.646] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk", lpFilePart=0x0) returned 0x47 [0135.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.646] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\f8xvcf21p.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.646] GetFileType (hFile=0x154) returned 0x1 [0135.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.646] GetFileType (hFile=0x154) returned 0x1 [0135.646] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x90c [0135.646] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7a158*, lpNumberOfBytesRead=0x2ae404*=0x90c, lpOverlapped=0x0) returned 1 [0135.647] CloseHandle (hObject=0x154) returned 1 [0135.685] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk", lpFilePart=0x0) returned 0x47 [0135.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.685] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\f8xvcf21p.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.687] GetFileType (hFile=0x154) returned 0x1 [0135.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.687] GetFileType (hFile=0x154) returned 0x1 [0135.687] WriteFile (in: hFile=0x154, lpBuffer=0x19cad58*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19cad58*, lpNumberOfBytesWritten=0x2ae3cc*=0x910, lpOverlapped=0x0) returned 1 [0135.688] CloseHandle (hObject=0x154) returned 1 [0135.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk", lpFilePart=0x0) returned 0x47 [0135.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0135.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\f8xvcf21p.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2ba130, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadfe2eb0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefd07690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0135.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.688] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\f8xvcf21p.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F8xvCF21p.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\f8xvcf21p.lnk.anonymous")) returned 1 [0135.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk", lpFilePart=0x0) returned 0x47 [0135.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.690] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\fjq8hu0hf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.690] GetFileType (hFile=0x154) returned 0x1 [0135.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.690] GetFileType (hFile=0x154) returned 0x1 [0135.690] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x138a [0135.690] ReadFile (in: hFile=0x154, lpBuffer=0x19cc094, nNumberOfBytesToRead=0x138a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19cc094*, lpNumberOfBytesRead=0x2ae404*=0x138a, lpOverlapped=0x0) returned 1 [0135.691] CloseHandle (hObject=0x154) returned 1 [0135.703] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk", lpFilePart=0x0) returned 0x47 [0135.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.703] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\fjq8hu0hf.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.707] GetFileType (hFile=0x154) returned 0x1 [0135.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.707] GetFileType (hFile=0x154) returned 0x1 [0135.707] WriteFile (in: hFile=0x154, lpBuffer=0x1a1f1ac*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a1f1ac*, lpNumberOfBytesWritten=0x2ae3f8*=0x1390, lpOverlapped=0x0) returned 1 [0135.708] CloseHandle (hObject=0x154) returned 1 [0135.708] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk", lpFilePart=0x0) returned 0x47 [0135.708] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0135.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\fjq8hu0hf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xada61bd0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xada61bd0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefd2d7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1390)) returned 1 [0135.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.709] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\fjq8hu0hf.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJq8hu0HF.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\fjq8hu0hf.lnk.anonymous")) returned 1 [0135.709] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk", lpFilePart=0x0) returned 0x4b [0135.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.710] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g4pmr96dv.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.710] GetFileType (hFile=0x154) returned 0x1 [0135.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.710] GetFileType (hFile=0x154) returned 0x1 [0135.710] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x217 [0135.710] ReadFile (in: hFile=0x154, lpBuffer=0x1a20bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a20bcc*, lpNumberOfBytesRead=0x2ae404*=0x217, lpOverlapped=0x0) returned 1 [0135.711] CloseHandle (hObject=0x154) returned 1 [0135.723] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk", lpFilePart=0x0) returned 0x4b [0135.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.723] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g4pmr96dv.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.724] GetFileType (hFile=0x154) returned 0x1 [0135.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.724] GetFileType (hFile=0x154) returned 0x1 [0135.724] WriteFile (in: hFile=0x154, lpBuffer=0x1a6f59c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6f59c*, lpNumberOfBytesWritten=0x2ae3cc*=0x220, lpOverlapped=0x0) returned 1 [0135.725] CloseHandle (hObject=0x154) returned 1 [0135.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk", lpFilePart=0x0) returned 0x4b [0135.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0135.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g4pmr96dv.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad898b50, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad898b50, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefd53950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0135.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.726] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g4pmr96dv.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g4PmR96DV.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g4pmr96dv.flv.lnk.anonymous")) returned 1 [0135.727] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk", lpFilePart=0x0) returned 0x55 [0135.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.727] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g9pgaul1dr zn_vdegy.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.727] GetFileType (hFile=0x154) returned 0x1 [0135.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.727] GetFileType (hFile=0x154) returned 0x1 [0135.727] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe1e [0135.728] ReadFile (in: hFile=0x154, lpBuffer=0x1a71754, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a71754*, lpNumberOfBytesRead=0x2ae404*=0xe1e, lpOverlapped=0x0) returned 1 [0135.729] CloseHandle (hObject=0x154) returned 1 [0135.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk", lpFilePart=0x0) returned 0x55 [0135.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.741] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g9pgaul1dr zn_vdegy.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.743] GetFileType (hFile=0x154) returned 0x1 [0135.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.743] GetFileType (hFile=0x154) returned 0x1 [0135.743] WriteFile (in: hFile=0x154, lpBuffer=0x1ac3d44*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ac3d44*, lpNumberOfBytesWritten=0x2ae3cc*=0xe20, lpOverlapped=0x0) returned 1 [0135.744] CloseHandle (hObject=0x154) returned 1 [0135.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk", lpFilePart=0x0) returned 0x55 [0135.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk.anonymous", lpFilePart=0x0) returned 0x5f [0135.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g9pgaul1dr zn_vdegy.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb202b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadb202b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefd9fc10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0135.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.745] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g9pgaul1dr zn_vdegy.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g9pgAuL1DR zn_VDeGy.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g9pgaul1dr zn_vdegy.flv.lnk.anonymous")) returned 1 [0135.746] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk", lpFilePart=0x0) returned 0x4d [0135.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.746] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gciotjfm_gh82n7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.746] GetFileType (hFile=0x154) returned 0x1 [0135.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.746] GetFileType (hFile=0x154) returned 0x1 [0135.746] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9db [0135.746] ReadFile (in: hFile=0x154, lpBuffer=0x1ac5ad4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac5ad4*, lpNumberOfBytesRead=0x2ae404*=0x9db, lpOverlapped=0x0) returned 1 [0135.747] CloseHandle (hObject=0x154) returned 1 [0135.759] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk", lpFilePart=0x0) returned 0x4d [0135.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.759] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gciotjfm_gh82n7.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.761] GetFileType (hFile=0x154) returned 0x1 [0135.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.761] GetFileType (hFile=0x154) returned 0x1 [0135.761] WriteFile (in: hFile=0x154, lpBuffer=0x1b16b68*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b16b68*, lpNumberOfBytesWritten=0x2ae3cc*=0x9e0, lpOverlapped=0x0) returned 1 [0135.762] CloseHandle (hObject=0x154) returned 1 [0135.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk", lpFilePart=0x0) returned 0x4d [0135.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk.anonymous", lpFilePart=0x0) returned 0x57 [0135.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gciotjfm_gh82n7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa37c070, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaa37c070, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefdc5d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1 [0135.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.762] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gciotjfm_gh82n7.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GCIOtJfm_GH82N7.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gciotjfm_gh82n7.lnk.anonymous")) returned 1 [0135.763] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk", lpFilePart=0x0) returned 0x4a [0135.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.763] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gel4xiwhzryv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.763] GetFileType (hFile=0x154) returned 0x1 [0135.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.763] GetFileType (hFile=0x154) returned 0x1 [0135.763] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9be [0135.764] ReadFile (in: hFile=0x154, lpBuffer=0x1b188a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b188a4*, lpNumberOfBytesRead=0x2ae404*=0x9be, lpOverlapped=0x0) returned 1 [0135.764] CloseHandle (hObject=0x154) returned 1 [0135.776] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk", lpFilePart=0x0) returned 0x4a [0135.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.777] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gel4xiwhzryv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.778] GetFileType (hFile=0x154) returned 0x1 [0135.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.778] GetFileType (hFile=0x154) returned 0x1 [0135.778] WriteFile (in: hFile=0x154, lpBuffer=0x1b6988c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b6988c*, lpNumberOfBytesWritten=0x2ae3cc*=0x9c0, lpOverlapped=0x0) returned 1 [0135.779] CloseHandle (hObject=0x154) returned 1 [0135.780] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk", lpFilePart=0x0) returned 0x4a [0135.780] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0135.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gel4xiwhzryv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xada61bd0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xada61bd0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefdebed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9c0)) returned 1 [0135.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.780] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gel4xiwhzryv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GEl4XIwHzryv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gel4xiwhzryv.lnk.anonymous")) returned 1 [0135.781] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk", lpFilePart=0x0) returned 0x4e [0135.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.781] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gkbawditzqsqc6mt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.781] GetFileType (hFile=0x154) returned 0x1 [0135.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.781] GetFileType (hFile=0x154) returned 0x1 [0135.781] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13d3 [0135.781] ReadFile (in: hFile=0x154, lpBuffer=0x1b6ac00, nNumberOfBytesToRead=0x13d3, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6ac00*, lpNumberOfBytesRead=0x2ae404*=0x13d3, lpOverlapped=0x0) returned 1 [0135.782] CloseHandle (hObject=0x154) returned 1 [0135.819] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk", lpFilePart=0x0) returned 0x4e [0135.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.819] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gkbawditzqsqc6mt.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.821] GetFileType (hFile=0x154) returned 0x1 [0135.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.821] GetFileType (hFile=0x154) returned 0x1 [0135.821] WriteFile (in: hFile=0x154, lpBuffer=0x19be810*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19be810*, lpNumberOfBytesWritten=0x2ae3f8*=0x13e0, lpOverlapped=0x0) returned 1 [0135.822] CloseHandle (hObject=0x154) returned 1 [0135.822] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk", lpFilePart=0x0) returned 0x4e [0135.822] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0135.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gkbawditzqsqc6mt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabafd9b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xabafd9b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefe5e2f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13e0)) returned 1 [0135.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.822] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gkbawditzqsqc6mt.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gkbAwdItzqSQC6mT.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gkbawditzqsqc6mt.lnk.anonymous")) returned 1 [0135.823] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk", lpFilePart=0x0) returned 0x44 [0135.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.823] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gta95-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.823] GetFileType (hFile=0x154) returned 0x1 [0135.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.823] GetFileType (hFile=0x154) returned 0x1 [0135.823] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1956 [0135.824] ReadFile (in: hFile=0x154, lpBuffer=0x19c0094, nNumberOfBytesToRead=0x1956, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c0094*, lpNumberOfBytesRead=0x2ae404*=0x1956, lpOverlapped=0x0) returned 1 [0135.824] CloseHandle (hObject=0x154) returned 1 [0135.837] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk", lpFilePart=0x0) returned 0x44 [0135.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.837] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gta95-.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.838] GetFileType (hFile=0x154) returned 0x1 [0135.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.838] GetFileType (hFile=0x154) returned 0x1 [0135.838] WriteFile (in: hFile=0x154, lpBuffer=0x1a14ebc*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a14ebc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1960, lpOverlapped=0x0) returned 1 [0135.839] CloseHandle (hObject=0x154) returned 1 [0135.840] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk", lpFilePart=0x0) returned 0x44 [0135.840] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk.anonymous", lpFilePart=0x0) returned 0x4e [0135.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gta95-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad33d9d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad33d9d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefe84450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1960)) returned 1 [0135.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.840] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gta95-.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gta95-.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\gta95-.lnk.anonymous")) returned 1 [0135.860] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk", lpFilePart=0x0) returned 0x49 [0135.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.860] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g_qvdhvzgod.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.860] GetFileType (hFile=0x154) returned 0x1 [0135.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.860] GetFileType (hFile=0x154) returned 0x1 [0135.860] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1391 [0135.860] ReadFile (in: hFile=0x154, lpBuffer=0x1a16c6c, nNumberOfBytesToRead=0x1391, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a16c6c*, lpNumberOfBytesRead=0x2ae404*=0x1391, lpOverlapped=0x0) returned 1 [0135.861] CloseHandle (hObject=0x154) returned 1 [0135.873] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk", lpFilePart=0x0) returned 0x49 [0135.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.874] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g_qvdhvzgod.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.875] GetFileType (hFile=0x154) returned 0x1 [0135.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.875] GetFileType (hFile=0x154) returned 0x1 [0135.875] WriteFile (in: hFile=0x154, lpBuffer=0x1a69c78*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a69c78*, lpNumberOfBytesWritten=0x2ae3f8*=0x13a0, lpOverlapped=0x0) returned 1 [0135.876] CloseHandle (hObject=0x154) returned 1 [0135.876] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk", lpFilePart=0x0) returned 0x49 [0135.876] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0135.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g_qvdhvzgod.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad46e4d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad46e4d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xefed0710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13a0)) returned 1 [0135.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.877] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g_qvdhvzgod.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g_QvdhVzGOD.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\g_qvdhvzgod.lnk.anonymous")) returned 1 [0135.877] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk", lpFilePart=0x0) returned 0x47 [0135.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.878] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h5wapsuju.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.878] GetFileType (hFile=0x154) returned 0x1 [0135.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.878] GetFileType (hFile=0x154) returned 0x1 [0135.878] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1294 [0135.878] ReadFile (in: hFile=0x154, lpBuffer=0x1a6b488, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6b488*, lpNumberOfBytesRead=0x2ae404*=0x1294, lpOverlapped=0x0) returned 1 [0135.879] CloseHandle (hObject=0x154) returned 1 [0135.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk", lpFilePart=0x0) returned 0x47 [0135.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.905] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h5wapsuju.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.907] GetFileType (hFile=0x154) returned 0x1 [0135.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.907] GetFileType (hFile=0x154) returned 0x1 [0135.907] WriteFile (in: hFile=0x154, lpBuffer=0x1abdf90*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1abdf90*, lpNumberOfBytesWritten=0x2ae3f8*=0x12a0, lpOverlapped=0x0) returned 1 [0135.908] CloseHandle (hObject=0x154) returned 1 [0135.908] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk", lpFilePart=0x0) returned 0x47 [0135.908] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0135.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h5wapsuju.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7700550, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6113f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xeff1c9d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12a0)) returned 1 [0135.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.908] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h5wapsuju.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h5WapsuJu.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h5wapsuju.lnk.anonymous")) returned 1 [0135.910] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk", lpFilePart=0x0) returned 0x43 [0135.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.910] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h7gvz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.910] GetFileType (hFile=0x154) returned 0x1 [0135.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.910] GetFileType (hFile=0x154) returned 0x1 [0135.910] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xdec [0135.910] ReadFile (in: hFile=0x154, lpBuffer=0x1ac0474, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac0474*, lpNumberOfBytesRead=0x2ae404*=0xdec, lpOverlapped=0x0) returned 1 [0135.911] CloseHandle (hObject=0x154) returned 1 [0135.925] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk", lpFilePart=0x0) returned 0x43 [0135.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.926] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h7gvz.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.927] GetFileType (hFile=0x154) returned 0x1 [0135.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.927] GetFileType (hFile=0x154) returned 0x1 [0135.927] WriteFile (in: hFile=0x154, lpBuffer=0x1b1292c*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b1292c*, lpNumberOfBytesWritten=0x2ae3cc*=0xdf0, lpOverlapped=0x0) returned 1 [0135.928] CloseHandle (hObject=0x154) returned 1 [0135.928] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk", lpFilePart=0x0) returned 0x43 [0135.928] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0135.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h7gvz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa76da3f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadc76f10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xeff42b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdf0)) returned 1 [0135.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.929] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h7gvz.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h7gvZ.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\h7gvz.lnk.anonymous")) returned 1 [0135.930] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk", lpFilePart=0x0) returned 0x49 [0135.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.930] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdv_pkio-sk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.930] GetFileType (hFile=0x154) returned 0x1 [0135.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.930] GetFileType (hFile=0x154) returned 0x1 [0135.930] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd8d [0135.930] ReadFile (in: hFile=0x154, lpBuffer=0x1b149f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b149f4*, lpNumberOfBytesRead=0x2ae404*=0xd8d, lpOverlapped=0x0) returned 1 [0135.931] CloseHandle (hObject=0x154) returned 1 [0135.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk", lpFilePart=0x0) returned 0x49 [0135.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.943] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdv_pkio-sk.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.945] GetFileType (hFile=0x154) returned 0x1 [0135.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.945] GetFileType (hFile=0x154) returned 0x1 [0135.945] WriteFile (in: hFile=0x154, lpBuffer=0x1b66ce4*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b66ce4*, lpNumberOfBytesWritten=0x2ae3cc*=0xd90, lpOverlapped=0x0) returned 1 [0135.946] CloseHandle (hObject=0x154) returned 1 [0135.946] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk", lpFilePart=0x0) returned 0x49 [0135.946] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0135.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdv_pkio-sk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75f5bb0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaf2a1bf0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xeff8edf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd90)) returned 1 [0135.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.947] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdv_pkio-sk.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hdv_PKiO-SK.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdv_pkio-sk.lnk.anonymous")) returned 1 [0135.948] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk", lpFilePart=0x0) returned 0x43 [0135.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.948] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdwj1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.948] GetFileType (hFile=0x154) returned 0x1 [0135.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.948] GetFileType (hFile=0x154) returned 0x1 [0135.948] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x193a [0135.948] ReadFile (in: hFile=0x154, lpBuffer=0x1b6801c, nNumberOfBytesToRead=0x193a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b6801c*, lpNumberOfBytesRead=0x2ae404*=0x193a, lpOverlapped=0x0) returned 1 [0135.949] CloseHandle (hObject=0x154) returned 1 [0135.988] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk", lpFilePart=0x0) returned 0x43 [0135.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0135.988] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdwj1.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.990] GetFileType (hFile=0x154) returned 0x1 [0135.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0135.990] GetFileType (hFile=0x154) returned 0x1 [0135.990] WriteFile (in: hFile=0x154, lpBuffer=0x19bd1a8*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19bd1a8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1940, lpOverlapped=0x0) returned 1 [0135.992] CloseHandle (hObject=0x154) returned 1 [0135.992] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk", lpFilePart=0x0) returned 0x43 [0135.992] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0135.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0135.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdwj1.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9cceb0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xab9cceb0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0001210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0135.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0135.992] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdwj1.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hDWJ1.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hdwj1.lnk.anonymous")) returned 1 [0135.993] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk", lpFilePart=0x0) returned 0x4e [0135.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0135.993] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hfqjxrvfc5ynblwu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0135.994] GetFileType (hFile=0x154) returned 0x1 [0135.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0135.994] GetFileType (hFile=0x154) returned 0x1 [0135.994] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x132f [0135.994] ReadFile (in: hFile=0x154, lpBuffer=0x19bef3c, nNumberOfBytesToRead=0x132f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19bef3c*, lpNumberOfBytesRead=0x2ae404*=0x132f, lpOverlapped=0x0) returned 1 [0135.995] CloseHandle (hObject=0x154) returned 1 [0136.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk", lpFilePart=0x0) returned 0x4e [0136.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.007] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hfqjxrvfc5ynblwu.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.009] GetFileType (hFile=0x154) returned 0x1 [0136.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.009] GetFileType (hFile=0x154) returned 0x1 [0136.009] WriteFile (in: hFile=0x154, lpBuffer=0x1a11e74*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a11e74*, lpNumberOfBytesWritten=0x2ae3f8*=0x1330, lpOverlapped=0x0) returned 1 [0136.010] CloseHandle (hObject=0x154) returned 1 [0136.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk", lpFilePart=0x0) returned 0x4e [0136.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0136.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hfqjxrvfc5ynblwu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77266b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xae02f170, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0027370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1330)) returned 1 [0136.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.010] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hfqjxrvfc5ynblwu.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HFQJxrvfc5YnbLWu.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hfqjxrvfc5ynblwu.lnk.anonymous")) returned 1 [0136.011] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk", lpFilePart=0x0) returned 0x4f [0136.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.011] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hmfj4of_qnjac.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.011] GetFileType (hFile=0x154) returned 0x1 [0136.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.012] GetFileType (hFile=0x154) returned 0x1 [0136.012] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3be [0136.012] ReadFile (in: hFile=0x154, lpBuffer=0x1a13a3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a13a3c*, lpNumberOfBytesRead=0x2ae404*=0x3be, lpOverlapped=0x0) returned 1 [0136.013] CloseHandle (hObject=0x154) returned 1 [0136.026] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk", lpFilePart=0x0) returned 0x4f [0136.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.026] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hmfj4of_qnjac.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.028] GetFileType (hFile=0x154) returned 0x1 [0136.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.028] GetFileType (hFile=0x154) returned 0x1 [0136.028] WriteFile (in: hFile=0x154, lpBuffer=0x1a62c34*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a62c34*, lpNumberOfBytesWritten=0x2ae3cc*=0x3c0, lpOverlapped=0x0) returned 1 [0136.029] CloseHandle (hObject=0x154) returned 1 [0136.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk", lpFilePart=0x0) returned 0x4f [0136.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0136.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hmfj4of_qnjac.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87f6210, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa87f6210, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf004d4d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0136.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.029] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hmfj4of_qnjac.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HMfj4OF_QnJAC.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hmfj4of_qnjac.flv.lnk.anonymous")) returned 1 [0136.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk", lpFilePart=0x0) returned 0x4b [0136.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.030] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hob_iouodgiqc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.031] GetFileType (hFile=0x154) returned 0x1 [0136.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.031] GetFileType (hFile=0x154) returned 0x1 [0136.031] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x22b [0136.031] ReadFile (in: hFile=0x154, lpBuffer=0x1a641e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a641e8*, lpNumberOfBytesRead=0x2ae404*=0x22b, lpOverlapped=0x0) returned 1 [0136.032] CloseHandle (hObject=0x154) returned 1 [0136.044] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk", lpFilePart=0x0) returned 0x4b [0136.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.044] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hob_iouodgiqc.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.045] GetFileType (hFile=0x154) returned 0x1 [0136.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.046] GetFileType (hFile=0x154) returned 0x1 [0136.046] WriteFile (in: hFile=0x154, lpBuffer=0x1ab2c04*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ab2c04*, lpNumberOfBytesWritten=0x2ae3cc*=0x230, lpOverlapped=0x0) returned 1 [0136.047] CloseHandle (hObject=0x154) returned 1 [0136.047] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk", lpFilePart=0x0) returned 0x4b [0136.047] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0136.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.047] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hob_iouodgiqc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace7add0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xace7add0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0073630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0136.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.047] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hob_iouodgiqc.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hOB_IOUODgIqc.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hob_iouodgiqc.lnk.anonymous")) returned 1 [0136.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk", lpFilePart=0x0) returned 0x43 [0136.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.048] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hqa1w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.048] GetFileType (hFile=0x154) returned 0x1 [0136.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.049] GetFileType (hFile=0x154) returned 0x1 [0136.049] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1b5 [0136.049] ReadFile (in: hFile=0x154, lpBuffer=0x1ab410c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab410c*, lpNumberOfBytesRead=0x2ae404*=0x1b5, lpOverlapped=0x0) returned 1 [0136.050] CloseHandle (hObject=0x154) returned 1 [0136.066] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk", lpFilePart=0x0) returned 0x43 [0136.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.066] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hqa1w.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.067] GetFileType (hFile=0x154) returned 0x1 [0136.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.067] GetFileType (hFile=0x154) returned 0x1 [0136.067] WriteFile (in: hFile=0x154, lpBuffer=0x1b028dc*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b028dc*, lpNumberOfBytesWritten=0x2ae3cc*=0x1c0, lpOverlapped=0x0) returned 1 [0136.069] CloseHandle (hObject=0x154) returned 1 [0136.069] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk", lpFilePart=0x0) returned 0x43 [0136.069] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0136.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hqa1w.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa717f270, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xae009010, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0099790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c0)) returned 1 [0136.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.069] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hqa1w.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQa1w.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\hqa1w.lnk.anonymous")) returned 1 [0136.070] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk", lpFilePart=0x0) returned 0x45 [0136.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.070] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\iajbqm9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.070] GetFileType (hFile=0x154) returned 0x1 [0136.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.070] GetFileType (hFile=0x154) returned 0x1 [0136.070] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe46 [0136.070] ReadFile (in: hFile=0x154, lpBuffer=0x1b04a4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b04a4c*, lpNumberOfBytesRead=0x2ae404*=0xe46, lpOverlapped=0x0) returned 1 [0136.071] CloseHandle (hObject=0x154) returned 1 [0136.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk", lpFilePart=0x0) returned 0x45 [0136.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.085] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\iajbqm9.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.086] GetFileType (hFile=0x154) returned 0x1 [0136.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.086] GetFileType (hFile=0x154) returned 0x1 [0136.086] WriteFile (in: hFile=0x154, lpBuffer=0x1b570f4*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b570f4*, lpNumberOfBytesWritten=0x2ae3cc*=0xe50, lpOverlapped=0x0) returned 1 [0136.087] CloseHandle (hObject=0x154) returned 1 [0136.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk", lpFilePart=0x0) returned 0x45 [0136.087] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0136.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\iajbqm9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96d6b90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa96d6b90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf00e5a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe50)) returned 1 [0136.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.088] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\iajbqm9.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iaJbQm9.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\iajbqm9.lnk.anonymous")) returned 1 [0136.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk", lpFilePart=0x0) returned 0x4f [0136.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.089] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\igdszg5nh3mfzlp3t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.089] GetFileType (hFile=0x154) returned 0x1 [0136.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.089] GetFileType (hFile=0x154) returned 0x1 [0136.089] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23f [0136.089] ReadFile (in: hFile=0x154, lpBuffer=0x1b58690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b58690*, lpNumberOfBytesRead=0x2ae404*=0x23f, lpOverlapped=0x0) returned 1 [0136.090] CloseHandle (hObject=0x154) returned 1 [0136.129] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk", lpFilePart=0x0) returned 0x4f [0136.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.129] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\igdszg5nh3mfzlp3t.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.131] GetFileType (hFile=0x154) returned 0x1 [0136.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.131] GetFileType (hFile=0x154) returned 0x1 [0136.131] WriteFile (in: hFile=0x154, lpBuffer=0x19a5a38*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a5a38*, lpNumberOfBytesWritten=0x2ae3cc*=0x240, lpOverlapped=0x0) returned 1 [0136.132] CloseHandle (hObject=0x154) returned 1 [0136.132] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk", lpFilePart=0x0) returned 0x4f [0136.132] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0136.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\igdszg5nh3mfzlp3t.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6113f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6113f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0157e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0136.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.132] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\igdszg5nh3mfzlp3t.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iGDsZG5NH3MfzLp3t.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\igdszg5nh3mfzlp3t.lnk.anonymous")) returned 1 [0136.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk", lpFilePart=0x0) returned 0x44 [0136.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.148] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jclm-1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.148] GetFileType (hFile=0x154) returned 0x1 [0136.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.149] GetFileType (hFile=0x154) returned 0x1 [0136.149] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1907 [0136.149] ReadFile (in: hFile=0x154, lpBuffer=0x19a6d9c, nNumberOfBytesToRead=0x1907, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a6d9c*, lpNumberOfBytesRead=0x2ae404*=0x1907, lpOverlapped=0x0) returned 1 [0136.150] CloseHandle (hObject=0x154) returned 1 [0136.163] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk", lpFilePart=0x0) returned 0x44 [0136.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.163] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jclm-1.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.164] GetFileType (hFile=0x154) returned 0x1 [0136.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.165] GetFileType (hFile=0x154) returned 0x1 [0136.165] WriteFile (in: hFile=0x154, lpBuffer=0x19fba34*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19fba34*, lpNumberOfBytesWritten=0x2ae3f8*=0x1910, lpOverlapped=0x0) returned 1 [0136.166] CloseHandle (hObject=0x154) returned 1 [0136.166] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk", lpFilePart=0x0) returned 0x44 [0136.166] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk.anonymous", lpFilePart=0x0) returned 0x4e [0136.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jclm-1.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0dc3d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad0dc3d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf01a4130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1910)) returned 1 [0136.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.166] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jclm-1.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jCLm-1.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jclm-1.lnk.anonymous")) returned 1 [0136.167] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk", lpFilePart=0x0) returned 0x47 [0136.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.167] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jgczxckvh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.168] GetFileType (hFile=0x154) returned 0x1 [0136.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.168] GetFileType (hFile=0x154) returned 0x1 [0136.168] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x992 [0136.168] ReadFile (in: hFile=0x154, lpBuffer=0x19fe12c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19fe12c*, lpNumberOfBytesRead=0x2ae404*=0x992, lpOverlapped=0x0) returned 1 [0136.169] CloseHandle (hObject=0x154) returned 1 [0136.185] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk", lpFilePart=0x0) returned 0x47 [0136.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.186] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jgczxckvh.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.187] GetFileType (hFile=0x154) returned 0x1 [0136.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.187] GetFileType (hFile=0x154) returned 0x1 [0136.188] WriteFile (in: hFile=0x154, lpBuffer=0x1a4f070*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a4f070*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0136.189] CloseHandle (hObject=0x154) returned 1 [0136.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk", lpFilePart=0x0) returned 0x47 [0136.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0136.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jgczxckvh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad5eb290, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad5eb290, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf01ca290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0136.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.190] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jgczxckvh.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jGCzXCkVh.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\jgczxckvh.lnk.anonymous")) returned 1 [0136.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk", lpFilePart=0x0) returned 0x4d [0136.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.191] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\k4jfjzv5sv15iec.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.191] GetFileType (hFile=0x154) returned 0x1 [0136.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.191] GetFileType (hFile=0x154) returned 0x1 [0136.191] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe21 [0136.191] ReadFile (in: hFile=0x154, lpBuffer=0x1a511f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a511f4*, lpNumberOfBytesRead=0x2ae404*=0xe21, lpOverlapped=0x0) returned 1 [0136.192] CloseHandle (hObject=0x154) returned 1 [0136.208] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk", lpFilePart=0x0) returned 0x4d [0136.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.209] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\k4jfjzv5sv15iec.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.211] GetFileType (hFile=0x154) returned 0x1 [0136.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.211] GetFileType (hFile=0x154) returned 0x1 [0136.211] WriteFile (in: hFile=0x154, lpBuffer=0x1aa3820*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aa3820*, lpNumberOfBytesWritten=0x2ae3cc*=0xe30, lpOverlapped=0x0) returned 1 [0136.212] CloseHandle (hObject=0x154) returned 1 [0136.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk", lpFilePart=0x0) returned 0x4d [0136.212] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk.anonymous", lpFilePart=0x0) returned 0x57 [0136.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\k4jfjzv5sv15iec.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa787d310, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad3fc0b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0216550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0136.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.213] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\k4jfjzv5sv15iec.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k4JfjzV5sv15IeC.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\k4jfjzv5sv15iec.lnk.anonymous")) returned 1 [0136.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk", lpFilePart=0x0) returned 0x47 [0136.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.214] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kap0bgsed.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.214] GetFileType (hFile=0x154) returned 0x1 [0136.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.214] GetFileType (hFile=0x154) returned 0x1 [0136.215] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x992 [0136.215] ReadFile (in: hFile=0x154, lpBuffer=0x1aa5520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa5520*, lpNumberOfBytesRead=0x2ae404*=0x992, lpOverlapped=0x0) returned 1 [0136.216] CloseHandle (hObject=0x154) returned 1 [0136.231] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk", lpFilePart=0x0) returned 0x47 [0136.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.231] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kap0bgsed.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.232] GetFileType (hFile=0x154) returned 0x1 [0136.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.233] GetFileType (hFile=0x154) returned 0x1 [0136.233] WriteFile (in: hFile=0x154, lpBuffer=0x1af6464*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1af6464*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0136.234] CloseHandle (hObject=0x154) returned 1 [0136.234] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk", lpFilePart=0x0) returned 0x47 [0136.234] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0136.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.234] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kap0bgsed.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8005d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad8005d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf023c6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0136.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.234] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kap0bgsed.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KaP0bgSeD.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kap0bgsed.lnk.anonymous")) returned 1 [0136.235] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk", lpFilePart=0x0) returned 0x49 [0136.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.236] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kq6zhn9.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.236] GetFileType (hFile=0x154) returned 0x1 [0136.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.236] GetFileType (hFile=0x154) returned 0x1 [0136.236] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1931 [0136.236] ReadFile (in: hFile=0x154, lpBuffer=0x1af77a8, nNumberOfBytesToRead=0x1931, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af77a8*, lpNumberOfBytesRead=0x2ae404*=0x1931, lpOverlapped=0x0) returned 1 [0136.237] CloseHandle (hObject=0x154) returned 1 [0136.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk", lpFilePart=0x0) returned 0x49 [0136.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.251] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kq6zhn9.ots.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.253] GetFileType (hFile=0x154) returned 0x1 [0136.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.253] GetFileType (hFile=0x154) returned 0x1 [0136.253] WriteFile (in: hFile=0x154, lpBuffer=0x1b4c3d4*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b4c3d4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1940, lpOverlapped=0x0) returned 1 [0136.254] CloseHandle (hObject=0x154) returned 1 [0136.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk", lpFilePart=0x0) returned 0x49 [0136.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0136.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kq6zhn9.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae02f170, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xae02f170, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0262810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0136.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.254] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kq6zhn9.ots.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KQ6zhn9.ots.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kq6zhn9.ots.lnk.anonymous")) returned 1 [0136.255] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk", lpFilePart=0x0) returned 0x4b [0136.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.255] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kydfobwqeur2d.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.255] GetFileType (hFile=0x154) returned 0x1 [0136.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.256] GetFileType (hFile=0x154) returned 0x1 [0136.256] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13b6 [0136.256] ReadFile (in: hFile=0x154, lpBuffer=0x1b4e194, nNumberOfBytesToRead=0x13b6, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b4e194*, lpNumberOfBytesRead=0x2ae404*=0x13b6, lpOverlapped=0x0) returned 1 [0136.257] CloseHandle (hObject=0x154) returned 1 [0136.303] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk", lpFilePart=0x0) returned 0x4b [0136.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.303] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kydfobwqeur2d.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.305] GetFileType (hFile=0x154) returned 0x1 [0136.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.305] GetFileType (hFile=0x154) returned 0x1 [0136.305] WriteFile (in: hFile=0x154, lpBuffer=0x19a23a4*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19a23a4*, lpNumberOfBytesWritten=0x2ae3f8*=0x13c0, lpOverlapped=0x0) returned 1 [0136.306] CloseHandle (hObject=0x154) returned 1 [0136.306] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk", lpFilePart=0x0) returned 0x4b [0136.306] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0136.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kydfobwqeur2d.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace7add0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xace7add0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf02fad90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13c0)) returned 1 [0136.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.306] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kydfobwqeur2d.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kydFOBwqEUR2d.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\kydfobwqeur2d.lnk.anonymous")) returned 1 [0136.307] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk", lpFilePart=0x0) returned 0x51 [0136.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.307] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\l1uu3sa7v4os9vdznwi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.308] GetFileType (hFile=0x154) returned 0x1 [0136.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.308] GetFileType (hFile=0x154) returned 0x1 [0136.308] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x249 [0136.308] ReadFile (in: hFile=0x154, lpBuffer=0x19a3e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a3e68*, lpNumberOfBytesRead=0x2ae404*=0x249, lpOverlapped=0x0) returned 1 [0136.309] CloseHandle (hObject=0x154) returned 1 [0136.321] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk", lpFilePart=0x0) returned 0x51 [0136.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.321] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\l1uu3sa7v4os9vdznwi.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.322] GetFileType (hFile=0x154) returned 0x1 [0136.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.322] GetFileType (hFile=0x154) returned 0x1 [0136.323] WriteFile (in: hFile=0x154, lpBuffer=0x19f2a98*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19f2a98*, lpNumberOfBytesWritten=0x2ae3cc*=0x250, lpOverlapped=0x0) returned 1 [0136.324] CloseHandle (hObject=0x154) returned 1 [0136.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk", lpFilePart=0x0) returned 0x51 [0136.324] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0136.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\l1uu3sa7v4os9vdznwi.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac32c550, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac32c550, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0320ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0136.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.324] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\l1uu3sa7v4os9vdznwi.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l1UU3SA7V4os9vdZNWi.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\l1uu3sa7v4os9vdznwi.lnk.anonymous")) returned 1 [0136.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk", lpFilePart=0x0) returned 0x48 [0136.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.326] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lvgev6.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.326] GetFileType (hFile=0x154) returned 0x1 [0136.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.326] GetFileType (hFile=0x154) returned 0x1 [0136.326] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x206 [0136.326] ReadFile (in: hFile=0x154, lpBuffer=0x19f402c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f402c*, lpNumberOfBytesRead=0x2ae404*=0x206, lpOverlapped=0x0) returned 1 [0136.327] CloseHandle (hObject=0x154) returned 1 [0136.339] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk", lpFilePart=0x0) returned 0x48 [0136.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.339] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lvgev6.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.341] GetFileType (hFile=0x154) returned 0x1 [0136.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.341] GetFileType (hFile=0x154) returned 0x1 [0136.341] WriteFile (in: hFile=0x154, lpBuffer=0x1a429a4*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a429a4*, lpNumberOfBytesWritten=0x2ae3cc*=0x210, lpOverlapped=0x0) returned 1 [0136.342] CloseHandle (hObject=0x154) returned 1 [0136.342] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk", lpFilePart=0x0) returned 0x48 [0136.342] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0136.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lvgev6.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b88310, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa8b88310, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0347050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0136.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.342] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lvgev6.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LVGeV6.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lvgev6.mkv.lnk.anonymous")) returned 1 [0136.343] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk", lpFilePart=0x0) returned 0x42 [0136.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.343] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxft.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.343] GetFileType (hFile=0x154) returned 0x1 [0136.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.343] GetFileType (hFile=0x154) returned 0x1 [0136.343] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x957 [0136.344] ReadFile (in: hFile=0x154, lpBuffer=0x1a44640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a44640*, lpNumberOfBytesRead=0x2ae404*=0x957, lpOverlapped=0x0) returned 1 [0136.344] CloseHandle (hObject=0x154) returned 1 [0136.357] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk", lpFilePart=0x0) returned 0x42 [0136.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.357] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxft.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.358] GetFileType (hFile=0x154) returned 0x1 [0136.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.358] GetFileType (hFile=0x154) returned 0x1 [0136.359] WriteFile (in: hFile=0x154, lpBuffer=0x1a95430*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a95430*, lpNumberOfBytesWritten=0x2ae3cc*=0x960, lpOverlapped=0x0) returned 1 [0136.360] CloseHandle (hObject=0x154) returned 1 [0136.360] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk", lpFilePart=0x0) returned 0x42 [0136.360] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk.anonymous", lpFilePart=0x0) returned 0x4c [0136.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxft.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac91fc50, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac91fc50, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf036d1b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x960)) returned 1 [0136.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.360] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxft.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LXfT.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxft.lnk.anonymous")) returned 1 [0136.361] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk", lpFilePart=0x0) returned 0x46 [0136.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.361] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxkm e7r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.361] GetFileType (hFile=0x154) returned 0x1 [0136.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.361] GetFileType (hFile=0x154) returned 0x1 [0136.361] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xde7 [0136.362] ReadFile (in: hFile=0x154, lpBuffer=0x1a97548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a97548*, lpNumberOfBytesRead=0x2ae404*=0xde7, lpOverlapped=0x0) returned 1 [0136.362] CloseHandle (hObject=0x154) returned 1 [0136.374] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk", lpFilePart=0x0) returned 0x46 [0136.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.375] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxkm e7r.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.376] GetFileType (hFile=0x154) returned 0x1 [0136.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.376] GetFileType (hFile=0x154) returned 0x1 [0136.376] WriteFile (in: hFile=0x154, lpBuffer=0x1ae9a18*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae9a18*, lpNumberOfBytesWritten=0x2ae3cc*=0xdf0, lpOverlapped=0x0) returned 1 [0136.377] CloseHandle (hObject=0x154) returned 1 [0136.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk", lpFilePart=0x0) returned 0x46 [0136.377] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0136.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxkm e7r.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab2cee10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xab2cee10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0393310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdf0)) returned 1 [0136.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.378] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxkm e7r.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXKm e7R.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\lxkm e7r.lnk.anonymous")) returned 1 [0136.379] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk", lpFilePart=0x0) returned 0x4f [0136.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.379] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\m7xrcmqs3zqktqalh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.379] GetFileType (hFile=0x154) returned 0x1 [0136.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.379] GetFileType (hFile=0x154) returned 0x1 [0136.379] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe4a [0136.379] ReadFile (in: hFile=0x154, lpBuffer=0x1aebbcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aebbcc*, lpNumberOfBytesRead=0x2ae404*=0xe4a, lpOverlapped=0x0) returned 1 [0136.380] CloseHandle (hObject=0x154) returned 1 [0136.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk", lpFilePart=0x0) returned 0x4f [0136.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.392] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\m7xrcmqs3zqktqalh.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.394] GetFileType (hFile=0x154) returned 0x1 [0136.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.394] GetFileType (hFile=0x154) returned 0x1 [0136.394] WriteFile (in: hFile=0x154, lpBuffer=0x1b3e298*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3e298*, lpNumberOfBytesWritten=0x2ae3cc*=0xe50, lpOverlapped=0x0) returned 1 [0136.395] CloseHandle (hObject=0x154) returned 1 [0136.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk", lpFilePart=0x0) returned 0x4f [0136.395] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0136.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\m7xrcmqs3zqktqalh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2ba130, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac2ba130, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf03b9470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe50)) returned 1 [0136.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.395] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\m7xrcmqs3zqktqalh.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m7XRcmqs3ZQktQALH.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\m7xrcmqs3zqktqalh.lnk.anonymous")) returned 1 [0136.396] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk", lpFilePart=0x0) returned 0x4e [0136.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.396] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mdemmbv4kcu1pqin.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.396] GetFileType (hFile=0x154) returned 0x1 [0136.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.396] GetFileType (hFile=0x154) returned 0x1 [0136.396] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23a [0136.397] ReadFile (in: hFile=0x154, lpBuffer=0x1b3f86c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3f86c*, lpNumberOfBytesRead=0x2ae404*=0x23a, lpOverlapped=0x0) returned 1 [0136.398] CloseHandle (hObject=0x154) returned 1 [0136.409] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk", lpFilePart=0x0) returned 0x4e [0136.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.409] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mdemmbv4kcu1pqin.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.411] GetFileType (hFile=0x154) returned 0x1 [0136.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.411] GetFileType (hFile=0x154) returned 0x1 [0136.411] WriteFile (in: hFile=0x154, lpBuffer=0x1b8e2e8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b8e2e8*, lpNumberOfBytesWritten=0x2ae3cc*=0x240, lpOverlapped=0x0) returned 1 [0136.415] CloseHandle (hObject=0x154) returned 1 [0136.415] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk", lpFilePart=0x0) returned 0x4e [0136.415] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0136.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mdemmbv4kcu1pqin.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae009010, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xae009010, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0405730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0136.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.415] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mdemmbv4kcu1pqin.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mdemmBv4kCu1pQin.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mdemmbv4kcu1pqin.lnk.anonymous")) returned 1 [0136.437] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk", lpFilePart=0x0) returned 0x4c [0136.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.438] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\meafmi4_oyqdhv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.438] GetFileType (hFile=0x154) returned 0x1 [0136.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.438] GetFileType (hFile=0x154) returned 0x1 [0136.438] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13ba [0136.442] ReadFile (in: hFile=0x154, lpBuffer=0x198dc6c, nNumberOfBytesToRead=0x13ba, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x198dc6c*, lpNumberOfBytesRead=0x2ae404*=0x13ba, lpOverlapped=0x0) returned 1 [0136.443] CloseHandle (hObject=0x154) returned 1 [0136.482] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk", lpFilePart=0x0) returned 0x4c [0136.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.483] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\meafmi4_oyqdhv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.485] GetFileType (hFile=0x154) returned 0x1 [0136.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.485] GetFileType (hFile=0x154) returned 0x1 [0136.485] WriteFile (in: hFile=0x154, lpBuffer=0x19e0e74*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19e0e74*, lpNumberOfBytesWritten=0x2ae3f8*=0x13c0, lpOverlapped=0x0) returned 1 [0136.486] CloseHandle (hObject=0x154) returned 1 [0136.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk", lpFilePart=0x0) returned 0x4c [0136.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0136.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\meafmi4_oyqdhv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad768050, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad768050, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf049dcb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13c0)) returned 1 [0136.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.487] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\meafmi4_oyqdhv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeafMI4_oyQdhV.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\meafmi4_oyqdhv.lnk.anonymous")) returned 1 [0136.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk", lpFilePart=0x0) returned 0x50 [0136.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.488] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mqxcxt-rjnhvqk yov.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.488] GetFileType (hFile=0x154) returned 0x1 [0136.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.489] GetFileType (hFile=0x154) returned 0x1 [0136.489] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x263b [0136.489] ReadFile (in: hFile=0x154, lpBuffer=0x19e26f4, nNumberOfBytesToRead=0x263b, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e26f4*, lpNumberOfBytesRead=0x2ae404*=0x263b, lpOverlapped=0x0) returned 1 [0136.490] CloseHandle (hObject=0x154) returned 1 [0136.504] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk", lpFilePart=0x0) returned 0x50 [0136.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.505] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mqxcxt-rjnhvqk yov.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.506] GetFileType (hFile=0x154) returned 0x1 [0136.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.506] GetFileType (hFile=0x154) returned 0x1 [0136.506] WriteFile (in: hFile=0x154, lpBuffer=0x1a3b420*, nNumberOfBytesToWrite=0x2640, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a3b420*, lpNumberOfBytesWritten=0x2ae3f8*=0x2640, lpOverlapped=0x0) returned 1 [0136.507] CloseHandle (hObject=0x154) returned 1 [0136.510] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk", lpFilePart=0x0) returned 0x50 [0136.510] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0136.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.510] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mqxcxt-rjnhvqk yov.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3063f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac3063f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf04e9f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2640)) returned 1 [0136.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.510] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mqxcxt-rjnhvqk yov.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mqXcXt-RjNhVqk yoV.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mqxcxt-rjnhvqk yov.lnk.anonymous")) returned 1 [0136.511] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk", lpFilePart=0x0) returned 0x50 [0136.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.511] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mtgl88wkcvnnh2_o1h.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.511] GetFileType (hFile=0x154) returned 0x1 [0136.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.511] GetFileType (hFile=0x154) returned 0x1 [0136.511] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x955 [0136.511] ReadFile (in: hFile=0x154, lpBuffer=0x1a3e8ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3e8ac*, lpNumberOfBytesRead=0x2ae404*=0x955, lpOverlapped=0x0) returned 1 [0136.512] CloseHandle (hObject=0x154) returned 1 [0136.525] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk", lpFilePart=0x0) returned 0x50 [0136.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.525] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mtgl88wkcvnnh2_o1h.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.526] GetFileType (hFile=0x154) returned 0x1 [0136.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.526] GetFileType (hFile=0x154) returned 0x1 [0136.526] WriteFile (in: hFile=0x154, lpBuffer=0x1a8f6d4*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a8f6d4*, lpNumberOfBytesWritten=0x2ae3cc*=0x960, lpOverlapped=0x0) returned 1 [0136.528] CloseHandle (hObject=0x154) returned 1 [0136.528] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk", lpFilePart=0x0) returned 0x50 [0136.528] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0136.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mtgl88wkcvnnh2_o1h.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa84b03d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadb6c570, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf05100d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x960)) returned 1 [0136.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.528] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mtgl88wkcvnnh2_o1h.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MTGl88WkCvNNh2_o1h.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\mtgl88wkcvnnh2_o1h.lnk.anonymous")) returned 1 [0136.529] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFilePart=0x0) returned 0x46 [0136.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.529] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.529] GetFileType (hFile=0x154) returned 0x1 [0136.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.529] GetFileType (hFile=0x154) returned 0x1 [0136.529] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4e9 [0136.529] ReadFile (in: hFile=0x154, lpBuffer=0x1a90f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a90f44*, lpNumberOfBytesRead=0x2ae404*=0x4e9, lpOverlapped=0x0) returned 1 [0136.530] CloseHandle (hObject=0x154) returned 1 [0136.542] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFilePart=0x0) returned 0x46 [0136.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.542] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.543] GetFileType (hFile=0x154) returned 0x1 [0136.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.543] GetFileType (hFile=0x154) returned 0x1 [0136.543] WriteFile (in: hFile=0x154, lpBuffer=0x1ae0710*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ae0710*, lpNumberOfBytesWritten=0x2ae3cc*=0x4f0, lpOverlapped=0x0) returned 1 [0136.545] CloseHandle (hObject=0x154) returned 1 [0136.545] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFilePart=0x0) returned 0x46 [0136.545] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0136.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaac43190, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac945db0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0536230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0136.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.545] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.anonymous")) returned 1 [0136.546] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFilePart=0x0) returned 0x49 [0136.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.546] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.546] GetFileType (hFile=0x154) returned 0x1 [0136.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.546] GetFileType (hFile=0x154) returned 0x1 [0136.546] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x50a [0136.546] ReadFile (in: hFile=0x154, lpBuffer=0x1ae1f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ae1f6c*, lpNumberOfBytesRead=0x2ae404*=0x50a, lpOverlapped=0x0) returned 1 [0136.547] CloseHandle (hObject=0x154) returned 1 [0136.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFilePart=0x0) returned 0x49 [0136.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.561] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.563] GetFileType (hFile=0x154) returned 0x1 [0136.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.563] GetFileType (hFile=0x154) returned 0x1 [0136.563] WriteFile (in: hFile=0x154, lpBuffer=0x1b317e0*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b317e0*, lpNumberOfBytesWritten=0x2ae3cc*=0x510, lpOverlapped=0x0) returned 1 [0136.565] CloseHandle (hObject=0x154) returned 1 [0136.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFilePart=0x0) returned 0x49 [0136.565] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0136.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7798ad0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadc76f10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf055c390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0136.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.565] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.anonymous")) returned 1 [0136.567] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFilePart=0x0) returned 0x47 [0136.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.567] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.567] GetFileType (hFile=0x154) returned 0x1 [0136.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.567] GetFileType (hFile=0x154) returned 0x1 [0136.567] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4f4 [0136.567] ReadFile (in: hFile=0x154, lpBuffer=0x1b33028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b33028*, lpNumberOfBytesRead=0x2ae404*=0x4f4, lpOverlapped=0x0) returned 1 [0136.568] CloseHandle (hObject=0x154) returned 1 [0136.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFilePart=0x0) returned 0x47 [0136.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.582] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.584] GetFileType (hFile=0x154) returned 0x1 [0136.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.584] GetFileType (hFile=0x154) returned 0x1 [0136.584] WriteFile (in: hFile=0x154, lpBuffer=0x1b82848*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b82848*, lpNumberOfBytesWritten=0x2ae3cc*=0x500, lpOverlapped=0x0) returned 1 [0136.585] CloseHandle (hObject=0x154) returned 1 [0136.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFilePart=0x0) returned 0x47 [0136.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0136.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f8c830, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaf2a1bf0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf05a8650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0136.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.586] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.anonymous")) returned 1 [0136.587] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk", lpFilePart=0x0) returned 0x45 [0136.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.587] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nazj52r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.588] GetFileType (hFile=0x154) returned 0x1 [0136.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.588] GetFileType (hFile=0x154) returned 0x1 [0136.588] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xde1 [0136.588] ReadFile (in: hFile=0x154, lpBuffer=0x1b8496c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b8496c*, lpNumberOfBytesRead=0x2ae404*=0xde1, lpOverlapped=0x0) returned 1 [0136.589] CloseHandle (hObject=0x154) returned 1 [0136.631] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk", lpFilePart=0x0) returned 0x45 [0136.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.631] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nazj52r.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.632] GetFileType (hFile=0x154) returned 0x1 [0136.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.633] GetFileType (hFile=0x154) returned 0x1 [0136.633] WriteFile (in: hFile=0x154, lpBuffer=0x19d7e44*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19d7e44*, lpNumberOfBytesWritten=0x2ae3cc*=0xdf0, lpOverlapped=0x0) returned 1 [0136.634] CloseHandle (hObject=0x154) returned 1 [0136.634] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk", lpFilePart=0x0) returned 0x45 [0136.634] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0136.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.634] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nazj52r.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfe2eb0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadfe2eb0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf061aa70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdf0)) returned 1 [0136.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.634] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nazj52r.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nAzj52R.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nazj52r.lnk.anonymous")) returned 1 [0136.635] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk", lpFilePart=0x0) returned 0x46 [0136.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.635] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nfsvvu3w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.635] GetFileType (hFile=0x154) returned 0x1 [0136.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.635] GetFileType (hFile=0x154) returned 0x1 [0136.635] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x992 [0136.635] ReadFile (in: hFile=0x154, lpBuffer=0x19d9b14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19d9b14*, lpNumberOfBytesRead=0x2ae404*=0x992, lpOverlapped=0x0) returned 1 [0136.636] CloseHandle (hObject=0x154) returned 1 [0136.650] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk", lpFilePart=0x0) returned 0x46 [0136.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.651] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nfsvvu3w.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.652] GetFileType (hFile=0x154) returned 0x1 [0136.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.652] GetFileType (hFile=0x154) returned 0x1 [0136.652] WriteFile (in: hFile=0x154, lpBuffer=0x1a2abb4*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a2abb4*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0136.653] CloseHandle (hObject=0x154) returned 1 [0136.653] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk", lpFilePart=0x0) returned 0x46 [0136.653] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0136.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nfsvvu3w.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabad7850, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xabad7850, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0640bd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0136.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.654] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nfsvvu3w.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nFsVVU3w.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nfsvvu3w.lnk.anonymous")) returned 1 [0136.655] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk", lpFilePart=0x0) returned 0x46 [0136.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.655] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nkmglel7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.655] GetFileType (hFile=0x154) returned 0x1 [0136.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.655] GetFileType (hFile=0x154) returned 0x1 [0136.655] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3a5 [0136.655] ReadFile (in: hFile=0x154, lpBuffer=0x1a2c2a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a2c2a4*, lpNumberOfBytesRead=0x2ae404*=0x3a5, lpOverlapped=0x0) returned 1 [0136.656] CloseHandle (hObject=0x154) returned 1 [0136.668] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk", lpFilePart=0x0) returned 0x46 [0136.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.668] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nkmglel7.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.669] GetFileType (hFile=0x154) returned 0x1 [0136.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.669] GetFileType (hFile=0x154) returned 0x1 [0136.669] WriteFile (in: hFile=0x154, lpBuffer=0x1a7b434*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a7b434*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0136.676] CloseHandle (hObject=0x154) returned 1 [0136.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk", lpFilePart=0x0) returned 0x46 [0136.676] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0136.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.676] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nkmglel7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad741ef0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad741ef0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0666d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0136.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.676] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nkmglel7.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NKmGleL7.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nkmglel7.lnk.anonymous")) returned 1 [0136.677] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk", lpFilePart=0x0) returned 0x50 [0136.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.678] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nn77itemj4h9fpnuoi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.678] GetFileType (hFile=0x154) returned 0x1 [0136.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.678] GetFileType (hFile=0x154) returned 0x1 [0136.678] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9e0 [0136.678] ReadFile (in: hFile=0x154, lpBuffer=0x1a7d184, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a7d184*, lpNumberOfBytesRead=0x2ae404*=0x9e0, lpOverlapped=0x0) returned 1 [0136.679] CloseHandle (hObject=0x154) returned 1 [0136.692] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk", lpFilePart=0x0) returned 0x50 [0136.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.692] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nn77itemj4h9fpnuoi.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.693] GetFileType (hFile=0x154) returned 0x1 [0136.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.693] GetFileType (hFile=0x154) returned 0x1 [0136.694] WriteFile (in: hFile=0x154, lpBuffer=0x1ace280*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ace280*, lpNumberOfBytesWritten=0x2ae3cc*=0x9f0, lpOverlapped=0x0) returned 1 [0136.695] CloseHandle (hObject=0x154) returned 1 [0136.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk", lpFilePart=0x0) returned 0x50 [0136.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0136.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nn77itemj4h9fpnuoi.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad71bd90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad71bd90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf06b2ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9f0)) returned 1 [0136.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.695] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nn77itemj4h9fpnuoi.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Nn77itEMj4H9FpNUOI.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\nn77itemj4h9fpnuoi.lnk.anonymous")) returned 1 [0136.696] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk", lpFilePart=0x0) returned 0x45 [0136.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.696] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o2iixuv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.696] GetFileType (hFile=0x154) returned 0x1 [0136.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.696] GetFileType (hFile=0x154) returned 0x1 [0136.696] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1f7f [0136.696] ReadFile (in: hFile=0x154, lpBuffer=0x1acf5f0, nNumberOfBytesToRead=0x1f7f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1acf5f0*, lpNumberOfBytesRead=0x2ae404*=0x1f7f, lpOverlapped=0x0) returned 1 [0136.697] CloseHandle (hObject=0x154) returned 1 [0136.710] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk", lpFilePart=0x0) returned 0x45 [0136.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.710] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o2iixuv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.711] GetFileType (hFile=0x154) returned 0x1 [0136.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.711] GetFileType (hFile=0x154) returned 0x1 [0136.711] WriteFile (in: hFile=0x154, lpBuffer=0x1b2615c*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b2615c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1f80, lpOverlapped=0x0) returned 1 [0136.712] CloseHandle (hObject=0x154) returned 1 [0136.713] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk", lpFilePart=0x0) returned 0x45 [0136.713] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0136.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o2iixuv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83cbb90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa83cbb90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf06d9150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f80)) returned 1 [0136.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.713] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o2iixuv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2IiXUv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o2iixuv.lnk.anonymous")) returned 1 [0136.714] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk", lpFilePart=0x0) returned 0x45 [0136.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.714] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o8k_mnw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.714] GetFileType (hFile=0x154) returned 0x1 [0136.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.714] GetFileType (hFile=0x154) returned 0x1 [0136.714] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1370 [0136.714] ReadFile (in: hFile=0x154, lpBuffer=0x1b2851c, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b2851c*, lpNumberOfBytesRead=0x2ae404*=0x1370, lpOverlapped=0x0) returned 1 [0136.715] CloseHandle (hObject=0x154) returned 1 [0136.727] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk", lpFilePart=0x0) returned 0x45 [0136.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.727] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o8k_mnw.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.728] GetFileType (hFile=0x154) returned 0x1 [0136.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.728] GetFileType (hFile=0x154) returned 0x1 [0136.728] WriteFile (in: hFile=0x154, lpBuffer=0x1b7b484*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b7b484*, lpNumberOfBytesWritten=0x2ae3f8*=0x1380, lpOverlapped=0x0) returned 1 [0136.729] CloseHandle (hObject=0x154) returned 1 [0136.730] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk", lpFilePart=0x0) returned 0x45 [0136.730] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0136.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o8k_mnw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8f9af0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac8f9af0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf06ff2b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1380)) returned 1 [0136.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.730] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o8k_mnw.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o8k_mNw.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o8k_mnw.lnk.anonymous")) returned 1 [0136.731] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk", lpFilePart=0x0) returned 0x4b [0136.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.731] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\odvbunwtlsole.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.731] GetFileType (hFile=0x154) returned 0x1 [0136.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.731] GetFileType (hFile=0x154) returned 0x1 [0136.731] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3c3 [0136.731] ReadFile (in: hFile=0x154, lpBuffer=0x1b7d02c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7d02c*, lpNumberOfBytesRead=0x2ae404*=0x3c3, lpOverlapped=0x0) returned 1 [0136.732] CloseHandle (hObject=0x154) returned 1 [0136.773] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk", lpFilePart=0x0) returned 0x4b [0136.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.773] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\odvbunwtlsole.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.774] GetFileType (hFile=0x154) returned 0x1 [0136.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.774] GetFileType (hFile=0x154) returned 0x1 [0136.774] WriteFile (in: hFile=0x154, lpBuffer=0x19accc8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19accc8*, lpNumberOfBytesWritten=0x2ae3cc*=0x3d0, lpOverlapped=0x0) returned 1 [0136.776] CloseHandle (hObject=0x154) returned 1 [0136.776] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk", lpFilePart=0x0) returned 0x4b [0136.776] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0136.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\odvbunwtlsole.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaac43190, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaac43190, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf07716d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0136.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.776] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\odvbunwtlsole.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oDVBUnwtlSolE.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\odvbunwtlsole.lnk.anonymous")) returned 1 [0136.777] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk", lpFilePart=0x0) returned 0x43 [0136.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.777] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\orovh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.777] GetFileType (hFile=0x154) returned 0x1 [0136.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.777] GetFileType (hFile=0x154) returned 0x1 [0136.777] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x392 [0136.777] ReadFile (in: hFile=0x154, lpBuffer=0x19ae3ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ae3ac*, lpNumberOfBytesRead=0x2ae404*=0x392, lpOverlapped=0x0) returned 1 [0136.778] CloseHandle (hObject=0x154) returned 1 [0136.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk", lpFilePart=0x0) returned 0x43 [0136.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.790] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\orovh.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.792] GetFileType (hFile=0x154) returned 0x1 [0136.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.792] GetFileType (hFile=0x154) returned 0x1 [0136.792] WriteFile (in: hFile=0x154, lpBuffer=0x19fd63c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19fd63c*, lpNumberOfBytesWritten=0x2ae3cc*=0x3a0, lpOverlapped=0x0) returned 1 [0136.793] CloseHandle (hObject=0x154) returned 1 [0136.793] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk", lpFilePart=0x0) returned 0x43 [0136.793] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0136.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\orovh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca2a5f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaca2a5f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0797830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0136.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.793] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\orovh.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orovh.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\orovh.lnk.anonymous")) returned 1 [0136.794] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk", lpFilePart=0x0) returned 0x49 [0136.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.794] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ovbwsz8ahby.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.794] GetFileType (hFile=0x154) returned 0x1 [0136.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.795] GetFileType (hFile=0x154) returned 0x1 [0136.795] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9a8 [0136.795] ReadFile (in: hFile=0x154, lpBuffer=0x19ff31c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ff31c*, lpNumberOfBytesRead=0x2ae404*=0x9a8, lpOverlapped=0x0) returned 1 [0136.796] CloseHandle (hObject=0x154) returned 1 [0136.808] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk", lpFilePart=0x0) returned 0x49 [0136.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.808] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ovbwsz8ahby.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.809] GetFileType (hFile=0x154) returned 0x1 [0136.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.809] GetFileType (hFile=0x154) returned 0x1 [0136.810] WriteFile (in: hFile=0x154, lpBuffer=0x1a502b0*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a502b0*, lpNumberOfBytesWritten=0x2ae3cc*=0x9b0, lpOverlapped=0x0) returned 1 [0136.811] CloseHandle (hObject=0x154) returned 1 [0136.811] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk", lpFilePart=0x0) returned 0x49 [0136.811] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0136.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ovbwsz8ahby.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87f6210, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa87f6210, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf07bd990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0136.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.811] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ovbwsz8ahby.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OVbwSz8ahBy.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ovbwsz8ahby.lnk.anonymous")) returned 1 [0136.812] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk", lpFilePart=0x0) returned 0x4d [0136.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.812] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\owvdkggvqs6w_k_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.812] GetFileType (hFile=0x154) returned 0x1 [0136.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.812] GetFileType (hFile=0x154) returned 0x1 [0136.812] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3c8 [0136.812] ReadFile (in: hFile=0x154, lpBuffer=0x1a519e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a519e4*, lpNumberOfBytesRead=0x2ae404*=0x3c8, lpOverlapped=0x0) returned 1 [0136.813] CloseHandle (hObject=0x154) returned 1 [0136.825] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk", lpFilePart=0x0) returned 0x4d [0136.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.825] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\owvdkggvqs6w_k_.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.827] GetFileType (hFile=0x154) returned 0x1 [0136.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.827] GetFileType (hFile=0x154) returned 0x1 [0136.827] WriteFile (in: hFile=0x154, lpBuffer=0x1aa0c28*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1aa0c28*, lpNumberOfBytesWritten=0x2ae3cc*=0x3d0, lpOverlapped=0x0) returned 1 [0136.828] CloseHandle (hObject=0x154) returned 1 [0136.828] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk", lpFilePart=0x0) returned 0x4d [0136.828] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk.anonymous", lpFilePart=0x0) returned 0x57 [0136.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\owvdkggvqs6w_k_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6113f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6113f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf07e3af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0136.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.828] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\owvdkggvqs6w_k_.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\owvdkGgVQS6w_k_.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\owvdkggvqs6w_k_.lnk.anonymous")) returned 1 [0136.829] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk", lpFilePart=0x0) returned 0x52 [0136.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.829] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o_-enchtnlsdgjfi-4n8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.829] GetFileType (hFile=0x154) returned 0x1 [0136.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.829] GetFileType (hFile=0x154) returned 0x1 [0136.829] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xf32 [0136.830] ReadFile (in: hFile=0x154, lpBuffer=0x1aa2ef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa2ef8*, lpNumberOfBytesRead=0x2ae404*=0xf32, lpOverlapped=0x0) returned 1 [0136.830] CloseHandle (hObject=0x154) returned 1 [0136.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk", lpFilePart=0x0) returned 0x52 [0136.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.843] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o_-enchtnlsdgjfi-4n8.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.845] GetFileType (hFile=0x154) returned 0x1 [0136.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.845] GetFileType (hFile=0x154) returned 0x1 [0136.845] WriteFile (in: hFile=0x154, lpBuffer=0x1af5a8c*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1af5a8c*, lpNumberOfBytesWritten=0x2ae3cc*=0xf40, lpOverlapped=0x0) returned 1 [0136.846] CloseHandle (hObject=0x154) returned 1 [0136.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk", lpFilePart=0x0) returned 0x52 [0136.846] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk.anonymous", lpFilePart=0x0) returned 0x5c [0136.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o_-enchtnlsdgjfi-4n8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8274f30, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa8274f30, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0809c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0136.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.846] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o_-enchtnlsdgjfi-4n8.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_-EnChtnLSdGjfi-4N8.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\o_-enchtnlsdgjfi-4n8.lnk.anonymous")) returned 1 [0136.847] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk", lpFilePart=0x0) returned 0x4e [0136.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.847] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\p9w_3pur cus.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.847] GetFileType (hFile=0x154) returned 0x1 [0136.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.847] GetFileType (hFile=0x154) returned 0x1 [0136.847] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13ab [0136.848] ReadFile (in: hFile=0x154, lpBuffer=0x1af6e30, nNumberOfBytesToRead=0x13ab, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af6e30*, lpNumberOfBytesRead=0x2ae404*=0x13ab, lpOverlapped=0x0) returned 1 [0136.848] CloseHandle (hObject=0x154) returned 1 [0136.860] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk", lpFilePart=0x0) returned 0x4e [0136.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.861] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\p9w_3pur cus.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.862] GetFileType (hFile=0x154) returned 0x1 [0136.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.862] GetFileType (hFile=0x154) returned 0x1 [0136.862] WriteFile (in: hFile=0x154, lpBuffer=0x1b49e8c*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b49e8c*, lpNumberOfBytesWritten=0x2ae3f8*=0x13b0, lpOverlapped=0x0) returned 1 [0136.863] CloseHandle (hObject=0x154) returned 1 [0136.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk", lpFilePart=0x0) returned 0x4e [0136.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0136.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\p9w_3pur cus.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbf3670, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xacbf3670, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf082fdb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13b0)) returned 1 [0136.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.864] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\p9w_3pur cus.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p9W_3pur cUs.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\p9w_3pur cus.mkv.lnk.anonymous")) returned 1 [0136.865] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk", lpFilePart=0x0) returned 0x4a [0136.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.865] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pbmh4uzo.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.865] GetFileType (hFile=0x154) returned 0x1 [0136.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.865] GetFileType (hFile=0x154) returned 0x1 [0136.865] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x212 [0136.865] ReadFile (in: hFile=0x154, lpBuffer=0x1b4b918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b4b918*, lpNumberOfBytesRead=0x2ae404*=0x212, lpOverlapped=0x0) returned 1 [0136.866] CloseHandle (hObject=0x154) returned 1 [0136.916] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk", lpFilePart=0x0) returned 0x4a [0136.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.916] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pbmh4uzo.ots.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.917] GetFileType (hFile=0x154) returned 0x1 [0136.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.917] GetFileType (hFile=0x154) returned 0x1 [0136.917] WriteFile (in: hFile=0x154, lpBuffer=0x199a108*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x199a108*, lpNumberOfBytesWritten=0x2ae3cc*=0x220, lpOverlapped=0x0) returned 1 [0136.918] CloseHandle (hObject=0x154) returned 1 [0136.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk", lpFilePart=0x0) returned 0x4a [0136.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0136.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.919] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pbmh4uzo.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa875dc90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa875dc90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf08c8330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0136.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.919] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pbmh4uzo.ots.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbMh4Uzo.ots.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pbmh4uzo.ots.lnk.anonymous")) returned 1 [0136.920] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk", lpFilePart=0x0) returned 0x46 [0136.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.920] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pcctdqrd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.920] GetFileType (hFile=0x154) returned 0x1 [0136.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.920] GetFileType (hFile=0x154) returned 0x1 [0136.920] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x26ad [0136.920] ReadFile (in: hFile=0x154, lpBuffer=0x199b45c, nNumberOfBytesToRead=0x26ad, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x199b45c*, lpNumberOfBytesRead=0x2ae404*=0x26ad, lpOverlapped=0x0) returned 1 [0136.921] CloseHandle (hObject=0x154) returned 1 [0136.936] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk", lpFilePart=0x0) returned 0x46 [0136.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.936] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pcctdqrd.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.937] GetFileType (hFile=0x154) returned 0x1 [0136.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.938] GetFileType (hFile=0x154) returned 0x1 [0136.938] WriteFile (in: hFile=0x154, lpBuffer=0x19f4514*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19f4514*, lpNumberOfBytesWritten=0x2ae3f8*=0x26b0, lpOverlapped=0x0) returned 1 [0136.948] CloseHandle (hObject=0x154) returned 1 [0136.948] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk", lpFilePart=0x0) returned 0x46 [0136.949] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0136.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.949] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pcctdqrd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c81830, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7c81830, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf09145f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26b0)) returned 1 [0136.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.949] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pcctdqrd.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PCcTdqRD.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pcctdqrd.lnk.anonymous")) returned 1 [0136.951] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk", lpFilePart=0x0) returned 0x51 [0136.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.951] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pdyuveyvtjd4-5mdysn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.951] GetFileType (hFile=0x154) returned 0x1 [0136.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.951] GetFileType (hFile=0x154) returned 0x1 [0136.951] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1fe0 [0136.951] ReadFile (in: hFile=0x154, lpBuffer=0x19f7048, nNumberOfBytesToRead=0x1fe0, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f7048*, lpNumberOfBytesRead=0x2ae404*=0x1fe0, lpOverlapped=0x0) returned 1 [0136.952] CloseHandle (hObject=0x154) returned 1 [0136.974] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk", lpFilePart=0x0) returned 0x51 [0136.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.974] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pdyuveyvtjd4-5mdysn.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.975] GetFileType (hFile=0x154) returned 0x1 [0136.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.975] GetFileType (hFile=0x154) returned 0x1 [0136.975] WriteFile (in: hFile=0x154, lpBuffer=0x1a4dde0*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a4dde0*, lpNumberOfBytesWritten=0x2ae3f8*=0x1ff0, lpOverlapped=0x0) returned 1 [0136.977] CloseHandle (hObject=0x154) returned 1 [0136.977] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk", lpFilePart=0x0) returned 0x51 [0136.977] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0136.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pdyuveyvtjd4-5mdysn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96d6b90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa96d6b90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf09608b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1ff0)) returned 1 [0136.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.977] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pdyuveyvtjd4-5mdysn.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pdYUveyvtjd4-5mdysn.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pdyuveyvtjd4-5mdysn.lnk.anonymous")) returned 1 [0136.978] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk", lpFilePart=0x0) returned 0x44 [0136.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.978] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pp1wo2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.978] GetFileType (hFile=0x154) returned 0x1 [0136.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.978] GetFileType (hFile=0x154) returned 0x1 [0136.978] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x206 [0136.978] ReadFile (in: hFile=0x154, lpBuffer=0x1a5049c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a5049c*, lpNumberOfBytesRead=0x2ae404*=0x206, lpOverlapped=0x0) returned 1 [0136.979] CloseHandle (hObject=0x154) returned 1 [0136.991] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk", lpFilePart=0x0) returned 0x44 [0136.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0136.992] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pp1wo2.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.993] GetFileType (hFile=0x154) returned 0x1 [0136.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0136.993] GetFileType (hFile=0x154) returned 0x1 [0136.993] WriteFile (in: hFile=0x154, lpBuffer=0x1a9ee04*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a9ee04*, lpNumberOfBytesWritten=0x2ae3cc*=0x210, lpOverlapped=0x0) returned 1 [0136.994] CloseHandle (hObject=0x154) returned 1 [0136.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk", lpFilePart=0x0) returned 0x44 [0136.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk.anonymous", lpFilePart=0x0) returned 0x4e [0136.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0136.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pp1wo2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc7a770, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xabc7a770, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0986a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0136.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0136.995] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pp1wo2.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pp1Wo2.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pp1wo2.lnk.anonymous")) returned 1 [0136.996] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk", lpFilePart=0x0) returned 0x49 [0136.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0136.996] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pqjwgvxhx-w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0136.996] GetFileType (hFile=0x154) returned 0x1 [0136.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0136.996] GetFileType (hFile=0x154) returned 0x1 [0136.996] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1318 [0136.996] ReadFile (in: hFile=0x154, lpBuffer=0x1aa013c, nNumberOfBytesToRead=0x1318, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aa013c*, lpNumberOfBytesRead=0x2ae404*=0x1318, lpOverlapped=0x0) returned 1 [0136.997] CloseHandle (hObject=0x154) returned 1 [0137.009] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk", lpFilePart=0x0) returned 0x49 [0137.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.009] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pqjwgvxhx-w.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.011] GetFileType (hFile=0x154) returned 0x1 [0137.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.011] GetFileType (hFile=0x154) returned 0x1 [0137.011] WriteFile (in: hFile=0x154, lpBuffer=0x1af2ec4*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1af2ec4*, lpNumberOfBytesWritten=0x2ae3f8*=0x1320, lpOverlapped=0x0) returned 1 [0137.012] CloseHandle (hObject=0x154) returned 1 [0137.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk", lpFilePart=0x0) returned 0x49 [0137.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0137.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.012] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pqjwgvxhx-w.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6cfad0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6cfad0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf09acb70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1320)) returned 1 [0137.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.012] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pqjwgvxhx-w.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pqJWGvXhx-w.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pqjwgvxhx-w.lnk.anonymous")) returned 1 [0137.013] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk", lpFilePart=0x0) returned 0x51 [0137.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.013] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pynamc02z9y8jo4ttvl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.013] GetFileType (hFile=0x154) returned 0x1 [0137.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.013] GetFileType (hFile=0x154) returned 0x1 [0137.013] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1f26 [0137.014] ReadFile (in: hFile=0x154, lpBuffer=0x1af467c, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1af467c*, lpNumberOfBytesRead=0x2ae404*=0x1f26, lpOverlapped=0x0) returned 1 [0137.014] CloseHandle (hObject=0x154) returned 1 [0137.027] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk", lpFilePart=0x0) returned 0x51 [0137.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.027] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pynamc02z9y8jo4ttvl.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.028] GetFileType (hFile=0x154) returned 0x1 [0137.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.029] GetFileType (hFile=0x154) returned 0x1 [0137.029] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b058*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b4b058*, lpNumberOfBytesWritten=0x2ae3f8*=0x1f30, lpOverlapped=0x0) returned 1 [0137.030] CloseHandle (hObject=0x154) returned 1 [0137.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk", lpFilePart=0x0) returned 0x51 [0137.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0137.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pynamc02z9y8jo4ttvl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c81830, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad4e08f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf09d2cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f30)) returned 1 [0137.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.031] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pynamc02z9y8jo4ttvl.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PYNAMC02z9Y8JO4ttVl.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\pynamc02z9y8jo4ttvl.lnk.anonymous")) returned 1 [0137.032] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk", lpFilePart=0x0) returned 0x48 [0137.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.032] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q-xk2ckhb1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.032] GetFileType (hFile=0x154) returned 0x1 [0137.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.032] GetFileType (hFile=0x154) returned 0x1 [0137.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xec4 [0137.032] ReadFile (in: hFile=0x154, lpBuffer=0x1b4e320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b4e320*, lpNumberOfBytesRead=0x2ae404*=0xec4, lpOverlapped=0x0) returned 1 [0137.033] CloseHandle (hObject=0x154) returned 1 [0137.071] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk", lpFilePart=0x0) returned 0x48 [0137.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.071] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q-xk2ckhb1.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.072] GetFileType (hFile=0x154) returned 0x1 [0137.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.073] GetFileType (hFile=0x154) returned 0x1 [0137.073] WriteFile (in: hFile=0x154, lpBuffer=0x19a23e0*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19a23e0*, lpNumberOfBytesWritten=0x2ae3cc*=0xed0, lpOverlapped=0x0) returned 1 [0137.074] CloseHandle (hObject=0x154) returned 1 [0137.074] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk", lpFilePart=0x0) returned 0x48 [0137.074] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0137.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q-xk2ckhb1.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad3fc0b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad3fc0b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0a450f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xed0)) returned 1 [0137.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.074] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q-xk2ckhb1.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q-XK2ckHb1.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q-xk2ckhb1.lnk.anonymous")) returned 1 [0137.075] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk", lpFilePart=0x0) returned 0x51 [0137.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.075] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q0ihg6qs8jq74wmt-ds.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.075] GetFileType (hFile=0x154) returned 0x1 [0137.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.075] GetFileType (hFile=0x154) returned 0x1 [0137.075] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13f8 [0137.075] ReadFile (in: hFile=0x154, lpBuffer=0x19a3750, nNumberOfBytesToRead=0x13f8, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19a3750*, lpNumberOfBytesRead=0x2ae404*=0x13f8, lpOverlapped=0x0) returned 1 [0137.076] CloseHandle (hObject=0x154) returned 1 [0137.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk", lpFilePart=0x0) returned 0x51 [0137.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.089] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q0ihg6qs8jq74wmt-ds.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.091] GetFileType (hFile=0x154) returned 0x1 [0137.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.091] GetFileType (hFile=0x154) returned 0x1 [0137.091] WriteFile (in: hFile=0x154, lpBuffer=0x19f6a94*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19f6a94*, lpNumberOfBytesWritten=0x2ae3f8*=0x1400, lpOverlapped=0x0) returned 1 [0137.092] CloseHandle (hObject=0x154) returned 1 [0137.092] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk", lpFilePart=0x0) returned 0x51 [0137.092] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0137.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q0ihg6qs8jq74wmt-ds.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6f5c30, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6f5c30, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0a6b250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1 [0137.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.092] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q0ihg6qs8jq74wmt-ds.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q0IHg6QS8jQ74wMT-dS.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q0ihg6qs8jq74wmt-ds.lnk.anonymous")) returned 1 [0137.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk", lpFilePart=0x0) returned 0x56 [0137.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.094] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q3qtjsi4mfxzkj4aid q.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.094] GetFileType (hFile=0x154) returned 0x1 [0137.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.094] GetFileType (hFile=0x154) returned 0x1 [0137.094] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3e1 [0137.094] ReadFile (in: hFile=0x154, lpBuffer=0x19f8784, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19f8784*, lpNumberOfBytesRead=0x2ae404*=0x3e1, lpOverlapped=0x0) returned 1 [0137.095] CloseHandle (hObject=0x154) returned 1 [0137.107] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk", lpFilePart=0x0) returned 0x56 [0137.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.108] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q3qtjsi4mfxzkj4aid q.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.109] GetFileType (hFile=0x154) returned 0x1 [0137.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.109] GetFileType (hFile=0x154) returned 0x1 [0137.109] WriteFile (in: hFile=0x154, lpBuffer=0x1a47a98*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a47a98*, lpNumberOfBytesWritten=0x2ae3cc*=0x3f0, lpOverlapped=0x0) returned 1 [0137.110] CloseHandle (hObject=0x154) returned 1 [0137.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk", lpFilePart=0x0) returned 0x56 [0137.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x60 [0137.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.111] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q3qtjsi4mfxzkj4aid q.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7ca7990, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7ca7990, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0a913b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f0)) returned 1 [0137.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.111] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q3qtjsi4mfxzkj4aid q.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3qTJsi4MFXZkJ4aID q.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\q3qtjsi4mfxzkj4aid q.mkv.lnk.anonymous")) returned 1 [0137.112] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk", lpFilePart=0x0) returned 0x55 [0137.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.112] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qecp3t3q3ojzipwzl3_.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.112] GetFileType (hFile=0x154) returned 0x1 [0137.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.112] GetFileType (hFile=0x154) returned 0x1 [0137.112] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2b3 [0137.112] ReadFile (in: hFile=0x154, lpBuffer=0x1a4912c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a4912c*, lpNumberOfBytesRead=0x2ae404*=0x2b3, lpOverlapped=0x0) returned 1 [0137.113] CloseHandle (hObject=0x154) returned 1 [0137.125] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk", lpFilePart=0x0) returned 0x55 [0137.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.125] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qecp3t3q3ojzipwzl3_.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.126] GetFileType (hFile=0x154) returned 0x1 [0137.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.126] GetFileType (hFile=0x154) returned 0x1 [0137.127] WriteFile (in: hFile=0x154, lpBuffer=0x1a97e48*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a97e48*, lpNumberOfBytesWritten=0x2ae3cc*=0x2c0, lpOverlapped=0x0) returned 1 [0137.128] CloseHandle (hObject=0x154) returned 1 [0137.128] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk", lpFilePart=0x0) returned 0x55 [0137.128] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x5f [0137.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.128] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qecp3t3q3ojzipwzl3_.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86532f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa86532f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0ab7510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2c0)) returned 1 [0137.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.128] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qecp3t3q3ojzipwzl3_.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qEcP3t3q3oJZipWZl3_.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qecp3t3q3ojzipwzl3_.mkv.lnk.anonymous")) returned 1 [0137.129] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk", lpFilePart=0x0) returned 0x46 [0137.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.129] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qgeckfb3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.129] GetFileType (hFile=0x154) returned 0x1 [0137.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.129] GetFileType (hFile=0x154) returned 0x1 [0137.129] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x137f [0137.129] ReadFile (in: hFile=0x154, lpBuffer=0x1a991d8, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a991d8*, lpNumberOfBytesRead=0x2ae404*=0x137f, lpOverlapped=0x0) returned 1 [0137.131] CloseHandle (hObject=0x154) returned 1 [0137.142] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk", lpFilePart=0x0) returned 0x46 [0137.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.142] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qgeckfb3.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.144] GetFileType (hFile=0x154) returned 0x1 [0137.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.144] GetFileType (hFile=0x154) returned 0x1 [0137.144] WriteFile (in: hFile=0x154, lpBuffer=0x1aec144*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aec144*, lpNumberOfBytesWritten=0x2ae3f8*=0x1380, lpOverlapped=0x0) returned 1 [0137.145] CloseHandle (hObject=0x154) returned 1 [0137.145] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk", lpFilePart=0x0) returned 0x46 [0137.146] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0137.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qgeckfb3.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d62810, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9d62810, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0add670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1380)) returned 1 [0137.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.146] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qgeckfb3.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qgeCkfb3.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\qgeckfb3.lnk.anonymous")) returned 1 [0137.147] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk", lpFilePart=0x0) returned 0x48 [0137.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.147] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\r3nd10qlkq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.147] GetFileType (hFile=0x154) returned 0x1 [0137.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.147] GetFileType (hFile=0x154) returned 0x1 [0137.147] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x99d [0137.147] ReadFile (in: hFile=0x154, lpBuffer=0x1aee2d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aee2d4*, lpNumberOfBytesRead=0x2ae404*=0x99d, lpOverlapped=0x0) returned 1 [0137.148] CloseHandle (hObject=0x154) returned 1 [0137.162] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk", lpFilePart=0x0) returned 0x48 [0137.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.162] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\r3nd10qlkq.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.163] GetFileType (hFile=0x154) returned 0x1 [0137.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.164] GetFileType (hFile=0x154) returned 0x1 [0137.164] WriteFile (in: hFile=0x154, lpBuffer=0x1b3f214*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b3f214*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0137.165] CloseHandle (hObject=0x154) returned 1 [0137.167] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk", lpFilePart=0x0) returned 0x48 [0137.167] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0137.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\r3nd10qlkq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb46410, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadb46410, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0b29930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0137.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.167] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\r3nd10qlkq.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r3nd10QLKq.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\r3nd10qlkq.lnk.anonymous")) returned 1 [0137.168] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk", lpFilePart=0x0) returned 0x43 [0137.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.168] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rigyw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.169] GetFileType (hFile=0x154) returned 0x1 [0137.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.169] GetFileType (hFile=0x154) returned 0x1 [0137.169] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x96d [0137.169] ReadFile (in: hFile=0x154, lpBuffer=0x1b40ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b40ec8*, lpNumberOfBytesRead=0x2ae404*=0x96d, lpOverlapped=0x0) returned 1 [0137.170] CloseHandle (hObject=0x154) returned 1 [0137.206] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk", lpFilePart=0x0) returned 0x43 [0137.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.206] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rigyw.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.208] GetFileType (hFile=0x154) returned 0x1 [0137.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.208] GetFileType (hFile=0x154) returned 0x1 [0137.208] WriteFile (in: hFile=0x154, lpBuffer=0x19948a0*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19948a0*, lpNumberOfBytesWritten=0x2ae3cc*=0x970, lpOverlapped=0x0) returned 1 [0137.209] CloseHandle (hObject=0x154) returned 1 [0137.209] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk", lpFilePart=0x0) returned 0x43 [0137.209] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0137.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rigyw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa723d950, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa723d950, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0b9bd50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0137.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.210] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rigyw.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rigyw.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rigyw.lnk.anonymous")) returned 1 [0137.211] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk", lpFilePart=0x0) returned 0x4f [0137.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.211] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rjbqb4ash4blq6z0s.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.211] GetFileType (hFile=0x154) returned 0x1 [0137.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.211] GetFileType (hFile=0x154) returned 0x1 [0137.211] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x135a [0137.211] ReadFile (in: hFile=0x154, lpBuffer=0x1995be4, nNumberOfBytesToRead=0x135a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1995be4*, lpNumberOfBytesRead=0x2ae404*=0x135a, lpOverlapped=0x0) returned 1 [0137.212] CloseHandle (hObject=0x154) returned 1 [0137.224] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk", lpFilePart=0x0) returned 0x4f [0137.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.224] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rjbqb4ash4blq6z0s.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.226] GetFileType (hFile=0x154) returned 0x1 [0137.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.226] GetFileType (hFile=0x154) returned 0x1 [0137.226] WriteFile (in: hFile=0x154, lpBuffer=0x19e8c0c*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19e8c0c*, lpNumberOfBytesWritten=0x2ae3f8*=0x1360, lpOverlapped=0x0) returned 1 [0137.228] CloseHandle (hObject=0x154) returned 1 [0137.228] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk", lpFilePart=0x0) returned 0x4f [0137.228] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0137.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rjbqb4ash4blq6z0s.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbcd510, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xacbcd510, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0bc1eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1360)) returned 1 [0137.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.228] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rjbqb4ash4blq6z0s.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RjBqb4ash4blq6Z0s.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rjbqb4ash4blq6z0s.lnk.anonymous")) returned 1 [0137.229] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFilePart=0x0) returned 0x45 [0137.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.229] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.229] GetFileType (hFile=0x154) returned 0x1 [0137.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.229] GetFileType (hFile=0x154) returned 0x1 [0137.229] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2da [0137.229] ReadFile (in: hFile=0x154, lpBuffer=0x19ea6f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ea6f8*, lpNumberOfBytesRead=0x2ae404*=0x2da, lpOverlapped=0x0) returned 1 [0137.230] CloseHandle (hObject=0x154) returned 1 [0137.243] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFilePart=0x0) returned 0x45 [0137.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.243] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.244] GetFileType (hFile=0x154) returned 0x1 [0137.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.244] GetFileType (hFile=0x154) returned 0x1 [0137.244] WriteFile (in: hFile=0x154, lpBuffer=0x1a3946c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a3946c*, lpNumberOfBytesWritten=0x2ae3cc*=0x2e0, lpOverlapped=0x0) returned 1 [0137.245] CloseHandle (hObject=0x154) returned 1 [0137.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFilePart=0x0) returned 0x45 [0137.246] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0137.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa709aa30, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadc50db0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0be8010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2e0)) returned 1 [0137.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.246] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.anonymous")) returned 1 [0137.247] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk", lpFilePart=0x0) returned 0x47 [0137.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.247] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rrnbpsokw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.247] GetFileType (hFile=0x154) returned 0x1 [0137.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.247] GetFileType (hFile=0x154) returned 0x1 [0137.247] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x8ee [0137.247] ReadFile (in: hFile=0x154, lpBuffer=0x1a3b098, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3b098*, lpNumberOfBytesRead=0x2ae404*=0x8ee, lpOverlapped=0x0) returned 1 [0137.248] CloseHandle (hObject=0x154) returned 1 [0137.261] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk", lpFilePart=0x0) returned 0x47 [0137.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.261] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rrnbpsokw.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.262] GetFileType (hFile=0x154) returned 0x1 [0137.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.263] GetFileType (hFile=0x154) returned 0x1 [0137.263] WriteFile (in: hFile=0x154, lpBuffer=0x1a8bc60*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a8bc60*, lpNumberOfBytesWritten=0x2ae3cc*=0x8f0, lpOverlapped=0x0) returned 1 [0137.264] CloseHandle (hObject=0x154) returned 1 [0137.264] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk", lpFilePart=0x0) returned 0x47 [0137.264] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0137.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rrnbpsokw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b88310, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadb46410, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0c0e170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8f0)) returned 1 [0137.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.264] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rrnbpsokw.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrnbpSokw.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rrnbpsokw.lnk.anonymous")) returned 1 [0137.265] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk", lpFilePart=0x0) returned 0x47 [0137.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.265] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rromc4h_s.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.265] GetFileType (hFile=0x154) returned 0x1 [0137.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.266] GetFileType (hFile=0x154) returned 0x1 [0137.266] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x138a [0137.266] ReadFile (in: hFile=0x154, lpBuffer=0x1a8cf9c, nNumberOfBytesToRead=0x138a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8cf9c*, lpNumberOfBytesRead=0x2ae404*=0x138a, lpOverlapped=0x0) returned 1 [0137.267] CloseHandle (hObject=0x154) returned 1 [0137.279] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk", lpFilePart=0x0) returned 0x47 [0137.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.279] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rromc4h_s.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.281] GetFileType (hFile=0x154) returned 0x1 [0137.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.281] GetFileType (hFile=0x154) returned 0x1 [0137.281] WriteFile (in: hFile=0x154, lpBuffer=0x1adff58*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1adff58*, lpNumberOfBytesWritten=0x2ae3f8*=0x1390, lpOverlapped=0x0) returned 1 [0137.282] CloseHandle (hObject=0x154) returned 1 [0137.282] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk", lpFilePart=0x0) returned 0x47 [0137.282] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0137.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rromc4h_s.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac26de70, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac26de70, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0c342d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1390)) returned 1 [0137.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.282] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rromc4h_s.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RROmC4h_S.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rromc4h_s.lnk.anonymous")) returned 1 [0137.283] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk", lpFilePart=0x0) returned 0x4f [0137.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.284] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rs7dknm4snvxjfuzk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.284] GetFileType (hFile=0x154) returned 0x1 [0137.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.284] GetFileType (hFile=0x154) returned 0x1 [0137.284] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3d2 [0137.284] ReadFile (in: hFile=0x154, lpBuffer=0x1ae1b44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ae1b44*, lpNumberOfBytesRead=0x2ae404*=0x3d2, lpOverlapped=0x0) returned 1 [0137.285] CloseHandle (hObject=0x154) returned 1 [0137.303] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk", lpFilePart=0x0) returned 0x4f [0137.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.303] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rs7dknm4snvxjfuzk.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.305] GetFileType (hFile=0x154) returned 0x1 [0137.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.305] GetFileType (hFile=0x154) returned 0x1 [0137.305] WriteFile (in: hFile=0x154, lpBuffer=0x1b30de8*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b30de8*, lpNumberOfBytesWritten=0x2ae3cc*=0x3e0, lpOverlapped=0x0) returned 1 [0137.307] CloseHandle (hObject=0x154) returned 1 [0137.307] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk", lpFilePart=0x0) returned 0x4f [0137.307] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0137.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.307] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rs7dknm4snvxjfuzk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d8c1d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7d8c1d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0c80590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0137.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.307] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rs7dknm4snvxjfuzk.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rS7DkNM4sNvXjfuzK.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\rs7dknm4snvxjfuzk.lnk.anonymous")) returned 1 [0137.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk", lpFilePart=0x0) returned 0x43 [0137.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.309] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\s6ted.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.309] GetFileType (hFile=0x154) returned 0x1 [0137.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.309] GetFileType (hFile=0x154) returned 0x1 [0137.309] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xd94 [0137.309] ReadFile (in: hFile=0x154, lpBuffer=0x1b32ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b32ee4*, lpNumberOfBytesRead=0x2ae404*=0xd94, lpOverlapped=0x0) returned 1 [0137.311] CloseHandle (hObject=0x154) returned 1 [0137.367] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk", lpFilePart=0x0) returned 0x43 [0137.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.367] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\s6ted.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.369] GetFileType (hFile=0x154) returned 0x1 [0137.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.369] GetFileType (hFile=0x154) returned 0x1 [0137.369] WriteFile (in: hFile=0x154, lpBuffer=0x1987754*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1987754*, lpNumberOfBytesWritten=0x2ae3cc*=0xda0, lpOverlapped=0x0) returned 1 [0137.370] CloseHandle (hObject=0x154) returned 1 [0137.370] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk", lpFilePart=0x0) returned 0x43 [0137.371] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0137.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\s6ted.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77266b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac96bf10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0d18b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xda0)) returned 1 [0137.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.371] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\s6ted.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s6tED.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\s6ted.lnk.anonymous")) returned 1 [0137.372] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk", lpFilePart=0x0) returned 0x4c [0137.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.372] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sbfjqhupcn1ibx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.372] GetFileType (hFile=0x154) returned 0x1 [0137.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.373] GetFileType (hFile=0x154) returned 0x1 [0137.373] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9d4 [0137.373] ReadFile (in: hFile=0x154, lpBuffer=0x1989470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1989470*, lpNumberOfBytesRead=0x2ae404*=0x9d4, lpOverlapped=0x0) returned 1 [0137.374] CloseHandle (hObject=0x154) returned 1 [0137.391] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk", lpFilePart=0x0) returned 0x4c [0137.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.391] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sbfjqhupcn1ibx.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.393] GetFileType (hFile=0x154) returned 0x1 [0137.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.393] GetFileType (hFile=0x154) returned 0x1 [0137.393] WriteFile (in: hFile=0x154, lpBuffer=0x19da664*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19da664*, lpNumberOfBytesWritten=0x2ae3cc*=0x9e0, lpOverlapped=0x0) returned 1 [0137.394] CloseHandle (hObject=0x154) returned 1 [0137.394] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk", lpFilePart=0x0) returned 0x4c [0137.394] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0137.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sbfjqhupcn1ibx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7ade910, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7ade910, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0d3ec70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e0)) returned 1 [0137.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.394] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sbfjqhupcn1ibx.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbFjqHuPCn1Ibx.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sbfjqhupcn1ibx.lnk.anonymous")) returned 1 [0137.396] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk", lpFilePart=0x0) returned 0x4e [0137.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.396] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sd5ja03v9cyykxmr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.396] GetFileType (hFile=0x154) returned 0x1 [0137.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.396] GetFileType (hFile=0x154) returned 0x1 [0137.396] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xead [0137.396] ReadFile (in: hFile=0x154, lpBuffer=0x19dc8a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19dc8a0*, lpNumberOfBytesRead=0x2ae404*=0xead, lpOverlapped=0x0) returned 1 [0137.397] CloseHandle (hObject=0x154) returned 1 [0137.409] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk", lpFilePart=0x0) returned 0x4e [0137.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.409] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sd5ja03v9cyykxmr.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.410] GetFileType (hFile=0x154) returned 0x1 [0137.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.411] GetFileType (hFile=0x154) returned 0x1 [0137.411] WriteFile (in: hFile=0x154, lpBuffer=0x1a2f148*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a2f148*, lpNumberOfBytesWritten=0x2ae3cc*=0xeb0, lpOverlapped=0x0) returned 1 [0137.412] CloseHandle (hObject=0x154) returned 1 [0137.412] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk", lpFilePart=0x0) returned 0x4e [0137.412] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0137.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sd5ja03v9cyykxmr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7987cb0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7987cb0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0d8af30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xeb0)) returned 1 [0137.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.412] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sd5ja03v9cyykxmr.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sD5Ja03v9cyYkXmR.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sd5ja03v9cyykxmr.lnk.anonymous")) returned 1 [0137.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk", lpFilePart=0x0) returned 0x46 [0137.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.414] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sjuxl3ot.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.414] GetFileType (hFile=0x154) returned 0x1 [0137.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.414] GetFileType (hFile=0x154) returned 0x1 [0137.414] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x992 [0137.414] ReadFile (in: hFile=0x154, lpBuffer=0x1a30e54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a30e54*, lpNumberOfBytesRead=0x2ae404*=0x992, lpOverlapped=0x0) returned 1 [0137.415] CloseHandle (hObject=0x154) returned 1 [0137.427] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk", lpFilePart=0x0) returned 0x46 [0137.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.427] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sjuxl3ot.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.429] GetFileType (hFile=0x154) returned 0x1 [0137.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.429] GetFileType (hFile=0x154) returned 0x1 [0137.429] WriteFile (in: hFile=0x154, lpBuffer=0x1a81d98*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a81d98*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0137.430] CloseHandle (hObject=0x154) returned 1 [0137.430] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk", lpFilePart=0x0) returned 0x46 [0137.430] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0137.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sjuxl3ot.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6a9970, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad6a9970, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0db1090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0137.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.430] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sjuxl3ot.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SjUXl3ot.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sjuxl3ot.lnk.anonymous")) returned 1 [0137.431] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk", lpFilePart=0x0) returned 0x47 [0137.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.431] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\so4fj0el4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.432] GetFileType (hFile=0x154) returned 0x1 [0137.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.432] GetFileType (hFile=0x154) returned 0x1 [0137.432] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x999 [0137.432] ReadFile (in: hFile=0x154, lpBuffer=0x1a83a7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a83a7c*, lpNumberOfBytesRead=0x2ae404*=0x999, lpOverlapped=0x0) returned 1 [0137.433] CloseHandle (hObject=0x154) returned 1 [0137.445] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk", lpFilePart=0x0) returned 0x47 [0137.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.445] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\so4fj0el4.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.446] GetFileType (hFile=0x154) returned 0x1 [0137.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.446] GetFileType (hFile=0x154) returned 0x1 [0137.447] WriteFile (in: hFile=0x154, lpBuffer=0x1ad49b8*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ad49b8*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0137.448] CloseHandle (hObject=0x154) returned 1 [0137.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk", lpFilePart=0x0) returned 0x47 [0137.448] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0137.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.448] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\so4fj0el4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89bf290, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa89bf290, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0dd71f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0137.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.448] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\so4fj0el4.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sO4Fj0El4.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\so4fj0el4.lnk.anonymous")) returned 1 [0137.449] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk", lpFilePart=0x0) returned 0x4b [0137.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.449] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sxi gvwedxwwt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.449] GetFileType (hFile=0x154) returned 0x1 [0137.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.449] GetFileType (hFile=0x154) returned 0x1 [0137.449] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xedd [0137.449] ReadFile (in: hFile=0x154, lpBuffer=0x1ad6bf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad6bf0*, lpNumberOfBytesRead=0x2ae404*=0xedd, lpOverlapped=0x0) returned 1 [0137.450] CloseHandle (hObject=0x154) returned 1 [0137.462] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk", lpFilePart=0x0) returned 0x4b [0137.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.462] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sxi gvwedxwwt.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.464] GetFileType (hFile=0x154) returned 0x1 [0137.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.464] GetFileType (hFile=0x154) returned 0x1 [0137.464] WriteFile (in: hFile=0x154, lpBuffer=0x1b29578*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b29578*, lpNumberOfBytesWritten=0x2ae3cc*=0xee0, lpOverlapped=0x0) returned 1 [0137.465] CloseHandle (hObject=0x154) returned 1 [0137.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk", lpFilePart=0x0) returned 0x4b [0137.465] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0137.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sxi gvwedxwwt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad5c5130, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad5c5130, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0dfd350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xee0)) returned 1 [0137.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.466] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sxi gvwedxwwt.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SXi GvWEdxwWT.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\sxi gvwedxwwt.lnk.anonymous")) returned 1 [0137.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk", lpFilePart=0x0) returned 0x4b [0137.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.467] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tiwdxlm_iexc3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.467] GetFileType (hFile=0x154) returned 0x1 [0137.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.467] GetFileType (hFile=0x154) returned 0x1 [0137.467] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x26d9 [0137.467] ReadFile (in: hFile=0x154, lpBuffer=0x1b2a8dc, nNumberOfBytesToRead=0x26d9, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b2a8dc*, lpNumberOfBytesRead=0x2ae404*=0x26d9, lpOverlapped=0x0) returned 1 [0137.468] CloseHandle (hObject=0x154) returned 1 [0137.516] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk", lpFilePart=0x0) returned 0x4b [0137.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.516] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tiwdxlm_iexc3.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.517] GetFileType (hFile=0x154) returned 0x1 [0137.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.518] GetFileType (hFile=0x154) returned 0x1 [0137.518] WriteFile (in: hFile=0x154, lpBuffer=0x198802c*, nNumberOfBytesToWrite=0x26e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x198802c*, lpNumberOfBytesWritten=0x2ae3f8*=0x26e0, lpOverlapped=0x0) returned 1 [0137.519] CloseHandle (hObject=0x154) returned 1 [0137.519] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk", lpFilePart=0x0) returned 0x4b [0137.519] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0137.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tiwdxlm_iexc3.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad4e08f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad4e08f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0e6f770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26e0)) returned 1 [0137.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.519] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tiwdxlm_iexc3.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TIwdxlM_iExC3.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tiwdxlm_iexc3.lnk.anonymous")) returned 1 [0137.521] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk", lpFilePart=0x0) returned 0x42 [0137.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.521] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tlyo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.521] GetFileType (hFile=0x154) returned 0x1 [0137.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.521] GetFileType (hFile=0x154) returned 0x1 [0137.521] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x134f [0137.521] ReadFile (in: hFile=0x154, lpBuffer=0x198ab80, nNumberOfBytesToRead=0x134f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x198ab80*, lpNumberOfBytesRead=0x2ae404*=0x134f, lpOverlapped=0x0) returned 1 [0137.522] CloseHandle (hObject=0x154) returned 1 [0137.537] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk", lpFilePart=0x0) returned 0x42 [0137.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.537] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tlyo.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.538] GetFileType (hFile=0x154) returned 0x1 [0137.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.538] GetFileType (hFile=0x154) returned 0x1 [0137.538] WriteFile (in: hFile=0x154, lpBuffer=0x19ddb58*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19ddb58*, lpNumberOfBytesWritten=0x2ae3f8*=0x1350, lpOverlapped=0x0) returned 1 [0137.540] CloseHandle (hObject=0x154) returned 1 [0137.540] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk", lpFilePart=0x0) returned 0x42 [0137.540] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk.anonymous", lpFilePart=0x0) returned 0x4c [0137.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tlyo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7ee2e30, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7ee2e30, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0ebba30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1350)) returned 1 [0137.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.540] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tlyo.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tlyo.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tlyo.lnk.anonymous")) returned 1 [0137.541] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk", lpFilePart=0x0) returned 0x43 [0137.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.541] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tqnz7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.541] GetFileType (hFile=0x154) returned 0x1 [0137.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.541] GetFileType (hFile=0x154) returned 0x1 [0137.542] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe90 [0137.542] ReadFile (in: hFile=0x154, lpBuffer=0x19e0168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e0168*, lpNumberOfBytesRead=0x2ae404*=0xe90, lpOverlapped=0x0) returned 1 [0137.542] CloseHandle (hObject=0x154) returned 1 [0137.558] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk", lpFilePart=0x0) returned 0x43 [0137.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.559] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tqnz7.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.560] GetFileType (hFile=0x154) returned 0x1 [0137.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.561] GetFileType (hFile=0x154) returned 0x1 [0137.561] WriteFile (in: hFile=0x154, lpBuffer=0x1a3299c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a3299c*, lpNumberOfBytesWritten=0x2ae3cc*=0xea0, lpOverlapped=0x0) returned 1 [0137.562] CloseHandle (hObject=0x154) returned 1 [0137.562] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk", lpFilePart=0x0) returned 0x43 [0137.562] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0137.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tqnz7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9c9650, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad9c9650, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0ee1b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xea0)) returned 1 [0137.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.563] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tqnz7.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TqNZ7.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\tqnz7.lnk.anonymous")) returned 1 [0137.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk", lpFilePart=0x0) returned 0x48 [0137.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.564] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\u9bkaqdezd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.564] GetFileType (hFile=0x154) returned 0x1 [0137.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.564] GetFileType (hFile=0x154) returned 0x1 [0137.565] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x988 [0137.565] ReadFile (in: hFile=0x154, lpBuffer=0x1a3465c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a3465c*, lpNumberOfBytesRead=0x2ae404*=0x988, lpOverlapped=0x0) returned 1 [0137.566] CloseHandle (hObject=0x154) returned 1 [0137.581] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk", lpFilePart=0x0) returned 0x48 [0137.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.581] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\u9bkaqdezd.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.583] GetFileType (hFile=0x154) returned 0x1 [0137.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.583] GetFileType (hFile=0x154) returned 0x1 [0137.583] WriteFile (in: hFile=0x154, lpBuffer=0x1a85550*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a85550*, lpNumberOfBytesWritten=0x2ae3cc*=0x990, lpOverlapped=0x0) returned 1 [0137.585] CloseHandle (hObject=0x154) returned 1 [0137.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk", lpFilePart=0x0) returned 0x48 [0137.585] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk.anonymous", lpFilePart=0x0) returned 0x52 [0137.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\u9bkaqdezd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad5c5130, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad5c5130, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0f2de50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1 [0137.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.585] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\u9bkaqdezd.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u9BkAqdEzd.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\u9bkaqdezd.lnk.anonymous")) returned 1 [0137.586] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk", lpFilePart=0x0) returned 0x45 [0137.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.586] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\uiyff6z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.586] GetFileType (hFile=0x154) returned 0x1 [0137.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.586] GetFileType (hFile=0x154) returned 0x1 [0137.586] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe9b [0137.586] ReadFile (in: hFile=0x154, lpBuffer=0x1a87738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a87738*, lpNumberOfBytesRead=0x2ae404*=0xe9b, lpOverlapped=0x0) returned 1 [0137.587] CloseHandle (hObject=0x154) returned 1 [0137.600] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk", lpFilePart=0x0) returned 0x45 [0137.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.600] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\uiyff6z.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.601] GetFileType (hFile=0x154) returned 0x1 [0137.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.601] GetFileType (hFile=0x154) returned 0x1 [0137.601] WriteFile (in: hFile=0x154, lpBuffer=0x1ad9f6c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ad9f6c*, lpNumberOfBytesWritten=0x2ae3cc*=0xea0, lpOverlapped=0x0) returned 1 [0137.603] CloseHandle (hObject=0x154) returned 1 [0137.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk", lpFilePart=0x0) returned 0x45 [0137.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0137.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\uiyff6z.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3c4ad0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac3c4ad0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0f53fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xea0)) returned 1 [0137.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.603] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\uiyff6z.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UiYFf6z.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\uiyff6z.lnk.anonymous")) returned 1 [0137.604] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk", lpFilePart=0x0) returned 0x4b [0137.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.604] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ukrbel88hctc_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.604] GetFileType (hFile=0x154) returned 0x1 [0137.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.604] GetFileType (hFile=0x154) returned 0x1 [0137.604] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xdf0 [0137.604] ReadFile (in: hFile=0x154, lpBuffer=0x1adc0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1adc0a8*, lpNumberOfBytesRead=0x2ae404*=0xdf0, lpOverlapped=0x0) returned 1 [0137.605] CloseHandle (hObject=0x154) returned 1 [0137.620] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk", lpFilePart=0x0) returned 0x4b [0137.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.620] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ukrbel88hctc_.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.622] GetFileType (hFile=0x154) returned 0x1 [0137.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.622] GetFileType (hFile=0x154) returned 0x1 [0137.622] WriteFile (in: hFile=0x154, lpBuffer=0x1b2e5dc*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b2e5dc*, lpNumberOfBytesWritten=0x2ae3cc*=0xe00, lpOverlapped=0x0) returned 1 [0137.623] CloseHandle (hObject=0x154) returned 1 [0137.624] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk", lpFilePart=0x0) returned 0x4b [0137.624] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0137.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ukrbel88hctc_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d66070, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xada87d30, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf0f7a110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0137.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.624] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ukrbel88hctc_.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UkRBEL88HcTc_.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ukrbel88hctc_.lnk.anonymous")) returned 1 [0137.625] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk", lpFilePart=0x0) returned 0x52 [0137.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.626] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ur0oe5x8rv-xw8ku5zbm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.626] GetFileType (hFile=0x154) returned 0x1 [0137.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.626] GetFileType (hFile=0x154) returned 0x1 [0137.626] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x96b [0137.626] ReadFile (in: hFile=0x154, lpBuffer=0x1b302d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b302d8*, lpNumberOfBytesRead=0x2ae404*=0x96b, lpOverlapped=0x0) returned 1 [0137.627] CloseHandle (hObject=0x154) returned 1 [0137.669] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk", lpFilePart=0x0) returned 0x52 [0137.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.669] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ur0oe5x8rv-xw8ku5zbm.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.677] GetFileType (hFile=0x154) returned 0x1 [0137.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.677] GetFileType (hFile=0x154) returned 0x1 [0137.677] WriteFile (in: hFile=0x154, lpBuffer=0x1986d54*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1986d54*, lpNumberOfBytesWritten=0x2ae3cc*=0x970, lpOverlapped=0x0) returned 1 [0137.678] CloseHandle (hObject=0x154) returned 1 [0137.678] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk", lpFilePart=0x0) returned 0x52 [0137.678] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk.anonymous", lpFilePart=0x0) returned 0x5c [0137.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ur0oe5x8rv-xw8ku5zbm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89bf290, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad128690, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1012690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0137.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.678] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ur0oe5x8rv-xw8ku5zbm.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uR0OE5x8RV-XW8ku5ZbM.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ur0oe5x8rv-xw8ku5zbm.lnk.anonymous")) returned 1 [0137.679] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk", lpFilePart=0x0) returned 0x51 [0137.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.679] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\veyax_kx gmcgxb_ocm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.679] GetFileType (hFile=0x154) returned 0x1 [0137.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.680] GetFileType (hFile=0x154) returned 0x1 [0137.680] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe60 [0137.680] ReadFile (in: hFile=0x154, lpBuffer=0x1988f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1988f6c*, lpNumberOfBytesRead=0x2ae404*=0xe60, lpOverlapped=0x0) returned 1 [0137.681] CloseHandle (hObject=0x154) returned 1 [0137.696] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk", lpFilePart=0x0) returned 0x51 [0137.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.696] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\veyax_kx gmcgxb_ocm.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.697] GetFileType (hFile=0x154) returned 0x1 [0137.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.697] GetFileType (hFile=0x154) returned 0x1 [0137.697] WriteFile (in: hFile=0x154, lpBuffer=0x19db844*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19db844*, lpNumberOfBytesWritten=0x2ae3cc*=0xe70, lpOverlapped=0x0) returned 1 [0137.698] CloseHandle (hObject=0x154) returned 1 [0137.698] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk", lpFilePart=0x0) returned 0x51 [0137.699] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0137.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\veyax_kx gmcgxb_ocm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabad7850, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xabad7850, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf10387f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe70)) returned 1 [0137.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.699] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\veyax_kx gmcgxb_ocm.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VeYaX_KX GmcGXb_ocM.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\veyax_kx gmcgxb_ocm.lnk.anonymous")) returned 1 [0137.700] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk", lpFilePart=0x0) returned 0x4e [0137.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.700] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\vfyayxtgj bqmkxo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.700] GetFileType (hFile=0x154) returned 0x1 [0137.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.700] GetFileType (hFile=0x154) returned 0x1 [0137.700] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x262c [0137.700] ReadFile (in: hFile=0x154, lpBuffer=0x19dcbdc, nNumberOfBytesToRead=0x262c, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19dcbdc*, lpNumberOfBytesRead=0x2ae404*=0x262c, lpOverlapped=0x0) returned 1 [0137.701] CloseHandle (hObject=0x154) returned 1 [0137.714] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk", lpFilePart=0x0) returned 0x4e [0137.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.714] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\vfyayxtgj bqmkxo.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.715] GetFileType (hFile=0x154) returned 0x1 [0137.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.716] GetFileType (hFile=0x154) returned 0x1 [0137.716] WriteFile (in: hFile=0x154, lpBuffer=0x1a358b4*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a358b4*, lpNumberOfBytesWritten=0x2ae3f8*=0x2630, lpOverlapped=0x0) returned 1 [0137.717] CloseHandle (hObject=0x154) returned 1 [0137.717] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk", lpFilePart=0x0) returned 0x4e [0137.717] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0137.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\vfyayxtgj bqmkxo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad102530, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad102530, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf105e950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2630)) returned 1 [0137.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.717] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\vfyayxtgj bqmkxo.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vFyAyxtGj bqmKXO.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\vfyayxtgj bqmkxo.lnk.anonymous")) returned 1 [0137.718] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk", lpFilePart=0x0) returned 0x44 [0137.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.718] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\v_uncq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.718] GetFileType (hFile=0x154) returned 0x1 [0137.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.718] GetFileType (hFile=0x154) returned 0x1 [0137.718] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x97c [0137.719] ReadFile (in: hFile=0x154, lpBuffer=0x1a38d10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a38d10*, lpNumberOfBytesRead=0x2ae404*=0x97c, lpOverlapped=0x0) returned 1 [0137.719] CloseHandle (hObject=0x154) returned 1 [0137.732] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk", lpFilePart=0x0) returned 0x44 [0137.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.732] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\v_uncq.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.733] GetFileType (hFile=0x154) returned 0x1 [0137.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.733] GetFileType (hFile=0x154) returned 0x1 [0137.733] WriteFile (in: hFile=0x154, lpBuffer=0x1a89ba0*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a89ba0*, lpNumberOfBytesWritten=0x2ae3cc*=0x980, lpOverlapped=0x0) returned 1 [0137.735] CloseHandle (hObject=0x154) returned 1 [0137.735] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk", lpFilePart=0x0) returned 0x44 [0137.735] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk.anonymous", lpFilePart=0x0) returned 0x4e [0137.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.735] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\v_uncq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd355f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadd355f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1084ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x980)) returned 1 [0137.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.735] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\v_uncq.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V_UNCQ.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\v_uncq.lnk.anonymous")) returned 1 [0137.736] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk", lpFilePart=0x0) returned 0x44 [0137.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.736] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w0xap6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.736] GetFileType (hFile=0x154) returned 0x1 [0137.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.736] GetFileType (hFile=0x154) returned 0x1 [0137.736] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x12e1 [0137.737] ReadFile (in: hFile=0x154, lpBuffer=0x1a8aec8, nNumberOfBytesToRead=0x12e1, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8aec8*, lpNumberOfBytesRead=0x2ae404*=0x12e1, lpOverlapped=0x0) returned 1 [0137.737] CloseHandle (hObject=0x154) returned 1 [0137.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk", lpFilePart=0x0) returned 0x44 [0137.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.750] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w0xap6.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.751] GetFileType (hFile=0x154) returned 0x1 [0137.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.751] GetFileType (hFile=0x154) returned 0x1 [0137.751] WriteFile (in: hFile=0x154, lpBuffer=0x1addb64*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1addb64*, lpNumberOfBytesWritten=0x2ae3f8*=0x12f0, lpOverlapped=0x0) returned 1 [0137.753] CloseHandle (hObject=0x154) returned 1 [0137.753] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk", lpFilePart=0x0) returned 0x44 [0137.753] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk.anonymous", lpFilePart=0x0) returned 0x4e [0137.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w0xap6.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf255930, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaf255930, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf10aac10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12f0)) returned 1 [0137.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.753] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w0xap6.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W0xap6.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w0xap6.lnk.anonymous")) returned 1 [0137.755] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk", lpFilePart=0x0) returned 0x46 [0137.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.755] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w7h7.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.755] GetFileType (hFile=0x154) returned 0x1 [0137.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.755] GetFileType (hFile=0x154) returned 0x1 [0137.755] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x8ff [0137.755] ReadFile (in: hFile=0x154, lpBuffer=0x1adfba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1adfba8*, lpNumberOfBytesRead=0x2ae404*=0x8ff, lpOverlapped=0x0) returned 1 [0137.756] CloseHandle (hObject=0x154) returned 1 [0137.768] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk", lpFilePart=0x0) returned 0x46 [0137.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.768] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w7h7.mkv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.770] GetFileType (hFile=0x154) returned 0x1 [0137.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.770] GetFileType (hFile=0x154) returned 0x1 [0137.770] WriteFile (in: hFile=0x154, lpBuffer=0x1b307c0*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b307c0*, lpNumberOfBytesWritten=0x2ae3cc*=0x900, lpOverlapped=0x0) returned 1 [0137.771] CloseHandle (hObject=0x154) returned 1 [0137.771] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk", lpFilePart=0x0) returned 0x46 [0137.771] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk.anonymous", lpFilePart=0x0) returned 0x50 [0137.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w7h7.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaad73c90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaad73c90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf10f6ed0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x900)) returned 1 [0137.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.771] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w7h7.mkv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w7h7.mkv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w7h7.mkv.lnk.anonymous")) returned 1 [0137.772] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk", lpFilePart=0x0) returned 0x4c [0137.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.773] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w95s vzdyibkui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.773] GetFileType (hFile=0x154) returned 0x1 [0137.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.773] GetFileType (hFile=0x154) returned 0x1 [0137.773] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xdfc [0137.773] ReadFile (in: hFile=0x154, lpBuffer=0x1b3291c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b3291c*, lpNumberOfBytesRead=0x2ae404*=0xdfc, lpOverlapped=0x0) returned 1 [0137.774] CloseHandle (hObject=0x154) returned 1 [0137.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk", lpFilePart=0x0) returned 0x4c [0137.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.790] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w95s vzdyibkui.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.792] GetFileType (hFile=0x154) returned 0x1 [0137.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.792] GetFileType (hFile=0x154) returned 0x1 [0137.792] WriteFile (in: hFile=0x154, lpBuffer=0x198741c*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x198741c*, lpNumberOfBytesWritten=0x2ae3cc*=0xe00, lpOverlapped=0x0) returned 1 [0137.793] CloseHandle (hObject=0x154) returned 1 [0137.793] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk", lpFilePart=0x0) returned 0x4c [0137.793] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk.anonymous", lpFilePart=0x0) returned 0x56 [0137.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w95s vzdyibkui.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8607030, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xacbf3670, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf111d030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1 [0137.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.793] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w95s vzdyibkui.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s vZdyibKui.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\w95s vzdyibkui.lnk.anonymous")) returned 1 [0137.795] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk", lpFilePart=0x0) returned 0x50 [0137.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.795] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wb_8nmjawnyx-q40vf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.795] GetFileType (hFile=0x154) returned 0x1 [0137.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.795] GetFileType (hFile=0x154) returned 0x1 [0137.795] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x942 [0137.795] ReadFile (in: hFile=0x154, lpBuffer=0x19890f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19890f4*, lpNumberOfBytesRead=0x2ae404*=0x942, lpOverlapped=0x0) returned 1 [0137.796] CloseHandle (hObject=0x154) returned 1 [0137.833] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk", lpFilePart=0x0) returned 0x50 [0137.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.833] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wb_8nmjawnyx-q40vf.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.834] GetFileType (hFile=0x154) returned 0x1 [0137.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.834] GetFileType (hFile=0x154) returned 0x1 [0137.834] WriteFile (in: hFile=0x154, lpBuffer=0x19da02c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19da02c*, lpNumberOfBytesWritten=0x2ae3cc*=0x950, lpOverlapped=0x0) returned 1 [0137.835] CloseHandle (hObject=0x154) returned 1 [0137.836] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk", lpFilePart=0x0) returned 0x50 [0137.836] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0137.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wb_8nmjawnyx-q40vf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa749ef50, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadd355f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf118f450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x950)) returned 1 [0137.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.836] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wb_8nmjawnyx-q40vf.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wB_8nMJAwNyX-Q40vF.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wb_8nmjawnyx-q40vf.lnk.anonymous")) returned 1 [0137.837] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk", lpFilePart=0x0) returned 0x51 [0137.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.837] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wghugz9h5d4zmxsnjmb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.837] GetFileType (hFile=0x154) returned 0x1 [0137.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.837] GetFileType (hFile=0x154) returned 0x1 [0137.837] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x24e [0137.837] ReadFile (in: hFile=0x154, lpBuffer=0x19db628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19db628*, lpNumberOfBytesRead=0x2ae404*=0x24e, lpOverlapped=0x0) returned 1 [0137.838] CloseHandle (hObject=0x154) returned 1 [0137.850] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk", lpFilePart=0x0) returned 0x51 [0137.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.850] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wghugz9h5d4zmxsnjmb.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.852] GetFileType (hFile=0x154) returned 0x1 [0137.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.852] GetFileType (hFile=0x154) returned 0x1 [0137.852] WriteFile (in: hFile=0x154, lpBuffer=0x1a2a0f8*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a2a0f8*, lpNumberOfBytesWritten=0x2ae3cc*=0x250, lpOverlapped=0x0) returned 1 [0137.853] CloseHandle (hObject=0x154) returned 1 [0137.853] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk", lpFilePart=0x0) returned 0x51 [0137.853] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0137.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wghugz9h5d4zmxsnjmb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8783df0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa8783df0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf11b55b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0137.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.854] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wghugz9h5d4zmxsnjmb.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wGHugz9h5D4zmXsNJMb.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wghugz9h5d4zmxsnjmb.lnk.anonymous")) returned 1 [0137.855] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk", lpFilePart=0x0) returned 0x4f [0137.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.855] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wue9lfrqwwhyo9yq2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.855] GetFileType (hFile=0x154) returned 0x1 [0137.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.855] GetFileType (hFile=0x154) returned 0x1 [0137.855] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xf18 [0137.855] ReadFile (in: hFile=0x154, lpBuffer=0x1a2c3b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a2c3b4*, lpNumberOfBytesRead=0x2ae404*=0xf18, lpOverlapped=0x0) returned 1 [0137.856] CloseHandle (hObject=0x154) returned 1 [0137.869] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk", lpFilePart=0x0) returned 0x4f [0137.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.869] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wue9lfrqwwhyo9yq2.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.871] GetFileType (hFile=0x154) returned 0x1 [0137.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.871] GetFileType (hFile=0x154) returned 0x1 [0137.871] WriteFile (in: hFile=0x154, lpBuffer=0x1a7ee90*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a7ee90*, lpNumberOfBytesWritten=0x2ae3cc*=0xf20, lpOverlapped=0x0) returned 1 [0137.872] CloseHandle (hObject=0x154) returned 1 [0137.872] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk", lpFilePart=0x0) returned 0x4f [0137.872] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0137.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wue9lfrqwwhyo9yq2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9310d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad9310d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf11db710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf20)) returned 1 [0137.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.872] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wue9lfrqwwhyo9yq2.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WUE9LfRqWWHYo9yq2.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wue9lfrqwwhyo9yq2.lnk.anonymous")) returned 1 [0137.873] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk", lpFilePart=0x0) returned 0x4f [0137.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.873] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wwjgjs4g0aj2-rroe.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.873] GetFileType (hFile=0x154) returned 0x1 [0137.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.873] GetFileType (hFile=0x154) returned 0x1 [0137.873] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3d7 [0137.874] ReadFile (in: hFile=0x154, lpBuffer=0x1a80600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a80600*, lpNumberOfBytesRead=0x2ae404*=0x3d7, lpOverlapped=0x0) returned 1 [0137.875] CloseHandle (hObject=0x154) returned 1 [0137.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk", lpFilePart=0x0) returned 0x4f [0137.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.906] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wwjgjs4g0aj2-rroe.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.908] GetFileType (hFile=0x154) returned 0x1 [0137.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.908] GetFileType (hFile=0x154) returned 0x1 [0137.908] WriteFile (in: hFile=0x154, lpBuffer=0x1acf8a0*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1acf8a0*, lpNumberOfBytesWritten=0x2ae3cc*=0x3e0, lpOverlapped=0x0) returned 1 [0137.909] CloseHandle (hObject=0x154) returned 1 [0137.909] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk", lpFilePart=0x0) returned 0x4f [0137.909] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0137.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.909] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wwjgjs4g0aj2-rroe.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa761bd10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa761bd10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf12279d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0137.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.910] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wwjgjs4g0aj2-rroe.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wWJgjS4g0aj2-rroE.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\wwjgjs4g0aj2-rroe.lnk.anonymous")) returned 1 [0137.911] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk", lpFilePart=0x0) returned 0x43 [0137.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.911] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xc73w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.911] GetFileType (hFile=0x154) returned 0x1 [0137.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.911] GetFileType (hFile=0x154) returned 0x1 [0137.911] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x392 [0137.911] ReadFile (in: hFile=0x154, lpBuffer=0x1ad0f9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad0f9c*, lpNumberOfBytesRead=0x2ae404*=0x392, lpOverlapped=0x0) returned 1 [0137.912] CloseHandle (hObject=0x154) returned 1 [0137.924] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk", lpFilePart=0x0) returned 0x43 [0137.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.924] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xc73w.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.926] GetFileType (hFile=0x154) returned 0x1 [0137.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.926] GetFileType (hFile=0x154) returned 0x1 [0137.926] WriteFile (in: hFile=0x154, lpBuffer=0x1b200d0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b200d0*, lpNumberOfBytesWritten=0x2ae3cc*=0x3a0, lpOverlapped=0x0) returned 1 [0137.928] CloseHandle (hObject=0x154) returned 1 [0137.928] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk", lpFilePart=0x0) returned 0x43 [0137.928] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0137.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xc73w.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73482f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa73482f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1273c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0137.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.928] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xc73w.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xc73W.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xc73w.lnk.anonymous")) returned 1 [0137.929] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk", lpFilePart=0x0) returned 0x4b [0137.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.929] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xfkwyoqw4t p-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.929] GetFileType (hFile=0x154) returned 0x1 [0137.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.929] GetFileType (hFile=0x154) returned 0x1 [0137.929] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1996 [0137.930] ReadFile (in: hFile=0x154, lpBuffer=0x1b21404, nNumberOfBytesToRead=0x1996, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b21404*, lpNumberOfBytesRead=0x2ae404*=0x1996, lpOverlapped=0x0) returned 1 [0137.930] CloseHandle (hObject=0x154) returned 1 [0137.943] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk", lpFilePart=0x0) returned 0x4b [0137.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.943] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xfkwyoqw4t p-.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.945] GetFileType (hFile=0x154) returned 0x1 [0137.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.945] GetFileType (hFile=0x154) returned 0x1 [0137.945] WriteFile (in: hFile=0x154, lpBuffer=0x1b76210*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b76210*, lpNumberOfBytesWritten=0x2ae3f8*=0x19a0, lpOverlapped=0x0) returned 1 [0137.947] CloseHandle (hObject=0x154) returned 1 [0137.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk", lpFilePart=0x0) returned 0x4b [0137.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0137.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xfkwyoqw4t p-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9390d50, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9390d50, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1299df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19a0)) returned 1 [0137.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.947] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xfkwyoqw4t p-.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xFkWYOQW4T p-.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xfkwyoqw4t p-.lnk.anonymous")) returned 1 [0137.951] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk", lpFilePart=0x0) returned 0x43 [0137.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.951] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xgoku.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.951] GetFileType (hFile=0x154) returned 0x1 [0137.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.951] GetFileType (hFile=0x154) returned 0x1 [0137.951] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1ff [0137.951] ReadFile (in: hFile=0x154, lpBuffer=0x1b78230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b78230*, lpNumberOfBytesRead=0x2ae404*=0x1ff, lpOverlapped=0x0) returned 1 [0137.952] CloseHandle (hObject=0x154) returned 1 [0137.990] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk", lpFilePart=0x0) returned 0x43 [0137.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0137.990] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xgoku.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.992] GetFileType (hFile=0x154) returned 0x1 [0137.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0137.992] GetFileType (hFile=0x154) returned 0x1 [0137.992] WriteFile (in: hFile=0x154, lpBuffer=0x19c8de8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19c8de8*, lpNumberOfBytesWritten=0x2ae3cc*=0x200, lpOverlapped=0x0) returned 1 [0137.993] CloseHandle (hObject=0x154) returned 1 [0137.993] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk", lpFilePart=0x0) returned 0x43 [0137.993] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0137.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0137.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xgoku.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad33d9d0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad33d9d0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf130c210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0137.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0137.993] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xgoku.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xGOku.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xgoku.lnk.anonymous")) returned 1 [0137.994] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk", lpFilePart=0x0) returned 0x45 [0137.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0137.995] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xiucecd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0137.995] GetFileType (hFile=0x154) returned 0x1 [0137.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0137.995] GetFileType (hFile=0x154) returned 0x1 [0137.995] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x20b [0137.995] ReadFile (in: hFile=0x154, lpBuffer=0x19ca31c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ca31c*, lpNumberOfBytesRead=0x2ae404*=0x20b, lpOverlapped=0x0) returned 1 [0137.996] CloseHandle (hObject=0x154) returned 1 [0138.009] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk", lpFilePart=0x0) returned 0x45 [0138.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.009] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xiucecd.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.011] GetFileType (hFile=0x154) returned 0x1 [0138.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.011] GetFileType (hFile=0x154) returned 0x1 [0138.011] WriteFile (in: hFile=0x154, lpBuffer=0x1a18ddc*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a18ddc*, lpNumberOfBytesWritten=0x2ae3cc*=0x210, lpOverlapped=0x0) returned 1 [0138.012] CloseHandle (hObject=0x154) returned 1 [0138.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk", lpFilePart=0x0) returned 0x45 [0138.012] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0138.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.012] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xiucecd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad2cb5b0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad2cb5b0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1332370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0138.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.012] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xiucecd.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIuceCD.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xiucecd.lnk.anonymous")) returned 1 [0138.014] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk", lpFilePart=0x0) returned 0x49 [0138.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.014] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xl0iev_.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.014] GetFileType (hFile=0x154) returned 0x1 [0138.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.014] GetFileType (hFile=0x154) returned 0x1 [0138.014] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe15 [0138.014] ReadFile (in: hFile=0x154, lpBuffer=0x1a1af38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a1af38*, lpNumberOfBytesRead=0x2ae404*=0xe15, lpOverlapped=0x0) returned 1 [0138.015] CloseHandle (hObject=0x154) returned 1 [0138.027] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk", lpFilePart=0x0) returned 0x49 [0138.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.028] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xl0iev_.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.029] GetFileType (hFile=0x154) returned 0x1 [0138.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.029] GetFileType (hFile=0x154) returned 0x1 [0138.029] WriteFile (in: hFile=0x154, lpBuffer=0x1a6d500*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a6d500*, lpNumberOfBytesWritten=0x2ae3cc*=0xe20, lpOverlapped=0x0) returned 1 [0138.030] CloseHandle (hObject=0x154) returned 1 [0138.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk", lpFilePart=0x0) returned 0x49 [0138.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk.anonymous", lpFilePart=0x0) returned 0x53 [0138.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xl0iev_.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa355f10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaa355f10, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf13584d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe20)) returned 1 [0138.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.030] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xl0iev_.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xl0iEv_.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xl0iev_.flv.lnk.anonymous")) returned 1 [0138.031] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk", lpFilePart=0x0) returned 0x43 [0138.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.032] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xob7x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.032] GetFileType (hFile=0x154) returned 0x1 [0138.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.032] GetFileType (hFile=0x154) returned 0x1 [0138.032] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x96d [0138.032] ReadFile (in: hFile=0x154, lpBuffer=0x1a6f1b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a6f1b4*, lpNumberOfBytesRead=0x2ae404*=0x96d, lpOverlapped=0x0) returned 1 [0138.033] CloseHandle (hObject=0x154) returned 1 [0138.045] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk", lpFilePart=0x0) returned 0x43 [0138.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.045] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xob7x.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.047] GetFileType (hFile=0x154) returned 0x1 [0138.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.047] GetFileType (hFile=0x154) returned 0x1 [0138.047] WriteFile (in: hFile=0x154, lpBuffer=0x1abffec*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1abffec*, lpNumberOfBytesWritten=0x2ae3cc*=0x970, lpOverlapped=0x0) returned 1 [0138.048] CloseHandle (hObject=0x154) returned 1 [0138.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk", lpFilePart=0x0) returned 0x43 [0138.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk.anonymous", lpFilePart=0x0) returned 0x4d [0138.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.048] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xob7x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd5b750, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadd5b750, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf137e630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x970)) returned 1 [0138.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.049] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xob7x.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xoB7x.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xob7x.lnk.anonymous")) returned 1 [0138.050] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk", lpFilePart=0x0) returned 0x42 [0138.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.050] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xqoc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.050] GetFileType (hFile=0x154) returned 0x1 [0138.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.050] GetFileType (hFile=0x154) returned 0x1 [0138.050] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x12c7 [0138.050] ReadFile (in: hFile=0x154, lpBuffer=0x1ac1300, nNumberOfBytesToRead=0x12c7, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac1300*, lpNumberOfBytesRead=0x2ae404*=0x12c7, lpOverlapped=0x0) returned 1 [0138.051] CloseHandle (hObject=0x154) returned 1 [0138.063] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk", lpFilePart=0x0) returned 0x42 [0138.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.063] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xqoc.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.064] GetFileType (hFile=0x154) returned 0x1 [0138.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.064] GetFileType (hFile=0x154) returned 0x1 [0138.064] WriteFile (in: hFile=0x154, lpBuffer=0x1b13efc*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b13efc*, lpNumberOfBytesWritten=0x2ae3f8*=0x12d0, lpOverlapped=0x0) returned 1 [0138.066] CloseHandle (hObject=0x154) returned 1 [0138.066] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk", lpFilePart=0x0) returned 0x42 [0138.066] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk.anonymous", lpFilePart=0x0) returned 0x4c [0138.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xqoc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad4ba790, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad4ba790, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf13a4790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12d0)) returned 1 [0138.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.066] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xqoc.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xqOc.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xqoc.lnk.anonymous")) returned 1 [0138.067] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk", lpFilePart=0x0) returned 0x47 [0138.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.067] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xwelhsmo2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.067] GetFileType (hFile=0x154) returned 0x1 [0138.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.067] GetFileType (hFile=0x154) returned 0x1 [0138.067] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3af [0138.067] ReadFile (in: hFile=0x154, lpBuffer=0x1b159bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b159bc*, lpNumberOfBytesRead=0x2ae404*=0x3af, lpOverlapped=0x0) returned 1 [0138.068] CloseHandle (hObject=0x154) returned 1 [0138.082] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk", lpFilePart=0x0) returned 0x47 [0138.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.082] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xwelhsmo2.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.084] GetFileType (hFile=0x154) returned 0x1 [0138.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.084] GetFileType (hFile=0x154) returned 0x1 [0138.084] WriteFile (in: hFile=0x154, lpBuffer=0x1b64b44*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b64b44*, lpNumberOfBytesWritten=0x2ae3cc*=0x3b0, lpOverlapped=0x0) returned 1 [0138.085] CloseHandle (hObject=0x154) returned 1 [0138.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk", lpFilePart=0x0) returned 0x47 [0138.085] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0138.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xwelhsmo2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac992070, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac992070, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf13f0a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0138.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.085] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xwelhsmo2.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xwElHSMO2.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\xwelhsmo2.lnk.anonymous")) returned 1 [0138.086] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk", lpFilePart=0x0) returned 0x45 [0138.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.086] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yej_g4v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.087] GetFileType (hFile=0x154) returned 0x1 [0138.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.087] GetFileType (hFile=0x154) returned 0x1 [0138.087] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x20b [0138.087] ReadFile (in: hFile=0x154, lpBuffer=0x1b66090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b66090*, lpNumberOfBytesRead=0x2ae404*=0x20b, lpOverlapped=0x0) returned 1 [0138.088] CloseHandle (hObject=0x154) returned 1 [0138.126] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk", lpFilePart=0x0) returned 0x45 [0138.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.126] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yej_g4v.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.128] GetFileType (hFile=0x154) returned 0x1 [0138.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.128] GetFileType (hFile=0x154) returned 0x1 [0138.128] WriteFile (in: hFile=0x154, lpBuffer=0x19b5494*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19b5494*, lpNumberOfBytesWritten=0x2ae3cc*=0x210, lpOverlapped=0x0) returned 1 [0138.129] CloseHandle (hObject=0x154) returned 1 [0138.129] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk", lpFilePart=0x0) returned 0x45 [0138.129] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk.anonymous", lpFilePart=0x0) returned 0x4f [0138.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yej_g4v.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaad73c90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaad73c90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1462e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0138.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.129] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yej_g4v.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEj_g4V.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yej_g4v.lnk.anonymous")) returned 1 [0138.130] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk", lpFilePart=0x0) returned 0x47 [0138.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.130] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yetfuyz0w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.131] GetFileType (hFile=0x154) returned 0x1 [0138.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.131] GetFileType (hFile=0x154) returned 0x1 [0138.131] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x999 [0138.131] ReadFile (in: hFile=0x154, lpBuffer=0x19b716c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19b716c*, lpNumberOfBytesRead=0x2ae404*=0x999, lpOverlapped=0x0) returned 1 [0138.132] CloseHandle (hObject=0x154) returned 1 [0138.145] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk", lpFilePart=0x0) returned 0x47 [0138.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.145] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yetfuyz0w.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.147] GetFileType (hFile=0x154) returned 0x1 [0138.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.147] GetFileType (hFile=0x154) returned 0x1 [0138.147] WriteFile (in: hFile=0x154, lpBuffer=0x1a08204*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a08204*, lpNumberOfBytesWritten=0x2ae3cc*=0x9a0, lpOverlapped=0x0) returned 1 [0138.148] CloseHandle (hObject=0x154) returned 1 [0138.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk", lpFilePart=0x0) returned 0x47 [0138.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk.anonymous", lpFilePart=0x0) returned 0x51 [0138.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yetfuyz0w.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b04a70, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa7b04a70, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1488fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0138.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.148] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yetfuyz0w.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YEtfuyZ0w.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yetfuyz0w.lnk.anonymous")) returned 1 [0138.149] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk", lpFilePart=0x0) returned 0x4e [0138.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.149] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ynatgjs775iicskj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.150] GetFileType (hFile=0x154) returned 0x1 [0138.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.150] GetFileType (hFile=0x154) returned 0x1 [0138.150] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23a [0138.150] ReadFile (in: hFile=0x154, lpBuffer=0x1a097a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a097a8*, lpNumberOfBytesRead=0x2ae404*=0x23a, lpOverlapped=0x0) returned 1 [0138.151] CloseHandle (hObject=0x154) returned 1 [0138.163] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk", lpFilePart=0x0) returned 0x4e [0138.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.163] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ynatgjs775iicskj.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.164] GetFileType (hFile=0x154) returned 0x1 [0138.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.164] GetFileType (hFile=0x154) returned 0x1 [0138.164] WriteFile (in: hFile=0x154, lpBuffer=0x1a58224*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a58224*, lpNumberOfBytesWritten=0x2ae3cc*=0x240, lpOverlapped=0x0) returned 1 [0138.165] CloseHandle (hObject=0x154) returned 1 [0138.166] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk", lpFilePart=0x0) returned 0x4e [0138.166] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk.anonymous", lpFilePart=0x0) returned 0x58 [0138.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ynatgjs775iicskj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd355f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadd355f0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf14af130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240)) returned 1 [0138.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.166] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ynatgjs775iicskj.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yNATGJs775IICSKJ.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\ynatgjs775iicskj.lnk.anonymous")) returned 1 [0138.185] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk", lpFilePart=0x0) returned 0x4a [0138.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.185] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yzk-q78cj c2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.186] GetFileType (hFile=0x154) returned 0x1 [0138.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.186] GetFileType (hFile=0x154) returned 0x1 [0138.186] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1303 [0138.186] ReadFile (in: hFile=0x154, lpBuffer=0x1a595a0, nNumberOfBytesToRead=0x1303, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a595a0*, lpNumberOfBytesRead=0x2ae404*=0x1303, lpOverlapped=0x0) returned 1 [0138.187] CloseHandle (hObject=0x154) returned 1 [0138.200] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk", lpFilePart=0x0) returned 0x4a [0138.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.201] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yzk-q78cj c2.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.202] GetFileType (hFile=0x154) returned 0x1 [0138.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.202] GetFileType (hFile=0x154) returned 0x1 [0138.202] WriteFile (in: hFile=0x154, lpBuffer=0x1aac2dc*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aac2dc*, lpNumberOfBytesWritten=0x2ae3f8*=0x1310, lpOverlapped=0x0) returned 1 [0138.204] CloseHandle (hObject=0x154) returned 1 [0138.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk", lpFilePart=0x0) returned 0x4a [0138.204] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk.anonymous", lpFilePart=0x0) returned 0x54 [0138.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yzk-q78cj c2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad102530, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xad233030, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf14fb3f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1310)) returned 1 [0138.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.205] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yzk-q78cj c2.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZk-Q78Cj c2.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\yzk-q78cj c2.lnk.anonymous")) returned 1 [0138.206] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk", lpFilePart=0x0) returned 0x4f [0138.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.206] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\y_qez0yxztfra0b-g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.206] GetFileType (hFile=0x154) returned 0x1 [0138.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.206] GetFileType (hFile=0x154) returned 0x1 [0138.206] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2705 [0138.206] ReadFile (in: hFile=0x154, lpBuffer=0x1aada90, nNumberOfBytesToRead=0x2705, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1aada90*, lpNumberOfBytesRead=0x2ae404*=0x2705, lpOverlapped=0x0) returned 1 [0138.209] CloseHandle (hObject=0x154) returned 1 [0138.221] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk", lpFilePart=0x0) returned 0x4f [0138.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.222] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\y_qez0yxztfra0b-g.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.224] GetFileType (hFile=0x154) returned 0x1 [0138.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.224] GetFileType (hFile=0x154) returned 0x1 [0138.224] WriteFile (in: hFile=0x154, lpBuffer=0x1b06bcc*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b06bcc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2710, lpOverlapped=0x0) returned 1 [0138.225] CloseHandle (hObject=0x154) returned 1 [0138.225] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk", lpFilePart=0x0) returned 0x4f [0138.225] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk.anonymous", lpFilePart=0x0) returned 0x59 [0138.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\y_qez0yxztfra0b-g.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbcd510, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xacbcd510, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf15476b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2710)) returned 1 [0138.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.225] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\y_qez0yxztfra0b-g.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_qeZ0YxZTFRA0b-g.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\y_qez0yxztfra0b-g.lnk.anonymous")) returned 1 [0138.227] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk", lpFilePart=0x0) returned 0x42 [0138.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.227] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\z9jm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.227] GetFileType (hFile=0x154) returned 0x1 [0138.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.227] GetFileType (hFile=0x154) returned 0x1 [0138.227] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2681 [0138.227] ReadFile (in: hFile=0x154, lpBuffer=0x1b09778, nNumberOfBytesToRead=0x2681, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b09778*, lpNumberOfBytesRead=0x2ae404*=0x2681, lpOverlapped=0x0) returned 1 [0138.228] CloseHandle (hObject=0x154) returned 1 [0138.241] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk", lpFilePart=0x0) returned 0x42 [0138.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.241] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\z9jm.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.242] GetFileType (hFile=0x154) returned 0x1 [0138.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.242] GetFileType (hFile=0x154) returned 0x1 [0138.242] WriteFile (in: hFile=0x154, lpBuffer=0x1b62634*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b62634*, lpNumberOfBytesWritten=0x2ae3f8*=0x2690, lpOverlapped=0x0) returned 1 [0138.244] CloseHandle (hObject=0x154) returned 1 [0138.244] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk", lpFilePart=0x0) returned 0x42 [0138.244] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk.anonymous", lpFilePart=0x0) returned 0x4c [0138.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\z9jm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dfad90, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xa9dfad90, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf156d810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2690)) returned 1 [0138.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.244] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\z9jm.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z9JM.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\z9jm.lnk.anonymous")) returned 1 [0138.245] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk", lpFilePart=0x0) returned 0x51 [0138.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.245] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zjoboq_-gg2cnqk9zfn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.246] GetFileType (hFile=0x154) returned 0x1 [0138.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.246] GetFileType (hFile=0x154) returned 0x1 [0138.246] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xa07 [0138.246] ReadFile (in: hFile=0x154, lpBuffer=0x1b65b34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b65b34*, lpNumberOfBytesRead=0x2ae404*=0xa07, lpOverlapped=0x0) returned 1 [0138.247] CloseHandle (hObject=0x154) returned 1 [0138.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk", lpFilePart=0x0) returned 0x51 [0138.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.287] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zjoboq_-gg2cnqk9zfn.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.288] GetFileType (hFile=0x154) returned 0x1 [0138.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.288] GetFileType (hFile=0x154) returned 0x1 [0138.288] WriteFile (in: hFile=0x154, lpBuffer=0x19b74e0*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x19b74e0*, lpNumberOfBytesWritten=0x2ae3cc*=0xa10, lpOverlapped=0x0) returned 1 [0138.289] CloseHandle (hObject=0x154) returned 1 [0138.290] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk", lpFilePart=0x0) returned 0x51 [0138.290] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk.anonymous", lpFilePart=0x0) returned 0x5b [0138.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zjoboq_-gg2cnqk9zfn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac293fd0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xac293fd0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf15dfc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa10)) returned 1 [0138.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.290] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zjoboq_-gg2cnqk9zfn.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJoBOQ_-GG2CNqK9zfN.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zjoboq_-gg2cnqk9zfn.lnk.anonymous")) returned 1 [0138.291] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk", lpFilePart=0x0) returned 0x4d [0138.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.291] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zx22w9jelux.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.291] GetFileType (hFile=0x154) returned 0x1 [0138.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.291] GetFileType (hFile=0x154) returned 0x1 [0138.291] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xe63 [0138.291] ReadFile (in: hFile=0x154, lpBuffer=0x19b96e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19b96e0*, lpNumberOfBytesRead=0x2ae404*=0xe63, lpOverlapped=0x0) returned 1 [0138.292] CloseHandle (hObject=0x154) returned 1 [0138.305] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk", lpFilePart=0x0) returned 0x4d [0138.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.305] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zx22w9jelux.flv.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.306] GetFileType (hFile=0x154) returned 0x1 [0138.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.306] GetFileType (hFile=0x154) returned 0x1 [0138.306] WriteFile (in: hFile=0x154, lpBuffer=0x1a0bfa8*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a0bfa8*, lpNumberOfBytesWritten=0x2ae3cc*=0xe70, lpOverlapped=0x0) returned 1 [0138.308] CloseHandle (hObject=0x154) returned 1 [0138.308] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk", lpFilePart=0x0) returned 0x4d [0138.308] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk.anonymous", lpFilePart=0x0) returned 0x57 [0138.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zx22w9jelux.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb6c570, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xadb6c570, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1605d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe70)) returned 1 [0138.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.308] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zx22w9jelux.flv.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZX22W9JelUx.flv.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\zx22w9jelux.flv.lnk.anonymous")) returned 1 [0138.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk", lpFilePart=0x0) returned 0x4b [0138.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.309] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_khm5u cafro.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.309] GetFileType (hFile=0x154) returned 0x1 [0138.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.309] GetFileType (hFile=0x154) returned 0x1 [0138.309] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x94f [0138.310] ReadFile (in: hFile=0x154, lpBuffer=0x1a0dc74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a0dc74*, lpNumberOfBytesRead=0x2ae404*=0x94f, lpOverlapped=0x0) returned 1 [0138.310] CloseHandle (hObject=0x154) returned 1 [0138.323] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk", lpFilePart=0x0) returned 0x4b [0138.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.323] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_khm5u cafro.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.324] GetFileType (hFile=0x154) returned 0x1 [0138.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.324] GetFileType (hFile=0x154) returned 0x1 [0138.324] WriteFile (in: hFile=0x154, lpBuffer=0x1a5ea2c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1a5ea2c*, lpNumberOfBytesWritten=0x2ae3cc*=0x950, lpOverlapped=0x0) returned 1 [0138.326] CloseHandle (hObject=0x154) returned 1 [0138.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk", lpFilePart=0x0) returned 0x4b [0138.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0138.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_khm5u cafro.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73482f0, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xaf2a1bf0, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf162bef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x950)) returned 1 [0138.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.326] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_khm5u cafro.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_khM5U CAfRO.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_khm5u cafro.lnk.anonymous")) returned 1 [0138.327] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk", lpFilePart=0x0) returned 0x50 [0138.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.327] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_ooyy v orzkyirwom.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.327] GetFileType (hFile=0x154) returned 0x1 [0138.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.327] GetFileType (hFile=0x154) returned 0x1 [0138.327] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xde5 [0138.328] ReadFile (in: hFile=0x154, lpBuffer=0x1a60b9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a60b9c*, lpNumberOfBytesRead=0x2ae404*=0xde5, lpOverlapped=0x0) returned 1 [0138.329] CloseHandle (hObject=0x154) returned 1 [0138.343] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk", lpFilePart=0x0) returned 0x50 [0138.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.343] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_ooyy v orzkyirwom.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.344] GetFileType (hFile=0x154) returned 0x1 [0138.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.344] GetFileType (hFile=0x154) returned 0x1 [0138.344] WriteFile (in: hFile=0x154, lpBuffer=0x1ab3094*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1ab3094*, lpNumberOfBytesWritten=0x2ae3cc*=0xdf0, lpOverlapped=0x0) returned 1 [0138.346] CloseHandle (hObject=0x154) returned 1 [0138.346] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk", lpFilePart=0x0) returned 0x50 [0138.346] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk.anonymous", lpFilePart=0x0) returned 0x5a [0138.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_ooyy v orzkyirwom.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7289c10, ftCreationTime.dwHighDateTime=0x1d45265, ftLastAccessTime.dwLowDateTime=0xada87d30, ftLastAccessTime.dwHighDateTime=0x1d45265, ftLastWriteTime.dwLowDateTime=0xf1652050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdf0)) returned 1 [0138.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.346] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_ooyy v orzkyirwom.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_OoYy V oRzKyIRWOM.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\recent\\_ooyy v orzkyirwom.lnk.anonymous")) returned 1 [0138.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0138.347] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x4f [0138.347] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x50 [0138.347] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0138.347] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.347] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.348] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.348] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.348] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.348] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0138.348] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0138.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0138.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0138.348] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x4f [0138.348] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x50 [0138.348] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0138.348] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.349] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.349] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.349] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.349] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.349] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0138.349] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0138.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0138.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0138.349] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4c [0138.349] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x4d [0138.350] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0138.351] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0138.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0138.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0138.352] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4c [0138.352] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x4d [0138.353] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0138.355] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0138.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0138.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.356] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39 [0138.356] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x3a [0138.356] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0138.357] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.357] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.357] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.357] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.357] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.357] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.358] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.358] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.358] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0138.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.359] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39 [0138.359] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x3a [0138.359] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0138.360] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.360] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.360] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.360] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.361] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.361] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.361] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.361] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.361] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0138.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.362] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFilePart=0x0) returned 0x4b [0138.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.362] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.364] GetFileType (hFile=0x154) returned 0x1 [0138.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.364] GetFileType (hFile=0x154) returned 0x1 [0138.364] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4d6 [0138.364] ReadFile (in: hFile=0x154, lpBuffer=0x1abdbe4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1abdbe4*, lpNumberOfBytesRead=0x2ae404*=0x4d6, lpOverlapped=0x0) returned 1 [0138.366] CloseHandle (hObject=0x154) returned 1 [0138.378] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFilePart=0x0) returned 0x4b [0138.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0138.378] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.380] GetFileType (hFile=0x154) returned 0x1 [0138.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0138.380] GetFileType (hFile=0x154) returned 0x1 [0138.380] WriteFile (in: hFile=0x154, lpBuffer=0x1b0d374*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2ae3cc, lpOverlapped=0x0 | out: lpBuffer=0x1b0d374*, lpNumberOfBytesWritten=0x2ae3cc*=0x4e0, lpOverlapped=0x0) returned 1 [0138.381] CloseHandle (hObject=0x154) returned 1 [0138.381] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFilePart=0x0) returned 0x4b [0138.381] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.anonymous", lpFilePart=0x0) returned 0x55 [0138.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0138.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8f30fb0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f30fb0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf16c4470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0138.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.381] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.anonymous")) returned 1 [0138.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d [0138.383] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x3e [0138.383] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf098 [0138.383] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.383] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.384] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.384] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.384] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0138.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.384] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d [0138.384] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x3e [0138.384] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf098 [0138.384] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.385] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.385] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.385] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.385] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0138.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0138.385] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46 [0138.385] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x47 [0138.385] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf098 [0138.386] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.386] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.386] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.386] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.386] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.387] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.387] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.387] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0138.387] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0138.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0138.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0138.387] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46 [0138.387] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x47 [0138.387] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf098 [0138.388] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.388] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.388] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.388] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.388] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.389] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.389] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0138.389] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0138.389] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0138.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0138.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0138.389] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x5c [0138.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0138.389] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.390] GetFileType (hFile=0x154) returned 0x1 [0138.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0138.390] GetFileType (hFile=0x154) returned 0x1 [0138.390] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x58b [0138.390] ReadFile (in: hFile=0x154, lpBuffer=0x1b133e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b133e8*, lpNumberOfBytesRead=0x2ae390*=0x58b, lpOverlapped=0x0) returned 1 [0138.393] CloseHandle (hObject=0x154) returned 1 [0138.407] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x5c [0138.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0138.407] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.409] GetFileType (hFile=0x154) returned 0x1 [0138.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0138.409] GetFileType (hFile=0x154) returned 0x1 [0138.410] WriteFile (in: hFile=0x154, lpBuffer=0x1b62f10*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b62f10*, lpNumberOfBytesWritten=0x2ae358*=0x590, lpOverlapped=0x0) returned 1 [0138.411] CloseHandle (hObject=0x154) returned 1 [0138.411] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x5c [0138.411] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x66 [0138.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0138.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0xccc88f0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1710730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0138.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.411] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.anonymous")) returned 1 [0138.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52 [0138.413] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x53 [0138.413] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0138.413] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.413] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.413] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.414] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.414] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.414] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.414] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.414] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.414] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.414] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0138.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.414] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52 [0138.414] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x53 [0138.414] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.415] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.416] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.416] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0138.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.416] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFilePart=0x0) returned 0x65 [0138.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0138.416] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.417] GetFileType (hFile=0x154) returned 0x1 [0138.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0138.417] GetFileType (hFile=0x154) returned 0x1 [0138.417] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x500 [0138.417] ReadFile (in: hFile=0x154, lpBuffer=0x1b67dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b67dc0*, lpNumberOfBytesRead=0x2ae31c*=0x500, lpOverlapped=0x0) returned 1 [0138.418] CloseHandle (hObject=0x154) returned 1 [0138.456] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFilePart=0x0) returned 0x65 [0138.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0138.456] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.458] GetFileType (hFile=0x154) returned 0x1 [0138.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0138.458] GetFileType (hFile=0x154) returned 0x1 [0138.459] WriteFile (in: hFile=0x154, lpBuffer=0x19b7f4c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x19b7f4c*, lpNumberOfBytesWritten=0x2ae2e4*=0x510, lpOverlapped=0x0) returned 1 [0138.460] CloseHandle (hObject=0x154) returned 1 [0138.460] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFilePart=0x0) returned 0x65 [0138.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.anonymous", lpFilePart=0x0) returned 0x6f [0138.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0138.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1782b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x510)) returned 1 [0138.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.461] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.anonymous")) returned 1 [0138.463] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFilePart=0x0) returned 0x5e [0138.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0138.463] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.464] GetFileType (hFile=0x154) returned 0x1 [0138.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0138.464] GetFileType (hFile=0x154) returned 0x1 [0138.464] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x518 [0138.464] ReadFile (in: hFile=0x154, lpBuffer=0x19b98a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x19b98a4*, lpNumberOfBytesRead=0x2ae31c*=0x518, lpOverlapped=0x0) returned 1 [0138.482] CloseHandle (hObject=0x154) returned 1 [0138.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFilePart=0x0) returned 0x5e [0138.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0138.495] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.496] GetFileType (hFile=0x154) returned 0x1 [0138.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0138.496] GetFileType (hFile=0x154) returned 0x1 [0138.496] WriteFile (in: hFile=0x154, lpBuffer=0x1a092e8*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a092e8*, lpNumberOfBytesWritten=0x2ae2e4*=0x520, lpOverlapped=0x0) returned 1 [0138.497] CloseHandle (hObject=0x154) returned 1 [0138.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFilePart=0x0) returned 0x5e [0138.498] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.anonymous", lpFilePart=0x0) returned 0x68 [0138.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0138.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf17cee10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0138.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.498] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.anonymous")) returned 1 [0138.499] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFilePart=0x0) returned 0x5a [0138.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0138.499] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.500] GetFileType (hFile=0x154) returned 0x1 [0138.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0138.500] GetFileType (hFile=0x154) returned 0x1 [0138.500] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x106 [0138.500] ReadFile (in: hFile=0x154, lpBuffer=0x1a0a7e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a0a7e4*, lpNumberOfBytesRead=0x2ae31c*=0x106, lpOverlapped=0x0) returned 1 [0138.502] CloseHandle (hObject=0x154) returned 1 [0138.521] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFilePart=0x0) returned 0x5a [0138.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0138.521] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.523] GetFileType (hFile=0x154) returned 0x1 [0138.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0138.524] GetFileType (hFile=0x154) returned 0x1 [0138.524] WriteFile (in: hFile=0x154, lpBuffer=0x1a58c70*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1a58c70*, lpNumberOfBytesWritten=0x2ae2e4*=0x110, lpOverlapped=0x0) returned 1 [0138.525] CloseHandle (hObject=0x154) returned 1 [0138.525] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFilePart=0x0) returned 0x5a [0138.525] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.anonymous", lpFilePart=0x0) returned 0x64 [0138.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0138.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf181b0d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0138.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.525] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.anonymous")) returned 1 [0138.527] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x67 [0138.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0138.527] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.528] GetFileType (hFile=0x154) returned 0x1 [0138.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0138.528] GetFileType (hFile=0x154) returned 0x1 [0138.528] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x4cc [0138.528] ReadFile (in: hFile=0x154, lpBuffer=0x1a5a54c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1a5a54c*, lpNumberOfBytesRead=0x2ae31c*=0x4cc, lpOverlapped=0x0) returned 1 [0138.530] CloseHandle (hObject=0x154) returned 1 [0138.545] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x67 [0138.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0138.545] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.547] GetFileType (hFile=0x154) returned 0x1 [0138.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0138.548] GetFileType (hFile=0x154) returned 0x1 [0138.548] WriteFile (in: hFile=0x154, lpBuffer=0x1aa9cc4*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1aa9cc4*, lpNumberOfBytesWritten=0x2ae2e4*=0x4d0, lpOverlapped=0x0) returned 1 [0138.549] CloseHandle (hObject=0x154) returned 1 [0138.549] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x67 [0138.550] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.anonymous", lpFilePart=0x0) returned 0x71 [0138.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0138.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1841230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0138.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.550] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.anonymous")) returned 1 [0138.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0138.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x60 [0138.552] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x61 [0138.552] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf2d8 [0138.552] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.552] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.552] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.552] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.552] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.553] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.553] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0138.553] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0138.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0138.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0138.553] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x60 [0138.553] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x61 [0138.553] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf2d8 [0138.553] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.554] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.554] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.554] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.554] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.554] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.554] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0138.554] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0138.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0138.555] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFilePart=0x0) returned 0x73 [0138.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.555] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.555] GetFileType (hFile=0x154) returned 0x1 [0138.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.555] GetFileType (hFile=0x154) returned 0x1 [0138.555] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x54e [0138.555] ReadFile (in: hFile=0x154, lpBuffer=0x1aae924, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1aae924*, lpNumberOfBytesRead=0x2ae2a8*=0x54e, lpOverlapped=0x0) returned 1 [0138.557] CloseHandle (hObject=0x154) returned 1 [0138.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFilePart=0x0) returned 0x73 [0138.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.571] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.573] GetFileType (hFile=0x154) returned 0x1 [0138.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.574] GetFileType (hFile=0x154) returned 0x1 [0138.574] WriteFile (in: hFile=0x154, lpBuffer=0x1afe330*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1afe330*, lpNumberOfBytesWritten=0x2ae270*=0x550, lpOverlapped=0x0) returned 1 [0138.575] CloseHandle (hObject=0x154) returned 1 [0138.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFilePart=0x0) returned 0x73 [0138.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.anonymous", lpFilePart=0x0) returned 0x7d [0138.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf188d4f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0138.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.576] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.anonymous")) returned 1 [0138.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFilePart=0x0) returned 0x6c [0138.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.578] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.579] GetFileType (hFile=0x154) returned 0x1 [0138.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.579] GetFileType (hFile=0x154) returned 0x1 [0138.579] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4ea [0138.579] ReadFile (in: hFile=0x154, lpBuffer=0x1affcb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1affcb4*, lpNumberOfBytesRead=0x2ae2a8*=0x4ea, lpOverlapped=0x0) returned 1 [0138.583] CloseHandle (hObject=0x154) returned 1 [0138.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFilePart=0x0) returned 0x6c [0138.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.597] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.600] GetFileType (hFile=0x154) returned 0x1 [0138.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.600] GetFileType (hFile=0x154) returned 0x1 [0138.600] WriteFile (in: hFile=0x154, lpBuffer=0x1b4f4c8*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b4f4c8*, lpNumberOfBytesWritten=0x2ae270*=0x4f0, lpOverlapped=0x0) returned 1 [0138.602] CloseHandle (hObject=0x154) returned 1 [0138.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFilePart=0x0) returned 0x6c [0138.603] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.anonymous", lpFilePart=0x0) returned 0x76 [0138.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf18d97b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0138.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.603] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.anonymous")) returned 1 [0138.605] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFilePart=0x0) returned 0x6d [0138.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.605] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.606] GetFileType (hFile=0x154) returned 0x1 [0138.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.606] GetFileType (hFile=0x154) returned 0x1 [0138.606] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4ee [0138.606] ReadFile (in: hFile=0x154, lpBuffer=0x1b50e30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1b50e30*, lpNumberOfBytesRead=0x2ae2a8*=0x4ee, lpOverlapped=0x0) returned 1 [0138.607] CloseHandle (hObject=0x154) returned 1 [0138.655] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFilePart=0x0) returned 0x6d [0138.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.655] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.657] GetFileType (hFile=0x154) returned 0x1 [0138.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.657] GetFileType (hFile=0x154) returned 0x1 [0138.657] WriteFile (in: hFile=0x154, lpBuffer=0x19a0c0c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19a0c0c*, lpNumberOfBytesWritten=0x2ae270*=0x4f0, lpOverlapped=0x0) returned 1 [0138.659] CloseHandle (hObject=0x154) returned 1 [0138.659] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFilePart=0x0) returned 0x6d [0138.659] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.anonymous", lpFilePart=0x0) returned 0x77 [0138.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1971d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0138.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.659] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.anonymous")) returned 1 [0138.662] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFilePart=0x0) returned 0x77 [0138.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.662] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.662] GetFileType (hFile=0x154) returned 0x1 [0138.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.662] GetFileType (hFile=0x154) returned 0x1 [0138.662] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x4e2 [0138.662] ReadFile (in: hFile=0x154, lpBuffer=0x19a2590, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19a2590*, lpNumberOfBytesRead=0x2ae2a8*=0x4e2, lpOverlapped=0x0) returned 1 [0138.666] CloseHandle (hObject=0x154) returned 1 [0138.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFilePart=0x0) returned 0x77 [0138.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.685] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.687] GetFileType (hFile=0x154) returned 0x1 [0138.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.687] GetFileType (hFile=0x154) returned 0x1 [0138.687] WriteFile (in: hFile=0x154, lpBuffer=0x19f1f34*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x19f1f34*, lpNumberOfBytesWritten=0x2ae270*=0x4f0, lpOverlapped=0x0) returned 1 [0138.689] CloseHandle (hObject=0x154) returned 1 [0138.689] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFilePart=0x0) returned 0x77 [0138.689] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.anonymous", lpFilePart=0x0) returned 0x81 [0138.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1997e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4f0)) returned 1 [0138.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.689] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.anonymous")) returned 1 [0138.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0138.691] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x5f [0138.691] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x60 [0138.691] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0138.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.693] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0138.693] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0138.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0138.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0138.693] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x5f [0138.693] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x60 [0138.693] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0138.693] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.694] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.694] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.694] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.694] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.694] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0138.695] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0138.695] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0138.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0138.695] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFilePart=0x0) returned 0x6c [0138.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.695] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.696] GetFileType (hFile=0x154) returned 0x1 [0138.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.696] GetFileType (hFile=0x154) returned 0x1 [0138.696] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x106 [0138.696] ReadFile (in: hFile=0x154, lpBuffer=0x19f68c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x19f68c0*, lpNumberOfBytesRead=0x2ae2a8*=0x106, lpOverlapped=0x0) returned 1 [0138.700] CloseHandle (hObject=0x154) returned 1 [0138.721] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFilePart=0x0) returned 0x6c [0138.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.721] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.723] GetFileType (hFile=0x154) returned 0x1 [0138.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.723] GetFileType (hFile=0x154) returned 0x1 [0138.723] WriteFile (in: hFile=0x154, lpBuffer=0x1a44d7c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a44d7c*, lpNumberOfBytesWritten=0x2ae270*=0x110, lpOverlapped=0x0) returned 1 [0138.724] CloseHandle (hObject=0x154) returned 1 [0138.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFilePart=0x0) returned 0x6c [0138.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.anonymous", lpFilePart=0x0) returned 0x76 [0138.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1a0a2b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0138.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.724] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.anonymous")) returned 1 [0138.725] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFilePart=0x0) returned 0x71 [0138.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.726] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.726] GetFileType (hFile=0x154) returned 0x1 [0138.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.726] GetFileType (hFile=0x154) returned 0x1 [0138.726] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x106 [0138.726] ReadFile (in: hFile=0x154, lpBuffer=0x1a4630c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a4630c*, lpNumberOfBytesRead=0x2ae2a8*=0x106, lpOverlapped=0x0) returned 1 [0138.728] CloseHandle (hObject=0x154) returned 1 [0138.740] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFilePart=0x0) returned 0x71 [0138.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.741] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.742] GetFileType (hFile=0x154) returned 0x1 [0138.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.743] GetFileType (hFile=0x154) returned 0x1 [0138.743] WriteFile (in: hFile=0x154, lpBuffer=0x1a947d8*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1a947d8*, lpNumberOfBytesWritten=0x2ae270*=0x110, lpOverlapped=0x0) returned 1 [0138.744] CloseHandle (hObject=0x154) returned 1 [0138.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFilePart=0x0) returned 0x71 [0138.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.anonymous", lpFilePart=0x0) returned 0x7b [0138.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1a30410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0138.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.744] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.anonymous")) returned 1 [0138.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFilePart=0x0) returned 0x82 [0138.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.746] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.746] GetFileType (hFile=0x154) returned 0x1 [0138.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.746] GetFileType (hFile=0x154) returned 0x1 [0138.746] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x5bd [0138.746] ReadFile (in: hFile=0x154, lpBuffer=0x1a96298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1a96298*, lpNumberOfBytesRead=0x2ae2a8*=0x5bd, lpOverlapped=0x0) returned 1 [0138.771] CloseHandle (hObject=0x154) returned 1 [0138.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFilePart=0x0) returned 0x82 [0138.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.788] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.790] GetFileType (hFile=0x154) returned 0x1 [0138.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.790] GetFileType (hFile=0x154) returned 0x1 [0138.790] WriteFile (in: hFile=0x154, lpBuffer=0x1ae5f14*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1ae5f14*, lpNumberOfBytesWritten=0x2ae270*=0x5c0, lpOverlapped=0x0) returned 1 [0138.792] CloseHandle (hObject=0x154) returned 1 [0138.792] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFilePart=0x0) returned 0x82 [0138.792] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.anonymous", lpFilePart=0x0) returned 0x8c [0138.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1aa2830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0138.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.793] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.anonymous")) returned 1 [0138.795] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFilePart=0x0) returned 0x7c [0138.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1f4) returned 1 [0138.795] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.796] GetFileType (hFile=0x154) returned 0x1 [0138.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1f0) returned 1 [0138.796] GetFileType (hFile=0x154) returned 0x1 [0138.796] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae2fc | out: lpFileSizeHigh=0x2ae2fc*=0x0) returned 0x51a [0138.796] ReadFile (in: hFile=0x154, lpBuffer=0x1ae796c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae2a8, lpOverlapped=0x0 | out: lpBuffer=0x1ae796c*, lpNumberOfBytesRead=0x2ae2a8*=0x51a, lpOverlapped=0x0) returned 1 [0138.798] CloseHandle (hObject=0x154) returned 1 [0138.817] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", nBufferLength=0x105, lpBuffer=0x2adcec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFilePart=0x0) returned 0x7c [0138.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1e0) returned 1 [0138.817] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.819] GetFileType (hFile=0x154) returned 0x1 [0138.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1dc) returned 1 [0138.819] GetFileType (hFile=0x154) returned 0x1 [0138.819] WriteFile (in: hFile=0x154, lpBuffer=0x1b372b4*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ae270, lpOverlapped=0x0 | out: lpBuffer=0x1b372b4*, lpNumberOfBytesWritten=0x2ae270*=0x520, lpOverlapped=0x0) returned 1 [0138.820] CloseHandle (hObject=0x154) returned 1 [0138.820] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFilePart=0x0) returned 0x7c [0138.821] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.anonymous", lpFilePart=0x0) returned 0x86 [0138.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae280) returned 1 [0138.821] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae2fc | out: lpFileInformation=0x2ae2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1aeeaf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0138.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0138.821] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.anonymous")) returned 1 [0138.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.826] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5b [0138.826] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x5c [0138.826] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee58 [0138.826] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.827] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.827] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.827] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0138.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.827] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5b [0138.827] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x5c [0138.827] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee58 [0138.828] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.828] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.828] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.828] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0138.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.828] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52 [0138.828] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x53 [0138.829] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee58 [0138.829] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.829] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.829] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.829] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.829] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0138.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.830] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52 [0138.830] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x53 [0138.830] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee58 [0138.830] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.831] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.831] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.831] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.831] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0138.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.831] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", nBufferLength=0x105, lpBuffer=0x2add74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFilePart=0x0) returned 0x5b [0138.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae268) returned 1 [0138.831] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.832] GetFileType (hFile=0x154) returned 0x1 [0138.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae264) returned 1 [0138.832] GetFileType (hFile=0x154) returned 0x1 [0138.832] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae370 | out: lpFileSizeHigh=0x2ae370*=0x0) returned 0x106 [0138.832] ReadFile (in: hFile=0x154, lpBuffer=0x1b3c6c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae31c, lpOverlapped=0x0 | out: lpBuffer=0x1b3c6c4*, lpNumberOfBytesRead=0x2ae31c*=0x106, lpOverlapped=0x0) returned 1 [0138.836] CloseHandle (hObject=0x154) returned 1 [0138.902] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", nBufferLength=0x105, lpBuffer=0x2add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFilePart=0x0) returned 0x5b [0138.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae254) returned 1 [0138.903] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.906] GetFileType (hFile=0x154) returned 0x1 [0138.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae250) returned 1 [0138.907] GetFileType (hFile=0x154) returned 0x1 [0138.907] WriteFile (in: hFile=0x154, lpBuffer=0x1989da4*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ae2e4, lpOverlapped=0x0 | out: lpBuffer=0x1989da4*, lpNumberOfBytesWritten=0x2ae2e4*=0x110, lpOverlapped=0x0) returned 1 [0138.912] CloseHandle (hObject=0x154) returned 1 [0138.914] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFilePart=0x0) returned 0x5b [0138.914] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ade94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.anonymous", lpFilePart=0x0) returned 0x65 [0138.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2f4) returned 1 [0138.914] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae370 | out: lpFileInformation=0x2ae370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f0ae50, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8f0ae50, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1bd3330, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x110)) returned 1 [0138.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0138.915] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.anonymous")) returned 1 [0138.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4e [0138.918] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x4f [0138.918] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0138.918] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.919] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.919] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.919] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0138.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0138.919] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4e [0138.919] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x4f [0138.919] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbeb98 [0138.919] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.920] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0138.920] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0138.920] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0138.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0138.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0138.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.920] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3c [0138.920] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x3d [0138.920] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0138.921] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.921] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.921] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0138.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.921] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3c [0138.921] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x3d [0138.921] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0138.922] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.922] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.922] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0138.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.922] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x39 [0138.922] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x3a [0138.922] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0138.923] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.923] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.923] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.923] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0138.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0138.923] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x39 [0138.923] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x3a [0138.923] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0138.924] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.924] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0138.924] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0138.924] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0138.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0138.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0138.924] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51 [0138.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0138.924] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0138.925] GetFileType (hFile=0x154) returned 0x1 [0138.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0138.925] GetFileType (hFile=0x154) returned 0x1 [0138.925] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x9cfab [0138.929] ReadFile (in: hFile=0x154, lpBuffer=0x1fc1b358, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1fc1b358*, lpNumberOfBytesRead=0x2ae404*=0x9cfab, lpOverlapped=0x0) returned 1 [0138.963] CloseHandle (hObject=0x154) returned 1 [0139.055] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51 [0139.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0139.055] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.066] GetFileType (hFile=0x154) returned 0x1 [0139.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0139.067] GetFileType (hFile=0x154) returned 0x1 [0139.067] WriteFile (in: hFile=0x154, lpBuffer=0x1ff2c200*, nNumberOfBytesToWrite=0x9cfb0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ff2c200*, lpNumberOfBytesWritten=0x2ae3f8*=0x9cfb0, lpOverlapped=0x0) returned 1 [0139.100] CloseHandle (hObject=0x154) returned 1 [0139.100] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51 [0139.100] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.anonymous", lpFilePart=0x0) returned 0x5b [0139.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0139.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee4cf0, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8ee4cf0, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf1d9c3b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9cfb0)) returned 1 [0139.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0139.100] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.anonymous")) returned 1 [0139.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0139.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x2f [0139.101] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x30 [0139.101] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0139.102] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.102] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.102] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0139.102] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0139.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0139.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0139.102] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x2f [0139.102] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x30 [0139.103] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0139.103] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.103] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.103] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0139.103] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0139.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0139.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0139.103] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x37 [0139.103] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x38 [0139.103] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0139.104] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.104] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0139.104] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0139.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0139.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0139.104] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x37 [0139.104] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x38 [0139.104] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0139.104] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.104] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0139.104] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0139.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0139.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0139.105] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x28 [0139.105] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x29 [0139.105] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0139.105] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0139.105] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0139.105] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0139.106] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0139.106] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0139.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0139.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0139.106] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x28 [0139.106] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x29 [0139.106] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0139.106] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0139.106] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0139.106] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0139.106] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0139.106] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0139.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0139.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0139.107] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x33 [0139.107] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x34 [0139.107] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0139.108] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.108] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0139.108] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0139.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0139.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0139.109] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x33 [0139.109] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x34 [0139.109] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0139.109] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.109] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0139.109] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0139.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0139.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0139.109] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x30 [0139.109] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x31 [0139.109] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0139.110] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.110] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.110] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.110] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.110] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0139.110] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0139.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0139.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0139.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x30 [0139.110] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x31 [0139.110] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0139.111] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.111] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.111] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.111] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0139.111] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0139.111] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0139.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0139.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0139.111] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x3e [0139.111] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x3f [0139.112] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0139.112] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.112] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.112] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0139.112] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0139.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0139.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0139.112] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x3e [0139.112] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x3f [0139.113] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0139.113] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.113] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.113] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0139.113] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0139.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0139.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0139.114] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x39 [0139.114] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x3a [0139.114] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0139.114] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.114] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.114] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0139.115] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0139.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0139.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0139.115] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x39 [0139.115] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x3a [0139.115] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0139.115] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.115] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0139.115] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0139.116] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0139.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0139.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0139.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpFilePart=0x0) returned 0x4a [0139.116] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpFilePart=0x0) returned 0x4b [0139.116] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0139.148] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.158] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.158] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.159] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.160] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.161] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.162] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.162] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.162] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.162] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0139.162] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0139.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0139.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0139.163] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default", lpFilePart=0x0) returned 0x4a [0139.163] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\", lpFilePart=0x0) returned 0x4b [0139.163] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0139.164] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.165] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.165] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.165] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.165] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.165] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.165] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.166] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0139.167] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0139.167] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0139.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0139.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0139.169] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak", lpFilePart=0x0) returned 0x5b [0139.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0139.169] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\sessionstore.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.171] GetFileType (hFile=0x154) returned 0x1 [0139.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0139.172] GetFileType (hFile=0x154) returned 0x1 [0139.172] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x24b [0139.172] ReadFile (in: hFile=0x154, lpBuffer=0x19efac8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19efac8*, lpNumberOfBytesRead=0x2ae390*=0x24b, lpOverlapped=0x0) returned 1 [0139.173] CloseHandle (hObject=0x154) returned 1 [0139.214] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak", lpFilePart=0x0) returned 0x5b [0139.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0139.214] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\sessionstore.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.216] GetFileType (hFile=0x154) returned 0x1 [0139.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0139.217] GetFileType (hFile=0x154) returned 0x1 [0139.217] WriteFile (in: hFile=0x154, lpBuffer=0x1a3e5a4*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a3e5a4*, lpNumberOfBytesWritten=0x2ae358*=0x250, lpOverlapped=0x0) returned 1 [0139.218] CloseHandle (hObject=0x154) returned 1 [0139.218] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak", lpFilePart=0x0) returned 0x5b [0139.218] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak.anonymous", lpFilePart=0x0) returned 0x65 [0139.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0139.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\sessionstore.bak"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9c30810, ftCreationTime.dwHighDateTime=0x1d2fb2e, ftLastAccessTime.dwLowDateTime=0xe9c30810, ftLastAccessTime.dwHighDateTime=0x1d2fb2e, ftLastWriteTime.dwLowDateTime=0xf1ea6d50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0139.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.218] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\sessionstore.bak"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\sessionstore.bak.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\sessionstore.bak.anonymous")) returned 1 [0139.235] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt", lpFilePart=0x0) returned 0x60 [0139.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0139.235] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\urlclassifierkey3.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.236] GetFileType (hFile=0x154) returned 0x1 [0139.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0139.236] GetFileType (hFile=0x154) returned 0x1 [0139.236] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9a [0139.236] ReadFile (in: hFile=0x154, lpBuffer=0x1a3fa8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a3fa8c*, lpNumberOfBytesRead=0x2ae390*=0x9a, lpOverlapped=0x0) returned 1 [0139.237] CloseHandle (hObject=0x154) returned 1 [0139.253] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt", lpFilePart=0x0) returned 0x60 [0139.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0139.253] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\urlclassifierkey3.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.255] GetFileType (hFile=0x154) returned 0x1 [0139.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0139.255] GetFileType (hFile=0x154) returned 0x1 [0139.255] WriteFile (in: hFile=0x154, lpBuffer=0x1a8dc50*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1a8dc50*, lpNumberOfBytesWritten=0x2ae358*=0xa0, lpOverlapped=0x0) returned 1 [0139.256] CloseHandle (hObject=0x154) returned 1 [0139.256] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt", lpFilePart=0x0) returned 0x60 [0139.256] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt.anonymous", lpFilePart=0x0) returned 0x6a [0139.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0139.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\urlclassifierkey3.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8868ee60, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x8868ee60, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xf1f19170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1 [0139.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.256] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\urlclassifierkey3.txt"), lpNewFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\urlclassifierkey3.txt.anonymous" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\mozilla\\firefox\\profiles\\h231daer.default\\urlclassifierkey3.txt.anonymous")) returned 1 [0139.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.257] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpFilePart=0x0) returned 0x5a [0139.257] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x5b [0139.257] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.270] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.270] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.271] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.271] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.271] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.272] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups", lpFilePart=0x0) returned 0x5a [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x5b [0139.272] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\bookmarkbackups\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.274] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.274] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.274] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.274] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.274] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.275] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpFilePart=0x0) returned 0x57 [0139.275] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\", lpFilePart=0x0) returned 0x58 [0139.275] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.276] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.276] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.276] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.276] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport", lpFilePart=0x0) returned 0x57 [0139.276] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\", lpFilePart=0x0) returned 0x58 [0139.276] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\healthreport\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.276] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.276] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.277] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.277] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpFilePart=0x0) returned 0x54 [0139.277] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpFilePart=0x0) returned 0x55 [0139.277] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.277] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.277] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.277] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.277] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.278] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB", lpFilePart=0x0) returned 0x54 [0139.278] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\", lpFilePart=0x0) returned 0x55 [0139.278] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.278] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.278] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.278] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.278] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0139.278] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x68 [0139.278] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x69 [0139.278] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0139.279] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0139.279] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0139.279] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0139.279] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0139.279] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0139.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0139.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae330) returned 1 [0139.280] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x2ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x68 [0139.280] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x69 [0139.280] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf118 [0139.280] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0139.280] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0139.280] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 1 [0139.280] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae068 | out: lpFindFileData=0x2ae068) returned 0 [0139.280] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2f0) returned 1 [0139.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2fc) returned 1 [0139.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0139.280] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x6c [0139.280] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x6d [0139.281] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf118 [0139.286] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0139.286] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0139.286] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0139.286] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0139.286] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0139.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0139.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2bc) returned 1 [0139.288] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x2addc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x6c [0139.288] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x2add98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x6d [0139.288] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf118 [0139.290] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0139.290] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0139.290] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 1 [0139.290] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adff4 | out: lpFindFileData=0x2adff4) returned 0 [0139.290] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae27c) returned 1 [0139.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae288) returned 1 [0139.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0139.292] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x7f [0139.292] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x80 [0139.292] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf118 [0139.294] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0139.294] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0139.294] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0139.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0139.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae248) returned 1 [0139.294] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x2add50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x7f [0139.294] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x2add24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x80 [0139.294] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x2adf70 | out: lpFindFileData=0x2adf70) returned 0xbf118 [0139.294] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 1 [0139.294] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2adf80 | out: lpFindFileData=0x2adf80) returned 0 [0139.294] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae208) returned 1 [0139.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae214) returned 1 [0139.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.295] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpFilePart=0x0) returned 0x54 [0139.295] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\", lpFilePart=0x0) returned 0x55 [0139.295] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.296] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.296] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.296] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps", lpFilePart=0x0) returned 0x54 [0139.297] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\", lpFilePart=0x0) returned 0x55 [0139.297] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\minidumps\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.297] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.297] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.297] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpFilePart=0x0) returned 0x52 [0139.297] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\", lpFilePart=0x0) returned 0x53 [0139.297] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.297] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.298] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.298] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.298] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0139.298] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", nBufferLength=0x105, lpBuffer=0x2adeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps", lpFilePart=0x0) returned 0x52 [0139.298] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x2ade80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\", lpFilePart=0x0) returned 0x53 [0139.298] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\h231daer.default\\webapps\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf118 [0139.298] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.298] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 1 [0139.298] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae0dc | out: lpFindFileData=0x2ae0dc) returned 0 [0139.298] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0139.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0139.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0139.299] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Application Data", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Application Data", lpFilePart=0x0) returned 0x21 [0139.299] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Application Data\\", lpFilePart=0x0) returned 0x22 [0139.299] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Application Data\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0139.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0139.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0139.300] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Contacts", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Contacts", lpFilePart=0x0) returned 0x19 [0139.300] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Contacts\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Contacts\\", lpFilePart=0x0) returned 0x1a [0139.300] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Contacts\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0139.300] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.301] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0139.302] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0139.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0139.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0139.302] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Contacts", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Contacts", lpFilePart=0x0) returned 0x19 [0139.302] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Contacts\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Contacts\\", lpFilePart=0x0) returned 0x1a [0139.302] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Contacts\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0139.302] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.302] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.303] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.303] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.303] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.303] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.303] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.303] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.304] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0139.304] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0139.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0139.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0139.304] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Cookies", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Cookies", lpFilePart=0x0) returned 0x18 [0139.304] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Cookies\\", lpFilePart=0x0) returned 0x19 [0139.304] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Cookies\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0139.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0139.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0139.306] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop", lpFilePart=0x0) returned 0x18 [0139.306] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\", lpFilePart=0x0) returned 0x19 [0139.306] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0139.306] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.306] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.306] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.307] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.307] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.307] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.307] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.307] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.307] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.308] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.309] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.310] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.311] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.312] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.312] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0139.312] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0139.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0139.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0139.312] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop", lpFilePart=0x0) returned 0x18 [0139.312] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\", lpFilePart=0x0) returned 0x19 [0139.312] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0139.313] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.313] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.313] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.313] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.313] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.314] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.314] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.314] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.314] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.314] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.315] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.315] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.315] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.315] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.315] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.315] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.316] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.316] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.316] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.316] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.316] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.316] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.317] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.317] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.317] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.317] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.317] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.317] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.318] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.318] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.318] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.318] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.318] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0139.319] FindNextFileW (in: hFindFile=0xbf118, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0139.320] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0139.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0139.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0139.320] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3", lpFilePart=0x0) returned 0x2f [0139.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.320] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\1n_gar1md9i83q54rw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.320] GetFileType (hFile=0x154) returned 0x1 [0139.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.320] GetFileType (hFile=0x154) returned 0x1 [0139.320] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1410c [0139.320] ReadFile (in: hFile=0x154, lpBuffer=0x1aa92e8, nNumberOfBytesToRead=0x1410c, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1aa92e8*, lpNumberOfBytesRead=0x2ae5d4*=0x1410c, lpOverlapped=0x0) returned 1 [0139.322] CloseHandle (hObject=0x154) returned 1 [0139.375] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3", lpFilePart=0x0) returned 0x2f [0139.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.376] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\1n_gar1md9i83q54rw.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.382] GetFileType (hFile=0x154) returned 0x1 [0139.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.382] GetFileType (hFile=0x154) returned 0x1 [0139.382] WriteFile (in: hFile=0x154, lpBuffer=0x1b32414*, nNumberOfBytesToWrite=0x14110, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b32414*, lpNumberOfBytesWritten=0x2ae5c8*=0x14110, lpOverlapped=0x0) returned 1 [0139.385] CloseHandle (hObject=0x154) returned 1 [0139.385] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3", lpFilePart=0x0) returned 0x2f [0139.385] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3.anonymous", lpFilePart=0x0) returned 0x39 [0139.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\1n_gar1md9i83q54rw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8379cf0, ftCreationTime.dwHighDateTime=0x1d41cc9, ftLastAccessTime.dwLowDateTime=0x28afaa40, ftLastAccessTime.dwHighDateTime=0x1d4175f, ftLastWriteTime.dwLowDateTime=0xf2049c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14110)) returned 1 [0139.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.385] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\1n_gar1md9i83q54rw.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\1n_gaR1md9I83Q54rW.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\1n_gar1md9i83q54rw.mp3.anonymous")) returned 1 [0139.387] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx", lpFilePart=0x0) returned 0x2f [0139.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.387] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx" (normalized: "c:\\users\\eebsym5\\desktop\\5lnut-tpw5jxtx02v.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.387] GetFileType (hFile=0x154) returned 0x1 [0139.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.387] GetFileType (hFile=0x154) returned 0x1 [0139.387] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x12d4f [0139.387] ReadFile (in: hFile=0x154, lpBuffer=0x1b468b8, nNumberOfBytesToRead=0x12d4f, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b468b8*, lpNumberOfBytesRead=0x2ae5d4*=0x12d4f, lpOverlapped=0x0) returned 1 [0139.388] CloseHandle (hObject=0x154) returned 1 [0139.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx", lpFilePart=0x0) returned 0x2f [0139.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.522] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx" (normalized: "c:\\users\\eebsym5\\desktop\\5lnut-tpw5jxtx02v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.524] GetFileType (hFile=0x154) returned 0x1 [0139.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.524] GetFileType (hFile=0x154) returned 0x1 [0139.524] WriteFile (in: hFile=0x154, lpBuffer=0x19df1ec*, nNumberOfBytesToWrite=0x12d50, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19df1ec*, lpNumberOfBytesWritten=0x2ae5c8*=0x12d50, lpOverlapped=0x0) returned 1 [0139.527] CloseHandle (hObject=0x154) returned 1 [0139.527] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx", lpFilePart=0x0) returned 0x2f [0139.527] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx.anonymous", lpFilePart=0x0) returned 0x39 [0139.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.527] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx" (normalized: "c:\\users\\eebsym5\\desktop\\5lnut-tpw5jxtx02v.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb887bd0, ftCreationTime.dwHighDateTime=0x1d41c5e, ftLastAccessTime.dwLowDateTime=0x5f93a020, ftLastAccessTime.dwHighDateTime=0x1d41534, ftLastWriteTime.dwLowDateTime=0xf21a08d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12d50)) returned 1 [0139.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.527] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx" (normalized: "c:\\users\\eebsym5\\desktop\\5lnut-tpw5jxtx02v.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\5lnut-TPW5jxtX02V.docx.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\5lnut-tpw5jxtx02v.docx.anonymous")) returned 1 [0139.528] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif", lpFilePart=0x0) returned 0x28 [0139.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.528] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif" (normalized: "c:\\users\\eebsym5\\desktop\\9nohbkfhzpn.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.529] GetFileType (hFile=0x154) returned 0x1 [0139.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.529] GetFileType (hFile=0x154) returned 0x1 [0139.529] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xe3ef [0139.529] ReadFile (in: hFile=0x154, lpBuffer=0x19f22cc, nNumberOfBytesToRead=0xe3ef, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19f22cc*, lpNumberOfBytesRead=0x2ae5d4*=0xe3ef, lpOverlapped=0x0) returned 1 [0139.530] CloseHandle (hObject=0x154) returned 1 [0139.544] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif", lpFilePart=0x0) returned 0x28 [0139.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.544] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif" (normalized: "c:\\users\\eebsym5\\desktop\\9nohbkfhzpn.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.546] GetFileType (hFile=0x154) returned 0x1 [0139.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.546] GetFileType (hFile=0x154) returned 0x1 [0139.546] WriteFile (in: hFile=0x154, lpBuffer=0x1a69df8*, nNumberOfBytesToWrite=0xe3f0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a69df8*, lpNumberOfBytesWritten=0x2ae5c8*=0xe3f0, lpOverlapped=0x0) returned 1 [0139.549] CloseHandle (hObject=0x154) returned 1 [0139.550] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif", lpFilePart=0x0) returned 0x28 [0139.550] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif.anonymous", lpFilePart=0x0) returned 0x32 [0139.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif" (normalized: "c:\\users\\eebsym5\\desktop\\9nohbkfhzpn.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a690c40, ftCreationTime.dwHighDateTime=0x1d41d27, ftLastAccessTime.dwLowDateTime=0x6e4ae0a0, ftLastAccessTime.dwHighDateTime=0x1d41715, ftLastWriteTime.dwLowDateTime=0xf21ecb90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe3f0)) returned 1 [0139.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.550] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif" (normalized: "c:\\users\\eebsym5\\desktop\\9nohbkfhzpn.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\9NoHbkFHzpn.gif.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\9nohbkfhzpn.gif.anonymous")) returned 1 [0139.551] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png", lpFilePart=0x0) returned 0x2b [0139.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.551] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png" (normalized: "c:\\users\\eebsym5\\desktop\\9vsthmg8wfp0cb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.551] GetFileType (hFile=0x154) returned 0x1 [0139.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.551] GetFileType (hFile=0x154) returned 0x1 [0139.551] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x104c [0139.551] ReadFile (in: hFile=0x154, lpBuffer=0x1a7852c, nNumberOfBytesToRead=0x104c, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a7852c*, lpNumberOfBytesRead=0x2ae5d4*=0x104c, lpOverlapped=0x0) returned 1 [0139.552] CloseHandle (hObject=0x154) returned 1 [0139.564] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png", lpFilePart=0x0) returned 0x2b [0139.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.564] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png" (normalized: "c:\\users\\eebsym5\\desktop\\9vsthmg8wfp0cb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.567] GetFileType (hFile=0x154) returned 0x1 [0139.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.567] GetFileType (hFile=0x154) returned 0x1 [0139.567] WriteFile (in: hFile=0x154, lpBuffer=0x1aca4a4*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1aca4a4*, lpNumberOfBytesWritten=0x2ae5c8*=0x1050, lpOverlapped=0x0) returned 1 [0139.568] CloseHandle (hObject=0x154) returned 1 [0139.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png", lpFilePart=0x0) returned 0x2b [0139.569] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png.anonymous", lpFilePart=0x0) returned 0x35 [0139.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png" (normalized: "c:\\users\\eebsym5\\desktop\\9vsthmg8wfp0cb.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d5edd0, ftCreationTime.dwHighDateTime=0x1d4148c, ftLastAccessTime.dwLowDateTime=0xc6b017b0, ftLastAccessTime.dwHighDateTime=0x1d4184b, ftLastWriteTime.dwLowDateTime=0xf2212cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1050)) returned 1 [0139.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.569] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png" (normalized: "c:\\users\\eebsym5\\desktop\\9vsthmg8wfp0cb.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\9vstHmg8wFp0Cb.png.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\9vsthmg8wfp0cb.png.anonymous")) returned 1 [0139.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt", lpFilePart=0x0) returned 0x29 [0139.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.571] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt" (normalized: "c:\\users\\eebsym5\\desktop\\ar8pecl2bnhm.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.571] GetFileType (hFile=0x154) returned 0x1 [0139.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.571] GetFileType (hFile=0x154) returned 0x1 [0139.571] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1c8b [0139.571] ReadFile (in: hFile=0x154, lpBuffer=0x1acb878, nNumberOfBytesToRead=0x1c8b, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1acb878*, lpNumberOfBytesRead=0x2ae5d4*=0x1c8b, lpOverlapped=0x0) returned 1 [0139.573] CloseHandle (hObject=0x154) returned 1 [0139.588] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt", lpFilePart=0x0) returned 0x29 [0139.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.588] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt" (normalized: "c:\\users\\eebsym5\\desktop\\ar8pecl2bnhm.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.593] GetFileType (hFile=0x154) returned 0x1 [0139.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.593] GetFileType (hFile=0x154) returned 0x1 [0139.593] WriteFile (in: hFile=0x154, lpBuffer=0x1b21534*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b21534*, lpNumberOfBytesWritten=0x2ae5c8*=0x1c90, lpOverlapped=0x0) returned 1 [0139.594] CloseHandle (hObject=0x154) returned 1 [0139.595] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt", lpFilePart=0x0) returned 0x29 [0139.595] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt.anonymous", lpFilePart=0x0) returned 0x33 [0139.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt" (normalized: "c:\\users\\eebsym5\\desktop\\ar8pecl2bnhm.odt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c6d160, ftCreationTime.dwHighDateTime=0x1d414ed, ftLastAccessTime.dwLowDateTime=0xa82ca450, ftLastAccessTime.dwHighDateTime=0x1d41b18, ftLastWriteTime.dwLowDateTime=0xf2238e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c90)) returned 1 [0139.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.595] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt" (normalized: "c:\\users\\eebsym5\\desktop\\ar8pecl2bnhm.odt"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\AR8pECl2BnhM.odt.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\ar8pecl2bnhm.odt.anonymous")) returned 1 [0139.597] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv", lpFilePart=0x0) returned 0x26 [0139.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.597] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv" (normalized: "c:\\users\\eebsym5\\desktop\\g4pmr96dv.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.597] GetFileType (hFile=0x154) returned 0x1 [0139.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.598] GetFileType (hFile=0x154) returned 0x1 [0139.598] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x9188 [0139.598] ReadFile (in: hFile=0x154, lpBuffer=0x1b23558, nNumberOfBytesToRead=0x9188, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b23558*, lpNumberOfBytesRead=0x2ae5d4*=0x9188, lpOverlapped=0x0) returned 1 [0139.599] CloseHandle (hObject=0x154) returned 1 [0139.614] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv", lpFilePart=0x0) returned 0x26 [0139.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.615] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv" (normalized: "c:\\users\\eebsym5\\desktop\\g4pmr96dv.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.616] GetFileType (hFile=0x154) returned 0x1 [0139.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.617] GetFileType (hFile=0x154) returned 0x1 [0139.617] WriteFile (in: hFile=0x154, lpBuffer=0x19a1b28*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19a1b28*, lpNumberOfBytesWritten=0x2ae5c8*=0x9190, lpOverlapped=0x0) returned 1 [0139.618] CloseHandle (hObject=0x154) returned 1 [0139.619] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv", lpFilePart=0x0) returned 0x26 [0139.619] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv.anonymous", lpFilePart=0x0) returned 0x30 [0139.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.619] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv" (normalized: "c:\\users\\eebsym5\\desktop\\g4pmr96dv.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0303550, ftCreationTime.dwHighDateTime=0x1d41f46, ftLastAccessTime.dwLowDateTime=0xd7052100, ftLastAccessTime.dwHighDateTime=0x1d4192c, ftLastWriteTime.dwLowDateTime=0xf2285110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9190)) returned 1 [0139.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.619] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv" (normalized: "c:\\users\\eebsym5\\desktop\\g4pmr96dv.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\g4PmR96DV.flv.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\g4pmr96dv.flv.anonymous")) returned 1 [0139.620] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf", lpFilePart=0x0) returned 0x2a [0139.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.620] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\hob_iouodgiqc.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.620] GetFileType (hFile=0x154) returned 0x1 [0139.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.620] GetFileType (hFile=0x154) returned 0x1 [0139.620] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xc826 [0139.621] ReadFile (in: hFile=0x154, lpBuffer=0x19aafe4, nNumberOfBytesToRead=0xc826, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19aafe4*, lpNumberOfBytesRead=0x2ae5d4*=0xc826, lpOverlapped=0x0) returned 1 [0139.622] CloseHandle (hObject=0x154) returned 1 [0139.683] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf", lpFilePart=0x0) returned 0x2a [0139.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.684] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\hob_iouodgiqc.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.686] GetFileType (hFile=0x154) returned 0x1 [0139.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.686] GetFileType (hFile=0x154) returned 0x1 [0139.686] WriteFile (in: hFile=0x154, lpBuffer=0x1a1d7d0*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a1d7d0*, lpNumberOfBytesWritten=0x2ae5c8*=0xc830, lpOverlapped=0x0) returned 1 [0139.688] CloseHandle (hObject=0x154) returned 1 [0139.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf", lpFilePart=0x0) returned 0x2a [0139.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf.anonymous", lpFilePart=0x0) returned 0x34 [0139.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\hob_iouodgiqc.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7f69df0, ftCreationTime.dwHighDateTime=0x1d41bcd, ftLastAccessTime.dwLowDateTime=0x404cf3b0, ftLastAccessTime.dwHighDateTime=0x1d412e6, ftLastWriteTime.dwLowDateTime=0xf231d690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc830)) returned 1 [0139.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.689] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\hob_iouodgiqc.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\hOB_IOUODgIqc.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\hob_iouodgiqc.pdf.anonymous")) returned 1 [0139.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\i1Y38z.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png", lpFilePart=0x0) returned 0x23 [0139.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.690] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png" (normalized: "c:\\users\\eebsym5\\desktop\\i1y38z.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.690] GetFileType (hFile=0x154) returned 0x1 [0139.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.690] GetFileType (hFile=0x154) returned 0x1 [0139.690] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x189fa [0139.690] ReadFile (in: hFile=0x154, lpBuffer=0x2004c6d0, nNumberOfBytesToRead=0x189fa, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2004c6d0*, lpNumberOfBytesRead=0x2ae5d4*=0x189fa, lpOverlapped=0x0) returned 1 [0139.692] CloseHandle (hObject=0x154) returned 1 [0139.718] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\i1Y38z.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png", lpFilePart=0x0) returned 0x23 [0139.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.718] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png" (normalized: "c:\\users\\eebsym5\\desktop\\i1y38z.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.720] GetFileType (hFile=0x154) returned 0x1 [0139.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.720] GetFileType (hFile=0x154) returned 0x1 [0139.720] WriteFile (in: hFile=0x154, lpBuffer=0x200c7908*, nNumberOfBytesToWrite=0x18a00, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x200c7908*, lpNumberOfBytesWritten=0x2ae5c8*=0x18a00, lpOverlapped=0x0) returned 1 [0139.723] CloseHandle (hObject=0x154) returned 1 [0139.723] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\i1Y38z.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png", lpFilePart=0x0) returned 0x23 [0139.723] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\i1Y38z.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png.anonymous", lpFilePart=0x0) returned 0x2d [0139.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png" (normalized: "c:\\users\\eebsym5\\desktop\\i1y38z.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaab7c2f0, ftCreationTime.dwHighDateTime=0x1d416ad, ftLastAccessTime.dwLowDateTime=0x213b2910, ftLastAccessTime.dwHighDateTime=0x1d40fcb, ftLastWriteTime.dwLowDateTime=0xf238fab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18a00)) returned 1 [0139.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.723] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png" (normalized: "c:\\users\\eebsym5\\desktop\\i1y38z.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\i1Y38z.png.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\i1y38z.png.anonymous")) returned 1 [0139.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png", lpFilePart=0x0) returned 0x2e [0139.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.724] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png" (normalized: "c:\\users\\eebsym5\\desktop\\igdszg5nh3mfzlp3t.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.724] GetFileType (hFile=0x154) returned 0x1 [0139.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.724] GetFileType (hFile=0x154) returned 0x1 [0139.724] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xcd6a [0139.724] ReadFile (in: hFile=0x154, lpBuffer=0x1a77444, nNumberOfBytesToRead=0xcd6a, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a77444*, lpNumberOfBytesRead=0x2ae5d4*=0xcd6a, lpOverlapped=0x0) returned 1 [0139.725] CloseHandle (hObject=0x154) returned 1 [0139.759] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png", lpFilePart=0x0) returned 0x2e [0139.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.759] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png" (normalized: "c:\\users\\eebsym5\\desktop\\igdszg5nh3mfzlp3t.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.761] GetFileType (hFile=0x154) returned 0x1 [0139.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.762] GetFileType (hFile=0x154) returned 0x1 [0139.762] WriteFile (in: hFile=0x154, lpBuffer=0x1aeaa94*, nNumberOfBytesToWrite=0xcd70, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1aeaa94*, lpNumberOfBytesWritten=0x2ae5c8*=0xcd70, lpOverlapped=0x0) returned 1 [0139.764] CloseHandle (hObject=0x154) returned 1 [0139.764] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png", lpFilePart=0x0) returned 0x2e [0139.764] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png.anonymous", lpFilePart=0x0) returned 0x38 [0139.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png" (normalized: "c:\\users\\eebsym5\\desktop\\igdszg5nh3mfzlp3t.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b89b6c0, ftCreationTime.dwHighDateTime=0x1d4184c, ftLastAccessTime.dwLowDateTime=0xae5f5440, ftLastAccessTime.dwHighDateTime=0x1d41be9, ftLastWriteTime.dwLowDateTime=0xf23dbd70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcd70)) returned 1 [0139.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.765] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png" (normalized: "c:\\users\\eebsym5\\desktop\\igdszg5nh3mfzlp3t.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\iGDsZG5NH3MfzLp3t.png.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\igdszg5nh3mfzlp3t.png.anonymous")) returned 1 [0139.766] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3", lpFilePart=0x0) returned 0x26 [0139.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.766] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\jf7nrcs5x.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.766] GetFileType (hFile=0x154) returned 0x1 [0139.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.766] GetFileType (hFile=0x154) returned 0x1 [0139.766] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x821a [0139.766] ReadFile (in: hFile=0x154, lpBuffer=0x1af7b70, nNumberOfBytesToRead=0x821a, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1af7b70*, lpNumberOfBytesRead=0x2ae5d4*=0x821a, lpOverlapped=0x0) returned 1 [0139.768] CloseHandle (hObject=0x154) returned 1 [0139.787] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3", lpFilePart=0x0) returned 0x26 [0139.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.787] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\jf7nrcs5x.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.790] GetFileType (hFile=0x154) returned 0x1 [0139.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.790] GetFileType (hFile=0x154) returned 0x1 [0139.790] WriteFile (in: hFile=0x154, lpBuffer=0x1b6d3fc*, nNumberOfBytesToWrite=0x8220, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b6d3fc*, lpNumberOfBytesWritten=0x2ae5c8*=0x8220, lpOverlapped=0x0) returned 1 [0139.792] CloseHandle (hObject=0x154) returned 1 [0139.792] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3", lpFilePart=0x0) returned 0x26 [0139.793] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3.anonymous", lpFilePart=0x0) returned 0x30 [0139.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\jf7nrcs5x.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2955d0, ftCreationTime.dwHighDateTime=0x1d410a9, ftLastAccessTime.dwLowDateTime=0xef5e1a00, ftLastAccessTime.dwHighDateTime=0x1d41fcf, ftLastWriteTime.dwLowDateTime=0xf2428030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8220)) returned 1 [0139.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.793] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\jf7nrcs5x.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\jF7NRCs5x.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\jf7nrcs5x.mp3.anonymous")) returned 1 [0139.794] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif", lpFilePart=0x0) returned 0x2b [0139.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.794] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif" (normalized: "c:\\users\\eebsym5\\desktop\\kebigtf_x9jbzk.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.795] GetFileType (hFile=0x154) returned 0x1 [0139.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.795] GetFileType (hFile=0x154) returned 0x1 [0139.795] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x16654 [0139.796] ReadFile (in: hFile=0x154, lpBuffer=0x200f9e08, nNumberOfBytesToRead=0x16654, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x200f9e08*, lpNumberOfBytesRead=0x2ae5d4*=0x16654, lpOverlapped=0x0) returned 1 [0139.798] CloseHandle (hObject=0x154) returned 1 [0139.870] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif", lpFilePart=0x0) returned 0x2b [0139.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.870] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif" (normalized: "c:\\users\\eebsym5\\desktop\\kebigtf_x9jbzk.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.873] GetFileType (hFile=0x154) returned 0x1 [0139.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.873] GetFileType (hFile=0x154) returned 0x1 [0139.873] WriteFile (in: hFile=0x154, lpBuffer=0x20169e18*, nNumberOfBytesToWrite=0x16660, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x20169e18*, lpNumberOfBytesWritten=0x2ae5c8*=0x16660, lpOverlapped=0x0) returned 1 [0139.903] CloseHandle (hObject=0x154) returned 1 [0139.904] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif", lpFilePart=0x0) returned 0x2b [0139.904] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif.anonymous", lpFilePart=0x0) returned 0x35 [0139.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif" (normalized: "c:\\users\\eebsym5\\desktop\\kebigtf_x9jbzk.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447822e0, ftCreationTime.dwHighDateTime=0x1d4124e, ftLastAccessTime.dwLowDateTime=0xba149c90, ftLastAccessTime.dwHighDateTime=0x1d4144c, ftLastWriteTime.dwLowDateTime=0xf25329d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16660)) returned 1 [0139.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.904] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif" (normalized: "c:\\users\\eebsym5\\desktop\\kebigtf_x9jbzk.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\KebIgTF_x9jbZK.gif.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\kebigtf_x9jbzk.gif.anonymous")) returned 1 [0139.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png", lpFilePart=0x0) returned 0x30 [0139.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.906] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png" (normalized: "c:\\users\\eebsym5\\desktop\\l1uu3sa7v4os9vdznwi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.906] GetFileType (hFile=0x154) returned 0x1 [0139.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.906] GetFileType (hFile=0x154) returned 0x1 [0139.906] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x2a45 [0139.906] ReadFile (in: hFile=0x154, lpBuffer=0x19a72c0, nNumberOfBytesToRead=0x2a45, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19a72c0*, lpNumberOfBytesRead=0x2ae5d4*=0x2a45, lpOverlapped=0x0) returned 1 [0139.908] CloseHandle (hObject=0x154) returned 1 [0139.925] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png", lpFilePart=0x0) returned 0x30 [0139.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0139.925] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png" (normalized: "c:\\users\\eebsym5\\desktop\\l1uu3sa7v4os9vdznwi.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.927] GetFileType (hFile=0x154) returned 0x1 [0139.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0139.928] GetFileType (hFile=0x154) returned 0x1 [0139.928] WriteFile (in: hFile=0x154, lpBuffer=0x1a01598*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a01598*, lpNumberOfBytesWritten=0x2ae5c8*=0x2a50, lpOverlapped=0x0) returned 1 [0139.929] CloseHandle (hObject=0x154) returned 1 [0139.930] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png", lpFilePart=0x0) returned 0x30 [0139.930] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png.anonymous", lpFilePart=0x0) returned 0x3a [0139.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0139.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png" (normalized: "c:\\users\\eebsym5\\desktop\\l1uu3sa7v4os9vdznwi.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9ac5d0, ftCreationTime.dwHighDateTime=0x1d415e2, ftLastAccessTime.dwLowDateTime=0x31ce67f0, ftLastAccessTime.dwHighDateTime=0x1d4106c, ftLastWriteTime.dwLowDateTime=0xf257ec90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2a50)) returned 1 [0139.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0139.930] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png" (normalized: "c:\\users\\eebsym5\\desktop\\l1uu3sa7v4os9vdznwi.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\l1UU3SA7V4os9vdZNWi.png.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\l1uu3sa7v4os9vdznwi.png.anonymous")) returned 1 [0139.932] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3", lpFilePart=0x0) returned 0x2f [0139.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0139.932] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\lfosza0ndpe4vprp2e.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0139.932] GetFileType (hFile=0x154) returned 0x1 [0139.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0139.932] GetFileType (hFile=0x154) returned 0x1 [0139.932] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x133ee [0139.933] ReadFile (in: hFile=0x154, lpBuffer=0x1a043a4, nNumberOfBytesToRead=0x133ee, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a043a4*, lpNumberOfBytesRead=0x2ae5d4*=0x133ee, lpOverlapped=0x0) returned 1 [0139.934] CloseHandle (hObject=0x154) returned 1 [0140.001] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3", lpFilePart=0x0) returned 0x2f [0140.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.001] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\lfosza0ndpe4vprp2e.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.003] GetFileType (hFile=0x154) returned 0x1 [0140.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.003] GetFileType (hFile=0x154) returned 0x1 [0140.003] WriteFile (in: hFile=0x154, lpBuffer=0x1a8ad74*, nNumberOfBytesToWrite=0x133f0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a8ad74*, lpNumberOfBytesWritten=0x2ae5c8*=0x133f0, lpOverlapped=0x0) returned 1 [0140.006] CloseHandle (hObject=0x154) returned 1 [0140.006] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3", lpFilePart=0x0) returned 0x2f [0140.006] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3.anonymous", lpFilePart=0x0) returned 0x39 [0140.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.006] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\lfosza0ndpe4vprp2e.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15e3320, ftCreationTime.dwHighDateTime=0x1d41f83, ftLastAccessTime.dwLowDateTime=0x86a6910, ftLastAccessTime.dwHighDateTime=0x1d4148e, ftLastWriteTime.dwLowDateTime=0xf263d370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x133f0)) returned 1 [0140.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.006] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\lfosza0ndpe4vprp2e.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\LFosZA0ndPe4VpRP2e.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\lfosza0ndpe4vprp2e.mp3.anonymous")) returned 1 [0140.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif", lpFilePart=0x0) returned 0x2d [0140.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.007] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif" (normalized: "c:\\users\\eebsym5\\desktop\\mdemmbv4kcu1pqin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.007] GetFileType (hFile=0x154) returned 0x1 [0140.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.007] GetFileType (hFile=0x154) returned 0x1 [0140.007] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x447c [0140.007] ReadFile (in: hFile=0x154, lpBuffer=0x1a9e508, nNumberOfBytesToRead=0x447c, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a9e508*, lpNumberOfBytesRead=0x2ae5d4*=0x447c, lpOverlapped=0x0) returned 1 [0140.010] CloseHandle (hObject=0x154) returned 1 [0140.023] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif", lpFilePart=0x0) returned 0x2d [0140.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.023] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif" (normalized: "c:\\users\\eebsym5\\desktop\\mdemmbv4kcu1pqin.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.026] GetFileType (hFile=0x154) returned 0x1 [0140.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.026] GetFileType (hFile=0x154) returned 0x1 [0140.026] WriteFile (in: hFile=0x154, lpBuffer=0x1b00970*, nNumberOfBytesToWrite=0x4480, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b00970*, lpNumberOfBytesWritten=0x2ae5c8*=0x4480, lpOverlapped=0x0) returned 1 [0140.029] CloseHandle (hObject=0x154) returned 1 [0140.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif", lpFilePart=0x0) returned 0x2d [0140.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif.anonymous", lpFilePart=0x0) returned 0x37 [0140.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif" (normalized: "c:\\users\\eebsym5\\desktop\\mdemmbv4kcu1pqin.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5d4090, ftCreationTime.dwHighDateTime=0x1d41964, ftLastAccessTime.dwLowDateTime=0xecba5c70, ftLastAccessTime.dwHighDateTime=0x1d41e6a, ftLastWriteTime.dwLowDateTime=0xf26634d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4480)) returned 1 [0140.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.029] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif" (normalized: "c:\\users\\eebsym5\\desktop\\mdemmbv4kcu1pqin.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\mdemmBv4kCu1pQin.gif.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\mdemmbv4kcu1pqin.gif.anonymous")) returned 1 [0140.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf", lpFilePart=0x0) returned 0x23 [0140.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.030] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\pp1wo2.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.030] GetFileType (hFile=0x154) returned 0x1 [0140.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.030] GetFileType (hFile=0x154) returned 0x1 [0140.030] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x957a [0140.031] ReadFile (in: hFile=0x154, lpBuffer=0x1b05158, nNumberOfBytesToRead=0x957a, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b05158*, lpNumberOfBytesRead=0x2ae5d4*=0x957a, lpOverlapped=0x0) returned 1 [0140.032] CloseHandle (hObject=0x154) returned 1 [0140.044] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf", lpFilePart=0x0) returned 0x23 [0140.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.044] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\pp1wo2.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.046] GetFileType (hFile=0x154) returned 0x1 [0140.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.046] GetFileType (hFile=0x154) returned 0x1 [0140.046] WriteFile (in: hFile=0x154, lpBuffer=0x1b80ac4*, nNumberOfBytesToWrite=0x9580, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b80ac4*, lpNumberOfBytesWritten=0x2ae5c8*=0x9580, lpOverlapped=0x0) returned 1 [0140.048] CloseHandle (hObject=0x154) returned 1 [0140.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf", lpFilePart=0x0) returned 0x23 [0140.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf.anonymous", lpFilePart=0x0) returned 0x2d [0140.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.048] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\pp1wo2.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752e3ba0, ftCreationTime.dwHighDateTime=0x1d41243, ftLastAccessTime.dwLowDateTime=0x1c1c9050, ftLastAccessTime.dwHighDateTime=0x1d41b73, ftLastWriteTime.dwLowDateTime=0xf26af790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9580)) returned 1 [0140.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.048] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf" (normalized: "c:\\users\\eebsym5\\desktop\\pp1wo2.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\Pp1Wo2.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\pp1wo2.pdf.anonymous")) returned 1 [0140.049] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3", lpFilePart=0x0) returned 0x31 [0140.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.049] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\ucqzywxzvz7kahi4mxvg.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.049] GetFileType (hFile=0x154) returned 0x1 [0140.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.049] GetFileType (hFile=0x154) returned 0x1 [0140.049] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x204a [0140.053] ReadFile (in: hFile=0x154, lpBuffer=0x19860b8, nNumberOfBytesToRead=0x204a, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19860b8*, lpNumberOfBytesRead=0x2ae5d4*=0x204a, lpOverlapped=0x0) returned 1 [0140.054] CloseHandle (hObject=0x154) returned 1 [0140.089] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3", lpFilePart=0x0) returned 0x31 [0140.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.089] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\ucqzywxzvz7kahi4mxvg.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.090] GetFileType (hFile=0x154) returned 0x1 [0140.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.090] GetFileType (hFile=0x154) returned 0x1 [0140.090] WriteFile (in: hFile=0x154, lpBuffer=0x19dd190*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19dd190*, lpNumberOfBytesWritten=0x2ae5c8*=0x2050, lpOverlapped=0x0) returned 1 [0140.091] CloseHandle (hObject=0x154) returned 1 [0140.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3", lpFilePart=0x0) returned 0x31 [0140.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3.anonymous", lpFilePart=0x0) returned 0x3b [0140.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\ucqzywxzvz7kahi4mxvg.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f5a17d0, ftCreationTime.dwHighDateTime=0x1d4123a, ftLastAccessTime.dwLowDateTime=0x65172890, ftLastAccessTime.dwHighDateTime=0x1d41a1c, ftLastWriteTime.dwLowDateTime=0xf26fba50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2050)) returned 1 [0140.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.092] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\ucqzywxzvz7kahi4mxvg.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\UCqZYwxZvZ7KaHI4Mxvg.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\ucqzywxzvz7kahi4mxvg.mp3.anonymous")) returned 1 [0140.092] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3", lpFilePart=0x0) returned 0x2f [0140.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.092] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\wf6ycvfk waszzbtev.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.093] GetFileType (hFile=0x154) returned 0x1 [0140.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.093] GetFileType (hFile=0x154) returned 0x1 [0140.093] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x5bc0 [0140.093] ReadFile (in: hFile=0x154, lpBuffer=0x19df588, nNumberOfBytesToRead=0x5bc0, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19df588*, lpNumberOfBytesRead=0x2ae5d4*=0x5bc0, lpOverlapped=0x0) returned 1 [0140.094] CloseHandle (hObject=0x154) returned 1 [0140.106] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3", lpFilePart=0x0) returned 0x2f [0140.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.106] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\wf6ycvfk waszzbtev.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.108] GetFileType (hFile=0x154) returned 0x1 [0140.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.108] GetFileType (hFile=0x154) returned 0x1 [0140.108] WriteFile (in: hFile=0x154, lpBuffer=0x1a48e80*, nNumberOfBytesToWrite=0x5bd0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a48e80*, lpNumberOfBytesWritten=0x2ae5c8*=0x5bd0, lpOverlapped=0x0) returned 1 [0140.110] CloseHandle (hObject=0x154) returned 1 [0140.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3", lpFilePart=0x0) returned 0x2f [0140.110] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3.anonymous", lpFilePart=0x0) returned 0x39 [0140.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\wf6ycvfk waszzbtev.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933f0760, ftCreationTime.dwHighDateTime=0x1d41616, ftLastAccessTime.dwLowDateTime=0xca9f05a0, ftLastAccessTime.dwHighDateTime=0x1d4122b, ftLastWriteTime.dwLowDateTime=0xf2747d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0)) returned 1 [0140.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.110] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3" (normalized: "c:\\users\\eebsym5\\desktop\\wf6ycvfk waszzbtev.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\WF6yCVfk wASZzbtEV.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\wf6ycvfk waszzbtev.mp3.anonymous")) returned 1 [0140.111] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx", lpFilePart=0x0) returned 0x31 [0140.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.111] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx" (normalized: "c:\\users\\eebsym5\\desktop\\wghugz9h5d4zmxsnjmb.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.111] GetFileType (hFile=0x154) returned 0x1 [0140.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.111] GetFileType (hFile=0x154) returned 0x1 [0140.111] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x3f7d [0140.111] ReadFile (in: hFile=0x154, lpBuffer=0x1a4edec, nNumberOfBytesToRead=0x3f7d, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a4edec*, lpNumberOfBytesRead=0x2ae5d4*=0x3f7d, lpOverlapped=0x0) returned 1 [0140.112] CloseHandle (hObject=0x154) returned 1 [0140.124] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx", lpFilePart=0x0) returned 0x31 [0140.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.124] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx" (normalized: "c:\\users\\eebsym5\\desktop\\wghugz9h5d4zmxsnjmb.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.126] GetFileType (hFile=0x154) returned 0x1 [0140.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.126] GetFileType (hFile=0x154) returned 0x1 [0140.126] WriteFile (in: hFile=0x154, lpBuffer=0x1aaf958*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1aaf958*, lpNumberOfBytesWritten=0x2ae5c8*=0x3f80, lpOverlapped=0x0) returned 1 [0140.127] CloseHandle (hObject=0x154) returned 1 [0140.127] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx", lpFilePart=0x0) returned 0x31 [0140.127] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx.anonymous", lpFilePart=0x0) returned 0x3b [0140.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx" (normalized: "c:\\users\\eebsym5\\desktop\\wghugz9h5d4zmxsnjmb.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2d5da0, ftCreationTime.dwHighDateTime=0x1d41dfc, ftLastAccessTime.dwLowDateTime=0xb7feed20, ftLastAccessTime.dwHighDateTime=0x1d41feb, ftLastWriteTime.dwLowDateTime=0xf276de70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f80)) returned 1 [0140.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.127] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx" (normalized: "c:\\users\\eebsym5\\desktop\\wghugz9h5d4zmxsnjmb.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\wGHugz9h5D4zmXsNJMb.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\wghugz9h5d4zmxsnjmb.xlsx.anonymous")) returned 1 [0140.131] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\xGOku.jpg", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg", lpFilePart=0x0) returned 0x22 [0140.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.131] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg" (normalized: "c:\\users\\eebsym5\\desktop\\xgoku.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.131] GetFileType (hFile=0x154) returned 0x1 [0140.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.131] GetFileType (hFile=0x154) returned 0x1 [0140.131] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x542c [0140.131] ReadFile (in: hFile=0x154, lpBuffer=0x1ab3c64, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ab3c64*, lpNumberOfBytesRead=0x2ae5d4*=0x542c, lpOverlapped=0x0) returned 1 [0140.132] CloseHandle (hObject=0x154) returned 1 [0140.144] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\xGOku.jpg", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg", lpFilePart=0x0) returned 0x22 [0140.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.144] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg" (normalized: "c:\\users\\eebsym5\\desktop\\xgoku.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.146] GetFileType (hFile=0x154) returned 0x1 [0140.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.146] GetFileType (hFile=0x154) returned 0x1 [0140.146] WriteFile (in: hFile=0x154, lpBuffer=0x1b1af3c*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b1af3c*, lpNumberOfBytesWritten=0x2ae5c8*=0x5430, lpOverlapped=0x0) returned 1 [0140.147] CloseHandle (hObject=0x154) returned 1 [0140.147] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\xGOku.jpg", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg", lpFilePart=0x0) returned 0x22 [0140.147] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\xGOku.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg.anonymous", lpFilePart=0x0) returned 0x2c [0140.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg" (normalized: "c:\\users\\eebsym5\\desktop\\xgoku.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1f8640, ftCreationTime.dwHighDateTime=0x1d4128a, ftLastAccessTime.dwLowDateTime=0x80a0f6d0, ftLastAccessTime.dwHighDateTime=0x1d41ce8, ftLastWriteTime.dwLowDateTime=0xf2793fd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5430)) returned 1 [0140.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.148] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg" (normalized: "c:\\users\\eebsym5\\desktop\\xgoku.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\xGOku.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\xgoku.jpg.anonymous")) returned 1 [0140.148] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\XIuceCD.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png", lpFilePart=0x0) returned 0x24 [0140.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.148] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png" (normalized: "c:\\users\\eebsym5\\desktop\\xiucecd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.148] GetFileType (hFile=0x154) returned 0x1 [0140.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.148] GetFileType (hFile=0x154) returned 0x1 [0140.148] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xb76f [0140.149] ReadFile (in: hFile=0x154, lpBuffer=0x1b20658, nNumberOfBytesToRead=0xb76f, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b20658*, lpNumberOfBytesRead=0x2ae5d4*=0xb76f, lpOverlapped=0x0) returned 1 [0140.150] CloseHandle (hObject=0x154) returned 1 [0140.168] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\XIuceCD.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png", lpFilePart=0x0) returned 0x24 [0140.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.168] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png" (normalized: "c:\\users\\eebsym5\\desktop\\xiucecd.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.171] GetFileType (hFile=0x154) returned 0x1 [0140.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.171] GetFileType (hFile=0x154) returned 0x1 [0140.171] WriteFile (in: hFile=0x154, lpBuffer=0x1991df8*, nNumberOfBytesToWrite=0xb770, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1991df8*, lpNumberOfBytesWritten=0x2ae5c8*=0xb770, lpOverlapped=0x0) returned 1 [0140.174] CloseHandle (hObject=0x154) returned 1 [0140.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\XIuceCD.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png", lpFilePart=0x0) returned 0x24 [0140.174] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\XIuceCD.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png.anonymous", lpFilePart=0x0) returned 0x2e [0140.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png" (normalized: "c:\\users\\eebsym5\\desktop\\xiucecd.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52628ab0, ftCreationTime.dwHighDateTime=0x1d41c78, ftLastAccessTime.dwLowDateTime=0xdd5ec900, ftLastAccessTime.dwHighDateTime=0x1d41a41, ftLastWriteTime.dwLowDateTime=0xf27e0290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb770)) returned 1 [0140.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.174] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png" (normalized: "c:\\users\\eebsym5\\desktop\\xiucecd.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\XIuceCD.png.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\xiucecd.png.anonymous")) returned 1 [0140.202] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif", lpFilePart=0x0) returned 0x24 [0140.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.202] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif" (normalized: "c:\\users\\eebsym5\\desktop\\yej_g4v.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.202] GetFileType (hFile=0x154) returned 0x1 [0140.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.202] GetFileType (hFile=0x154) returned 0x1 [0140.202] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x7438 [0140.202] ReadFile (in: hFile=0x154, lpBuffer=0x199d868, nNumberOfBytesToRead=0x7438, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x199d868*, lpNumberOfBytesRead=0x2ae5d4*=0x7438, lpOverlapped=0x0) returned 1 [0140.205] CloseHandle (hObject=0x154) returned 1 [0140.243] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif", lpFilePart=0x0) returned 0x24 [0140.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.243] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif" (normalized: "c:\\users\\eebsym5\\desktop\\yej_g4v.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.247] GetFileType (hFile=0x154) returned 0x1 [0140.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.247] GetFileType (hFile=0x154) returned 0x1 [0140.247] WriteFile (in: hFile=0x154, lpBuffer=0x1a0ecec*, nNumberOfBytesToWrite=0x7440, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a0ecec*, lpNumberOfBytesWritten=0x2ae5c8*=0x7440, lpOverlapped=0x0) returned 1 [0140.251] CloseHandle (hObject=0x154) returned 1 [0140.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif", lpFilePart=0x0) returned 0x24 [0140.251] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif.anonymous", lpFilePart=0x0) returned 0x2e [0140.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif" (normalized: "c:\\users\\eebsym5\\desktop\\yej_g4v.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1daaedb0, ftCreationTime.dwHighDateTime=0x1d4172f, ftLastAccessTime.dwLowDateTime=0x24df5ad0, ftLastAccessTime.dwHighDateTime=0x1d4150e, ftLastWriteTime.dwLowDateTime=0xf289e970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7440)) returned 1 [0140.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.252] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif" (normalized: "c:\\users\\eebsym5\\desktop\\yej_g4v.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\yEj_g4V.gif.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\yej_g4v.gif.anonymous")) returned 1 [0140.253] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls", lpFilePart=0x0) returned 0x2d [0140.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.253] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls" (normalized: "c:\\users\\eebsym5\\desktop\\ynatgjs775iicskj.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.253] GetFileType (hFile=0x154) returned 0x1 [0140.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.253] GetFileType (hFile=0x154) returned 0x1 [0140.253] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x11071 [0140.253] ReadFile (in: hFile=0x154, lpBuffer=0x1a16450, nNumberOfBytesToRead=0x11071, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a16450*, lpNumberOfBytesRead=0x2ae5d4*=0x11071, lpOverlapped=0x0) returned 1 [0140.255] CloseHandle (hObject=0x154) returned 1 [0140.278] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls", lpFilePart=0x0) returned 0x2d [0140.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.278] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls" (normalized: "c:\\users\\eebsym5\\desktop\\ynatgjs775iicskj.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.281] GetFileType (hFile=0x154) returned 0x1 [0140.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.281] GetFileType (hFile=0x154) returned 0x1 [0140.281] WriteFile (in: hFile=0x154, lpBuffer=0x1a963d0*, nNumberOfBytesToWrite=0x11080, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a963d0*, lpNumberOfBytesWritten=0x2ae5c8*=0x11080, lpOverlapped=0x0) returned 1 [0140.284] CloseHandle (hObject=0x154) returned 1 [0140.284] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls", lpFilePart=0x0) returned 0x2d [0140.284] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls.anonymous", lpFilePart=0x0) returned 0x37 [0140.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls" (normalized: "c:\\users\\eebsym5\\desktop\\ynatgjs775iicskj.xls"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6703210, ftCreationTime.dwHighDateTime=0x1d41f83, ftLastAccessTime.dwLowDateTime=0x9c6ba170, ftLastAccessTime.dwHighDateTime=0x1d41cfd, ftLastWriteTime.dwLowDateTime=0xf28eac30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11080)) returned 1 [0140.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.285] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls" (normalized: "c:\\users\\eebsym5\\desktop\\ynatgjs775iicskj.xls"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\yNATGJs775IICSKJ.xls.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\ynatgjs775iicskj.xls.anonymous")) returned 1 [0140.286] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png", lpFilePart=0x0) returned 0x29 [0140.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.286] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png" (normalized: "c:\\users\\eebsym5\\desktop\\_ettutmdwrdt.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.286] GetFileType (hFile=0x154) returned 0x1 [0140.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.286] GetFileType (hFile=0x154) returned 0x1 [0140.286] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x18d14 [0140.287] ReadFile (in: hFile=0x154, lpBuffer=0x201dfc58, nNumberOfBytesToRead=0x18d14, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x201dfc58*, lpNumberOfBytesRead=0x2ae5d4*=0x18d14, lpOverlapped=0x0) returned 1 [0140.290] CloseHandle (hObject=0x154) returned 1 [0140.309] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png", lpFilePart=0x0) returned 0x29 [0140.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.309] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png" (normalized: "c:\\users\\eebsym5\\desktop\\_ettutmdwrdt.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.311] GetFileType (hFile=0x154) returned 0x1 [0140.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.311] GetFileType (hFile=0x154) returned 0x1 [0140.311] WriteFile (in: hFile=0x154, lpBuffer=0x2025be28*, nNumberOfBytesToWrite=0x18d20, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x2025be28*, lpNumberOfBytesWritten=0x2ae5c8*=0x18d20, lpOverlapped=0x0) returned 1 [0140.314] CloseHandle (hObject=0x154) returned 1 [0140.314] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png", lpFilePart=0x0) returned 0x29 [0140.314] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png.anonymous", lpFilePart=0x0) returned 0x33 [0140.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png" (normalized: "c:\\users\\eebsym5\\desktop\\_ettutmdwrdt.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19648090, ftCreationTime.dwHighDateTime=0x1d41db5, ftLastAccessTime.dwLowDateTime=0xafc99420, ftLastAccessTime.dwHighDateTime=0x1d410dc, ftLastWriteTime.dwLowDateTime=0xf2936ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18d20)) returned 1 [0140.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.314] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png" (normalized: "c:\\users\\eebsym5\\desktop\\_ettutmdwrdt.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\_EtTUtMdWrdt.png.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\_ettutmdwrdt.png.anonymous")) returned 1 [0140.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0140.315] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\HQa1w", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w", lpFilePart=0x0) returned 0x1e [0140.315] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\", lpFilePart=0x0) returned 0x1f [0140.315] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec58 [0140.315] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.315] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.315] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.316] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0140.316] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0140.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0140.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0140.316] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\HQa1w", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w", lpFilePart=0x0) returned 0x1e [0140.316] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\", lpFilePart=0x0) returned 0x1f [0140.317] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbec58 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.317] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.318] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.318] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0140.318] FindNextFileW (in: hFindFile=0xbec58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0140.318] FindClose (in: hFindFile=0xbec58 | out: hFindFile=0xbec58) returned 1 [0140.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0140.318] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif", lpFilePart=0x0) returned 0x33 [0140.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0140.318] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif" (normalized: "c:\\users\\eebsym5\\desktop\\hqa1w\\9jp7ddhb_n0odmhj.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.318] GetFileType (hFile=0x154) returned 0x1 [0140.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0140.318] GetFileType (hFile=0x154) returned 0x1 [0140.318] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3d44 [0140.318] ReadFile (in: hFile=0x154, lpBuffer=0x1af6cec, nNumberOfBytesToRead=0x3d44, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1af6cec*, lpNumberOfBytesRead=0x2ae560*=0x3d44, lpOverlapped=0x0) returned 1 [0140.319] CloseHandle (hObject=0x154) returned 1 [0140.331] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif", lpFilePart=0x0) returned 0x33 [0140.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0140.331] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif" (normalized: "c:\\users\\eebsym5\\desktop\\hqa1w\\9jp7ddhb_n0odmhj.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.333] GetFileType (hFile=0x154) returned 0x1 [0140.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0140.333] GetFileType (hFile=0x154) returned 0x1 [0140.333] WriteFile (in: hFile=0x154, lpBuffer=0x1b56d64*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b56d64*, lpNumberOfBytesWritten=0x2ae554*=0x3d50, lpOverlapped=0x0) returned 1 [0140.334] CloseHandle (hObject=0x154) returned 1 [0140.334] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif", lpFilePart=0x0) returned 0x33 [0140.334] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif.anonymous", lpFilePart=0x0) returned 0x3d [0140.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0140.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif" (normalized: "c:\\users\\eebsym5\\desktop\\hqa1w\\9jp7ddhb_n0odmhj.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad5916e0, ftCreationTime.dwHighDateTime=0x1d41f62, ftLastAccessTime.dwLowDateTime=0x458af2d0, ftLastAccessTime.dwHighDateTime=0x1d419eb, ftLastWriteTime.dwLowDateTime=0xf295d050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3d50)) returned 1 [0140.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0140.335] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif" (normalized: "c:\\users\\eebsym5\\desktop\\hqa1w\\9jp7ddhb_n0odmhj.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Desktop\\HQa1w\\9jP7dDHB_N0oDMHj.gif.anonymous" (normalized: "c:\\users\\eebsym5\\desktop\\hqa1w\\9jp7ddhb_n0odmhj.gif.anonymous")) returned 1 [0140.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0140.335] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents", lpFilePart=0x0) returned 0x1a [0140.335] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\", lpFilePart=0x0) returned 0x1b [0140.335] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0140.335] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.336] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.337] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.338] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.339] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.339] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0140.339] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0140.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0140.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0140.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0140.339] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents", lpFilePart=0x0) returned 0x1a [0140.339] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\", lpFilePart=0x0) returned 0x1b [0140.339] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbea18 [0140.339] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.339] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.339] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.340] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.341] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.342] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.342] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.342] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.342] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.342] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.342] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.343] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.343] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.343] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.343] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.343] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.343] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0140.344] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0140.344] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0140.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0140.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0140.344] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx", lpFilePart=0x0) returned 0x32 [0140.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.344] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\9lnlju7r5rujvak78b.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.344] GetFileType (hFile=0x154) returned 0x1 [0140.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.344] GetFileType (hFile=0x154) returned 0x1 [0140.344] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1259d [0140.344] ReadFile (in: hFile=0x154, lpBuffer=0x1b60590, nNumberOfBytesToRead=0x1259d, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b60590*, lpNumberOfBytesRead=0x2ae5d4*=0x1259d, lpOverlapped=0x0) returned 1 [0140.346] CloseHandle (hObject=0x154) returned 1 [0140.396] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx", lpFilePart=0x0) returned 0x32 [0140.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.396] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\9lnlju7r5rujvak78b.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.398] GetFileType (hFile=0x154) returned 0x1 [0140.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.398] GetFileType (hFile=0x154) returned 0x1 [0140.398] WriteFile (in: hFile=0x154, lpBuffer=0x19eabb4*, nNumberOfBytesToWrite=0x125a0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19eabb4*, lpNumberOfBytesWritten=0x2ae5c8*=0x125a0, lpOverlapped=0x0) returned 1 [0140.400] CloseHandle (hObject=0x154) returned 1 [0140.400] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx", lpFilePart=0x0) returned 0x32 [0140.400] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx.anonymous", lpFilePart=0x0) returned 0x3c [0140.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\9lnlju7r5rujvak78b.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811a10b0, ftCreationTime.dwHighDateTime=0x1d3d887, ftLastAccessTime.dwLowDateTime=0x30f24510, ftLastAccessTime.dwHighDateTime=0x1d3c7b8, ftLastWriteTime.dwLowDateTime=0xf29f55d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x125a0)) returned 1 [0140.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.401] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\9lnlju7r5rujvak78b.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\9Lnlju7R5rujvAK78B.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\9lnlju7r5rujvak78b.xlsx.anonymous")) returned 1 [0140.401] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx", lpFilePart=0x0) returned 0x27 [0140.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.401] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx" (normalized: "c:\\users\\eebsym5\\documents\\d6szgsc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.402] GetFileType (hFile=0x154) returned 0x1 [0140.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.402] GetFileType (hFile=0x154) returned 0x1 [0140.402] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xa54a [0140.402] ReadFile (in: hFile=0x154, lpBuffer=0x19fd4e4, nNumberOfBytesToRead=0xa54a, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19fd4e4*, lpNumberOfBytesRead=0x2ae5d4*=0xa54a, lpOverlapped=0x0) returned 1 [0140.403] CloseHandle (hObject=0x154) returned 1 [0140.419] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx", lpFilePart=0x0) returned 0x27 [0140.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.419] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx" (normalized: "c:\\users\\eebsym5\\documents\\d6szgsc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.422] GetFileType (hFile=0x154) returned 0x1 [0140.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.422] GetFileType (hFile=0x154) returned 0x1 [0140.422] WriteFile (in: hFile=0x154, lpBuffer=0x1a7debc*, nNumberOfBytesToWrite=0xa550, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a7debc*, lpNumberOfBytesWritten=0x2ae5c8*=0xa550, lpOverlapped=0x0) returned 1 [0140.424] CloseHandle (hObject=0x154) returned 1 [0140.425] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx", lpFilePart=0x0) returned 0x27 [0140.425] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx.anonymous", lpFilePart=0x0) returned 0x31 [0140.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.425] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx" (normalized: "c:\\users\\eebsym5\\documents\\d6szgsc.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb7a1010, ftCreationTime.dwHighDateTime=0x1d3d77d, ftLastAccessTime.dwLowDateTime=0x5eef2ee0, ftLastAccessTime.dwHighDateTime=0x1d3d890, ftLastWriteTime.dwLowDateTime=0xf2a41890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa550)) returned 1 [0140.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.425] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx" (normalized: "c:\\users\\eebsym5\\documents\\d6szgsc.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\d6SzgSC.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\d6szgsc.docx.anonymous")) returned 1 [0140.426] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\dIOu.docx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx", lpFilePart=0x0) returned 0x24 [0140.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.426] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx" (normalized: "c:\\users\\eebsym5\\documents\\diou.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.426] GetFileType (hFile=0x154) returned 0x1 [0140.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.426] GetFileType (hFile=0x154) returned 0x1 [0140.426] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xcec3 [0140.426] ReadFile (in: hFile=0x154, lpBuffer=0x1a88734, nNumberOfBytesToRead=0xcec3, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a88734*, lpNumberOfBytesRead=0x2ae5d4*=0xcec3, lpOverlapped=0x0) returned 1 [0140.428] CloseHandle (hObject=0x154) returned 1 [0140.450] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\dIOu.docx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx", lpFilePart=0x0) returned 0x24 [0140.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.450] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx" (normalized: "c:\\users\\eebsym5\\documents\\diou.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.452] GetFileType (hFile=0x154) returned 0x1 [0140.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.452] GetFileType (hFile=0x154) returned 0x1 [0140.452] WriteFile (in: hFile=0x154, lpBuffer=0x1afc1a4*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1afc1a4*, lpNumberOfBytesWritten=0x2ae5c8*=0xced0, lpOverlapped=0x0) returned 1 [0140.627] CloseHandle (hObject=0x154) returned 1 [0140.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\dIOu.docx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx", lpFilePart=0x0) returned 0x24 [0140.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\dIOu.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx.anonymous", lpFilePart=0x0) returned 0x2e [0140.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx" (normalized: "c:\\users\\eebsym5\\documents\\diou.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f5e60, ftCreationTime.dwHighDateTime=0x1d43ad5, ftLastAccessTime.dwLowDateTime=0xeec2c1b0, ftLastAccessTime.dwHighDateTime=0x1d4173a, ftLastWriteTime.dwLowDateTime=0xf2c30a70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xced0)) returned 1 [0140.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.627] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx" (normalized: "c:\\users\\eebsym5\\documents\\diou.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\dIOu.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\diou.docx.anonymous")) returned 1 [0140.628] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx", lpFilePart=0x0) returned 0x33 [0140.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.628] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\efnezqs-f2_fzq2l6d0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.628] GetFileType (hFile=0x154) returned 0x1 [0140.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.628] GetFileType (hFile=0x154) returned 0x1 [0140.628] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x3268 [0140.628] ReadFile (in: hFile=0x154, lpBuffer=0x1b093a8, nNumberOfBytesToRead=0x3268, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b093a8*, lpNumberOfBytesRead=0x2ae5d4*=0x3268, lpOverlapped=0x0) returned 1 [0140.631] CloseHandle (hObject=0x154) returned 1 [0140.644] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx", lpFilePart=0x0) returned 0x33 [0140.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.644] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\efnezqs-f2_fzq2l6d0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.646] GetFileType (hFile=0x154) returned 0x1 [0140.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.646] GetFileType (hFile=0x154) returned 0x1 [0140.647] WriteFile (in: hFile=0x154, lpBuffer=0x1b65dc0*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b65dc0*, lpNumberOfBytesWritten=0x2ae5c8*=0x3270, lpOverlapped=0x0) returned 1 [0140.650] CloseHandle (hObject=0x154) returned 1 [0140.650] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx", lpFilePart=0x0) returned 0x33 [0140.650] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx.anonymous", lpFilePart=0x0) returned 0x3d [0140.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\efnezqs-f2_fzq2l6d0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc9400, ftCreationTime.dwHighDateTime=0x1d44099, ftLastAccessTime.dwLowDateTime=0x18452c70, ftLastAccessTime.dwHighDateTime=0x1d3fe7d, ftLastWriteTime.dwLowDateTime=0xf2c56bd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3270)) returned 1 [0140.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.650] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\efnezqs-f2_fzq2l6d0.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\efnEzQs-f2_fzq2l6D0.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\efnezqs-f2_fzq2l6d0.xlsx.anonymous")) returned 1 [0140.651] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx", lpFilePart=0x0) returned 0x2f [0140.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.651] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\gciotjfm_gh82n7.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.651] GetFileType (hFile=0x154) returned 0x1 [0140.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.651] GetFileType (hFile=0x154) returned 0x1 [0140.651] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x15072 [0140.652] ReadFile (in: hFile=0x154, lpBuffer=0x202b3448, nNumberOfBytesToRead=0x15072, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x202b3448*, lpNumberOfBytesRead=0x2ae5d4*=0x15072, lpOverlapped=0x0) returned 1 [0140.654] CloseHandle (hObject=0x154) returned 1 [0140.700] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx", lpFilePart=0x0) returned 0x2f [0140.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.700] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\gciotjfm_gh82n7.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.701] GetFileType (hFile=0x154) returned 0x1 [0140.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.702] GetFileType (hFile=0x154) returned 0x1 [0140.702] WriteFile (in: hFile=0x154, lpBuffer=0x2031c6f8*, nNumberOfBytesToWrite=0x15080, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x2031c6f8*, lpNumberOfBytesWritten=0x2ae5c8*=0x15080, lpOverlapped=0x0) returned 1 [0140.704] CloseHandle (hObject=0x154) returned 1 [0140.704] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx", lpFilePart=0x0) returned 0x2f [0140.704] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx.anonymous", lpFilePart=0x0) returned 0x39 [0140.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\gciotjfm_gh82n7.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0f8f00, ftCreationTime.dwHighDateTime=0x1d4058a, ftLastAccessTime.dwLowDateTime=0x36094210, ftLastAccessTime.dwHighDateTime=0x1d41678, ftLastWriteTime.dwLowDateTime=0xf2cef150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15080)) returned 1 [0140.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.704] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\gciotjfm_gh82n7.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\GCIOtJfm_GH82N7.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\gciotjfm_gh82n7.xlsx.anonymous")) returned 1 [0140.705] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx", lpFilePart=0x0) returned 0x2c [0140.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.705] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx" (normalized: "c:\\users\\eebsym5\\documents\\gel4xiwhzryv.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.705] GetFileType (hFile=0x154) returned 0x1 [0140.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.705] GetFileType (hFile=0x154) returned 0x1 [0140.705] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xddf1 [0140.705] ReadFile (in: hFile=0x154, lpBuffer=0x19a3f64, nNumberOfBytesToRead=0xddf1, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19a3f64*, lpNumberOfBytesRead=0x2ae5d4*=0xddf1, lpOverlapped=0x0) returned 1 [0140.706] CloseHandle (hObject=0x154) returned 1 [0140.720] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx", lpFilePart=0x0) returned 0x2c [0140.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.720] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx" (normalized: "c:\\users\\eebsym5\\documents\\gel4xiwhzryv.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.722] GetFileType (hFile=0x154) returned 0x1 [0140.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.722] GetFileType (hFile=0x154) returned 0x1 [0140.722] WriteFile (in: hFile=0x154, lpBuffer=0x1a1a8c0*, nNumberOfBytesToWrite=0xde00, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a1a8c0*, lpNumberOfBytesWritten=0x2ae5c8*=0xde00, lpOverlapped=0x0) returned 1 [0140.724] CloseHandle (hObject=0x154) returned 1 [0140.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx", lpFilePart=0x0) returned 0x2c [0140.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx.anonymous", lpFilePart=0x0) returned 0x36 [0140.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx" (normalized: "c:\\users\\eebsym5\\documents\\gel4xiwhzryv.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7732270, ftCreationTime.dwHighDateTime=0x1d41e2b, ftLastAccessTime.dwLowDateTime=0x13e1c530, ftLastAccessTime.dwHighDateTime=0x1d3d4a2, ftLastWriteTime.dwLowDateTime=0xf2d152b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xde00)) returned 1 [0140.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.724] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx" (normalized: "c:\\users\\eebsym5\\documents\\gel4xiwhzryv.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\GEl4XIwHzryv.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\gel4xiwhzryv.docx.anonymous")) returned 1 [0140.725] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt", lpFilePart=0x0) returned 0x28 [0140.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.725] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt" (normalized: "c:\\users\\eebsym5\\documents\\jgczxckvh.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.725] GetFileType (hFile=0x154) returned 0x1 [0140.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.725] GetFileType (hFile=0x154) returned 0x1 [0140.725] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x151e5 [0140.725] ReadFile (in: hFile=0x154, lpBuffer=0x2034d398, nNumberOfBytesToRead=0x151e5, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2034d398*, lpNumberOfBytesRead=0x2ae5d4*=0x151e5, lpOverlapped=0x0) returned 1 [0140.727] CloseHandle (hObject=0x154) returned 1 [0140.746] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt", lpFilePart=0x0) returned 0x28 [0140.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.746] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt" (normalized: "c:\\users\\eebsym5\\documents\\jgczxckvh.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.748] GetFileType (hFile=0x154) returned 0x1 [0140.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.748] GetFileType (hFile=0x154) returned 0x1 [0140.748] WriteFile (in: hFile=0x154, lpBuffer=0x203b6d80*, nNumberOfBytesToWrite=0x151f0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x203b6d80*, lpNumberOfBytesWritten=0x2ae5c8*=0x151f0, lpOverlapped=0x0) returned 1 [0140.750] CloseHandle (hObject=0x154) returned 1 [0140.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt", lpFilePart=0x0) returned 0x28 [0140.750] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt.anonymous", lpFilePart=0x0) returned 0x32 [0140.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.750] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt" (normalized: "c:\\users\\eebsym5\\documents\\jgczxckvh.ppt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf823da0, ftCreationTime.dwHighDateTime=0x1d41677, ftLastAccessTime.dwLowDateTime=0x1eb51150, ftLastAccessTime.dwHighDateTime=0x1d41b7a, ftLastWriteTime.dwLowDateTime=0xf2d61570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x151f0)) returned 1 [0140.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.751] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt" (normalized: "c:\\users\\eebsym5\\documents\\jgczxckvh.ppt"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\jGCzXCkVh.ppt.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\jgczxckvh.ppt.anonymous")) returned 1 [0140.762] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf", lpFilePart=0x0) returned 0x28 [0140.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.762] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf" (normalized: "c:\\users\\eebsym5\\documents\\kap0bgsed.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.762] GetFileType (hFile=0x154) returned 0x1 [0140.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.762] GetFileType (hFile=0x154) returned 0x1 [0140.762] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1841b [0140.762] ReadFile (in: hFile=0x154, lpBuffer=0x203cbf90, nNumberOfBytesToRead=0x1841b, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x203cbf90*, lpNumberOfBytesRead=0x2ae5d4*=0x1841b, lpOverlapped=0x0) returned 1 [0140.765] CloseHandle (hObject=0x154) returned 1 [0140.783] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf", lpFilePart=0x0) returned 0x28 [0140.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.784] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf" (normalized: "c:\\users\\eebsym5\\documents\\kap0bgsed.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.786] GetFileType (hFile=0x154) returned 0x1 [0140.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.786] GetFileType (hFile=0x154) returned 0x1 [0140.786] WriteFile (in: hFile=0x154, lpBuffer=0x20445468*, nNumberOfBytesToWrite=0x18420, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x20445468*, lpNumberOfBytesWritten=0x2ae5c8*=0x18420, lpOverlapped=0x0) returned 1 [0140.788] CloseHandle (hObject=0x154) returned 1 [0140.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf", lpFilePart=0x0) returned 0x28 [0140.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf.anonymous", lpFilePart=0x0) returned 0x32 [0140.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf" (normalized: "c:\\users\\eebsym5\\documents\\kap0bgsed.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2d9060, ftCreationTime.dwHighDateTime=0x1d414fa, ftLastAccessTime.dwLowDateTime=0xb13eaa90, ftLastAccessTime.dwHighDateTime=0x1d41ca6, ftLastWriteTime.dwLowDateTime=0xf2dad830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18420)) returned 1 [0140.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.789] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf" (normalized: "c:\\users\\eebsym5\\documents\\kap0bgsed.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\KaP0bgSeD.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\kap0bgsed.pdf.anonymous")) returned 1 [0140.789] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\LXfT.pdf", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf", lpFilePart=0x0) returned 0x23 [0140.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.789] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf" (normalized: "c:\\users\\eebsym5\\documents\\lxft.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.789] GetFileType (hFile=0x154) returned 0x1 [0140.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.790] GetFileType (hFile=0x154) returned 0x1 [0140.790] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x285f [0140.790] ReadFile (in: hFile=0x154, lpBuffer=0x1ac2c50, nNumberOfBytesToRead=0x285f, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ac2c50*, lpNumberOfBytesRead=0x2ae5d4*=0x285f, lpOverlapped=0x0) returned 1 [0140.791] CloseHandle (hObject=0x154) returned 1 [0140.802] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\LXfT.pdf", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf", lpFilePart=0x0) returned 0x23 [0140.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.803] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf" (normalized: "c:\\users\\eebsym5\\documents\\lxft.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.804] GetFileType (hFile=0x154) returned 0x1 [0140.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.804] GetFileType (hFile=0x154) returned 0x1 [0140.804] WriteFile (in: hFile=0x154, lpBuffer=0x1b1c41c*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b1c41c*, lpNumberOfBytesWritten=0x2ae5c8*=0x2860, lpOverlapped=0x0) returned 1 [0140.805] CloseHandle (hObject=0x154) returned 1 [0140.805] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\LXfT.pdf", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf", lpFilePart=0x0) returned 0x23 [0140.805] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\LXfT.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf.anonymous", lpFilePart=0x0) returned 0x2d [0140.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf" (normalized: "c:\\users\\eebsym5\\documents\\lxft.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1d69f0, ftCreationTime.dwHighDateTime=0x1d41d13, ftLastAccessTime.dwLowDateTime=0x8c610740, ftLastAccessTime.dwHighDateTime=0x1d4125b, ftLastWriteTime.dwLowDateTime=0xf2dd3990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2860)) returned 1 [0140.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.805] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf" (normalized: "c:\\users\\eebsym5\\documents\\lxft.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\LXfT.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\lxft.pdf.anonymous")) returned 1 [0140.806] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx", lpFilePart=0x0) returned 0x28 [0140.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.806] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\nfsvvu3w.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.806] GetFileType (hFile=0x154) returned 0x1 [0140.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.806] GetFileType (hFile=0x154) returned 0x1 [0140.806] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x16a05 [0140.807] ReadFile (in: hFile=0x154, lpBuffer=0x2045d8a8, nNumberOfBytesToRead=0x16a05, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2045d8a8*, lpNumberOfBytesRead=0x2ae5d4*=0x16a05, lpOverlapped=0x0) returned 1 [0140.809] CloseHandle (hObject=0x154) returned 1 [0140.836] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx", lpFilePart=0x0) returned 0x28 [0140.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.837] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\nfsvvu3w.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.839] GetFileType (hFile=0x154) returned 0x1 [0140.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.839] GetFileType (hFile=0x154) returned 0x1 [0140.839] WriteFile (in: hFile=0x154, lpBuffer=0x204ceb30*, nNumberOfBytesToWrite=0x16a10, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x204ceb30*, lpNumberOfBytesWritten=0x2ae5c8*=0x16a10, lpOverlapped=0x0) returned 1 [0140.842] CloseHandle (hObject=0x154) returned 1 [0140.842] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx", lpFilePart=0x0) returned 0x28 [0140.842] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx.anonymous", lpFilePart=0x0) returned 0x32 [0140.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\nfsvvu3w.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5b2ae0, ftCreationTime.dwHighDateTime=0x1d422a3, ftLastAccessTime.dwLowDateTime=0x633954d0, ftLastAccessTime.dwHighDateTime=0x1d3f230, ftLastWriteTime.dwLowDateTime=0xf2e1fc50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16a10)) returned 1 [0140.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.842] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\nfsvvu3w.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\nFsVVU3w.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\nfsvvu3w.xlsx.anonymous")) returned 1 [0140.843] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt", lpFilePart=0x0) returned 0x2a [0140.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.843] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt" (normalized: "c:\\users\\eebsym5\\documents\\ovbwsz8ahby.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.844] GetFileType (hFile=0x154) returned 0x1 [0140.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.844] GetFileType (hFile=0x154) returned 0x1 [0140.844] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x7d79 [0140.844] ReadFile (in: hFile=0x154, lpBuffer=0x1b6c0a4, nNumberOfBytesToRead=0x7d79, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b6c0a4*, lpNumberOfBytesRead=0x2ae5d4*=0x7d79, lpOverlapped=0x0) returned 1 [0140.845] CloseHandle (hObject=0x154) returned 1 [0140.948] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt", lpFilePart=0x0) returned 0x2a [0140.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.948] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt" (normalized: "c:\\users\\eebsym5\\documents\\ovbwsz8ahby.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.951] GetFileType (hFile=0x154) returned 0x1 [0140.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.951] GetFileType (hFile=0x154) returned 0x1 [0140.951] WriteFile (in: hFile=0x154, lpBuffer=0x19e7fe4*, nNumberOfBytesToWrite=0x7d80, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19e7fe4*, lpNumberOfBytesWritten=0x2ae5c8*=0x7d80, lpOverlapped=0x0) returned 1 [0140.953] CloseHandle (hObject=0x154) returned 1 [0140.953] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt", lpFilePart=0x0) returned 0x2a [0140.953] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt.anonymous", lpFilePart=0x0) returned 0x34 [0140.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt" (normalized: "c:\\users\\eebsym5\\documents\\ovbwsz8ahby.ppt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14e4b60, ftCreationTime.dwHighDateTime=0x1d41191, ftLastAccessTime.dwLowDateTime=0x8c64dfa0, ftLastAccessTime.dwHighDateTime=0x1d4144f, ftLastWriteTime.dwLowDateTime=0xf2f50750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d80)) returned 1 [0140.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.953] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt" (normalized: "c:\\users\\eebsym5\\documents\\ovbwsz8ahby.ppt"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\OVbwSz8ahBy.ppt.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\ovbwsz8ahby.ppt.anonymous")) returned 1 [0140.954] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\rigyw.docx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx", lpFilePart=0x0) returned 0x25 [0140.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.954] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx" (normalized: "c:\\users\\eebsym5\\documents\\rigyw.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.954] GetFileType (hFile=0x154) returned 0x1 [0140.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.954] GetFileType (hFile=0x154) returned 0x1 [0140.954] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x2b89 [0140.954] ReadFile (in: hFile=0x154, lpBuffer=0x19f00b4, nNumberOfBytesToRead=0x2b89, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19f00b4*, lpNumberOfBytesRead=0x2ae5d4*=0x2b89, lpOverlapped=0x0) returned 1 [0140.955] CloseHandle (hObject=0x154) returned 1 [0140.976] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\rigyw.docx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx", lpFilePart=0x0) returned 0x25 [0140.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0140.977] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx" (normalized: "c:\\users\\eebsym5\\documents\\rigyw.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.978] GetFileType (hFile=0x154) returned 0x1 [0140.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0140.978] GetFileType (hFile=0x154) returned 0x1 [0140.978] WriteFile (in: hFile=0x154, lpBuffer=0x1a4a9cc*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a4a9cc*, lpNumberOfBytesWritten=0x2ae5c8*=0x2b90, lpOverlapped=0x0) returned 1 [0140.979] CloseHandle (hObject=0x154) returned 1 [0140.979] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\rigyw.docx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx", lpFilePart=0x0) returned 0x25 [0140.979] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\rigyw.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx.anonymous", lpFilePart=0x0) returned 0x2f [0140.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0140.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx" (normalized: "c:\\users\\eebsym5\\documents\\rigyw.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a8e9a0, ftCreationTime.dwHighDateTime=0x1d41001, ftLastAccessTime.dwLowDateTime=0x639bde60, ftLastAccessTime.dwHighDateTime=0x1d41757, ftLastWriteTime.dwLowDateTime=0xf2f768b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2b90)) returned 1 [0140.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0140.980] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx" (normalized: "c:\\users\\eebsym5\\documents\\rigyw.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\rigyw.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\rigyw.docx.anonymous")) returned 1 [0140.980] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx", lpFilePart=0x0) returned 0x2e [0140.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0140.980] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\sbfjqhupcn1ibx.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0140.980] GetFileType (hFile=0x154) returned 0x1 [0140.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0140.980] GetFileType (hFile=0x154) returned 0x1 [0140.980] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1188e [0140.981] ReadFile (in: hFile=0x154, lpBuffer=0x1a4d880, nNumberOfBytesToRead=0x1188e, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a4d880*, lpNumberOfBytesRead=0x2ae5d4*=0x1188e, lpOverlapped=0x0) returned 1 [0140.983] CloseHandle (hObject=0x154) returned 1 [0141.029] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx", lpFilePart=0x0) returned 0x2e [0141.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.029] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\sbfjqhupcn1ibx.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.031] GetFileType (hFile=0x154) returned 0x1 [0141.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.031] GetFileType (hFile=0x154) returned 0x1 [0141.031] WriteFile (in: hFile=0x154, lpBuffer=0x1acf030*, nNumberOfBytesToWrite=0x11890, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1acf030*, lpNumberOfBytesWritten=0x2ae5c8*=0x11890, lpOverlapped=0x0) returned 1 [0141.033] CloseHandle (hObject=0x154) returned 1 [0141.033] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx", lpFilePart=0x0) returned 0x2e [0141.033] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx.anonymous", lpFilePart=0x0) returned 0x38 [0141.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\sbfjqhupcn1ibx.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9002c270, ftCreationTime.dwHighDateTime=0x1d3e903, ftLastAccessTime.dwLowDateTime=0x1a194b70, ftLastAccessTime.dwHighDateTime=0x1d3cd41, ftLastWriteTime.dwLowDateTime=0xf300ee30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11890)) returned 1 [0141.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.033] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\sbfjqhupcn1ibx.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\SbFjqHuPCn1Ibx.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\sbfjqhupcn1ibx.xlsx.anonymous")) returned 1 [0141.034] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx", lpFilePart=0x0) returned 0x28 [0141.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.034] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx" (normalized: "c:\\users\\eebsym5\\documents\\sjuxl3ot.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.034] GetFileType (hFile=0x154) returned 0x1 [0141.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.034] GetFileType (hFile=0x154) returned 0x1 [0141.034] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1590e [0141.035] ReadFile (in: hFile=0x154, lpBuffer=0x20508680, nNumberOfBytesToRead=0x1590e, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x20508680*, lpNumberOfBytesRead=0x2ae5d4*=0x1590e, lpOverlapped=0x0) returned 1 [0141.037] CloseHandle (hObject=0x154) returned 1 [0141.097] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx", lpFilePart=0x0) returned 0x28 [0141.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.097] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx" (normalized: "c:\\users\\eebsym5\\documents\\sjuxl3ot.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.099] GetFileType (hFile=0x154) returned 0x1 [0141.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.099] GetFileType (hFile=0x154) returned 0x1 [0141.099] WriteFile (in: hFile=0x154, lpBuffer=0x20574410*, nNumberOfBytesToWrite=0x15910, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x20574410*, lpNumberOfBytesWritten=0x2ae5c8*=0x15910, lpOverlapped=0x0) returned 1 [0141.101] CloseHandle (hObject=0x154) returned 1 [0141.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx", lpFilePart=0x0) returned 0x28 [0141.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx.anonymous", lpFilePart=0x0) returned 0x32 [0141.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx" (normalized: "c:\\users\\eebsym5\\documents\\sjuxl3ot.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e7bce0, ftCreationTime.dwHighDateTime=0x1d41e48, ftLastAccessTime.dwLowDateTime=0xdc71e0e0, ftLastAccessTime.dwHighDateTime=0x1d3dd4c, ftLastWriteTime.dwLowDateTime=0xf30a73b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15910)) returned 1 [0141.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.102] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx" (normalized: "c:\\users\\eebsym5\\documents\\sjuxl3ot.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\SjUXl3ot.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\sjuxl3ot.docx.anonymous")) returned 1 [0141.103] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx", lpFilePart=0x0) returned 0x29 [0141.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.103] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx" (normalized: "c:\\users\\eebsym5\\documents\\so4fj0el4.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.104] GetFileType (hFile=0x154) returned 0x1 [0141.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.104] GetFileType (hFile=0x154) returned 0x1 [0141.104] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x6ac0 [0141.104] ReadFile (in: hFile=0x154, lpBuffer=0x1b2dd50, nNumberOfBytesToRead=0x6ac0, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b2dd50*, lpNumberOfBytesRead=0x2ae5d4*=0x6ac0, lpOverlapped=0x0) returned 1 [0141.105] CloseHandle (hObject=0x154) returned 1 [0141.133] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx", lpFilePart=0x0) returned 0x29 [0141.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.133] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx" (normalized: "c:\\users\\eebsym5\\documents\\so4fj0el4.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.135] GetFileType (hFile=0x154) returned 0x1 [0141.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.135] GetFileType (hFile=0x154) returned 0x1 [0141.135] WriteFile (in: hFile=0x154, lpBuffer=0x19a0e6c*, nNumberOfBytesToWrite=0x6ad0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19a0e6c*, lpNumberOfBytesWritten=0x2ae5c8*=0x6ad0, lpOverlapped=0x0) returned 1 [0141.136] CloseHandle (hObject=0x154) returned 1 [0141.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx", lpFilePart=0x0) returned 0x29 [0141.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx.anonymous", lpFilePart=0x0) returned 0x33 [0141.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx" (normalized: "c:\\users\\eebsym5\\documents\\so4fj0el4.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f7e8970, ftCreationTime.dwHighDateTime=0x1d3fb75, ftLastAccessTime.dwLowDateTime=0xebf5e820, ftLastAccessTime.dwHighDateTime=0x1d3cd22, ftLastWriteTime.dwLowDateTime=0xf30f3670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6ad0)) returned 1 [0141.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.137] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx" (normalized: "c:\\users\\eebsym5\\documents\\so4fj0el4.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\sO4Fj0El4.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\so4fj0el4.pptx.anonymous")) returned 1 [0141.137] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx", lpFilePart=0x0) returned 0x26 [0141.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.137] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx" (normalized: "c:\\users\\eebsym5\\documents\\v_uncq.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.138] GetFileType (hFile=0x154) returned 0x1 [0141.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.138] GetFileType (hFile=0x154) returned 0x1 [0141.138] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xa366 [0141.138] ReadFile (in: hFile=0x154, lpBuffer=0x19a7c68, nNumberOfBytesToRead=0xa366, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19a7c68*, lpNumberOfBytesRead=0x2ae5d4*=0xa366, lpOverlapped=0x0) returned 1 [0141.139] CloseHandle (hObject=0x154) returned 1 [0141.213] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx", lpFilePart=0x0) returned 0x26 [0141.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.213] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx" (normalized: "c:\\users\\eebsym5\\documents\\v_uncq.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.216] GetFileType (hFile=0x154) returned 0x1 [0141.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.216] GetFileType (hFile=0x154) returned 0x1 [0141.216] WriteFile (in: hFile=0x154, lpBuffer=0x1a27ce0*, nNumberOfBytesToWrite=0xa370, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a27ce0*, lpNumberOfBytesWritten=0x2ae5c8*=0xa370, lpOverlapped=0x0) returned 1 [0141.242] CloseHandle (hObject=0x154) returned 1 [0141.242] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx", lpFilePart=0x0) returned 0x26 [0141.242] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx.anonymous", lpFilePart=0x0) returned 0x30 [0141.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx" (normalized: "c:\\users\\eebsym5\\documents\\v_uncq.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d767f0, ftCreationTime.dwHighDateTime=0x1d40aa4, ftLastAccessTime.dwLowDateTime=0xee614920, ftLastAccessTime.dwHighDateTime=0x1d41e7f, ftLastWriteTime.dwLowDateTime=0xf31fe010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa370)) returned 1 [0141.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.243] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx" (normalized: "c:\\users\\eebsym5\\documents\\v_uncq.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\V_UNCQ.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\v_uncq.pptx.anonymous")) returned 1 [0141.243] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\xoB7x.pptx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx", lpFilePart=0x0) returned 0x25 [0141.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.243] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx" (normalized: "c:\\users\\eebsym5\\documents\\xob7x.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.243] GetFileType (hFile=0x154) returned 0x1 [0141.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.244] GetFileType (hFile=0x154) returned 0x1 [0141.244] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x111c6 [0141.244] ReadFile (in: hFile=0x154, lpBuffer=0x1a32360, nNumberOfBytesToRead=0x111c6, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a32360*, lpNumberOfBytesRead=0x2ae5d4*=0x111c6, lpOverlapped=0x0) returned 1 [0141.245] CloseHandle (hObject=0x154) returned 1 [0141.259] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\xoB7x.pptx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx", lpFilePart=0x0) returned 0x25 [0141.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.259] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx" (normalized: "c:\\users\\eebsym5\\documents\\xob7x.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.261] GetFileType (hFile=0x154) returned 0x1 [0141.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.261] GetFileType (hFile=0x154) returned 0x1 [0141.261] WriteFile (in: hFile=0x154, lpBuffer=0x1ab26d0*, nNumberOfBytesToWrite=0x111d0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1ab26d0*, lpNumberOfBytesWritten=0x2ae5c8*=0x111d0, lpOverlapped=0x0) returned 1 [0141.263] CloseHandle (hObject=0x154) returned 1 [0141.263] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\xoB7x.pptx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx", lpFilePart=0x0) returned 0x25 [0141.263] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\xoB7x.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx.anonymous", lpFilePart=0x0) returned 0x2f [0141.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.263] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx" (normalized: "c:\\users\\eebsym5\\documents\\xob7x.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39682a0, ftCreationTime.dwHighDateTime=0x1d3e778, ftLastAccessTime.dwLowDateTime=0x7ec4c2b0, ftLastAccessTime.dwHighDateTime=0x1d3c7f7, ftLastWriteTime.dwLowDateTime=0xf3224170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x111d0)) returned 1 [0141.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.263] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx" (normalized: "c:\\users\\eebsym5\\documents\\xob7x.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\xoB7x.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\xob7x.pptx.anonymous")) returned 1 [0141.264] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx", lpFilePart=0x0) returned 0x29 [0141.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.264] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx" (normalized: "c:\\users\\eebsym5\\documents\\yetfuyz0w.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.264] GetFileType (hFile=0x154) returned 0x1 [0141.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.264] GetFileType (hFile=0x154) returned 0x1 [0141.264] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x5ce7 [0141.264] ReadFile (in: hFile=0x154, lpBuffer=0x1ac3bb0, nNumberOfBytesToRead=0x5ce7, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ac3bb0*, lpNumberOfBytesRead=0x2ae5d4*=0x5ce7, lpOverlapped=0x0) returned 1 [0141.265] CloseHandle (hObject=0x154) returned 1 [0141.278] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx", lpFilePart=0x0) returned 0x29 [0141.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.278] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx" (normalized: "c:\\users\\eebsym5\\documents\\yetfuyz0w.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.280] GetFileType (hFile=0x154) returned 0x1 [0141.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.280] GetFileType (hFile=0x154) returned 0x1 [0141.280] WriteFile (in: hFile=0x154, lpBuffer=0x1b2da4c*, nNumberOfBytesToWrite=0x5cf0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b2da4c*, lpNumberOfBytesWritten=0x2ae5c8*=0x5cf0, lpOverlapped=0x0) returned 1 [0141.282] CloseHandle (hObject=0x154) returned 1 [0141.282] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx", lpFilePart=0x0) returned 0x29 [0141.282] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx.anonymous", lpFilePart=0x0) returned 0x33 [0141.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx" (normalized: "c:\\users\\eebsym5\\documents\\yetfuyz0w.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a54d60, ftCreationTime.dwHighDateTime=0x1d3da29, ftLastAccessTime.dwLowDateTime=0xacfefcb0, ftLastAccessTime.dwHighDateTime=0x1d3c9b2, ftLastWriteTime.dwLowDateTime=0xf3270430, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5cf0)) returned 1 [0141.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.282] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx" (normalized: "c:\\users\\eebsym5\\documents\\yetfuyz0w.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\YEtfuyZ0w.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\yetfuyz0w.pptx.anonymous")) returned 1 [0141.283] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx", lpFilePart=0x0) returned 0x33 [0141.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.283] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx" (normalized: "c:\\users\\eebsym5\\documents\\zjoboq_-gg2cnqk9zfn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.283] GetFileType (hFile=0x154) returned 0x1 [0141.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.283] GetFileType (hFile=0x154) returned 0x1 [0141.283] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x3083 [0141.283] ReadFile (in: hFile=0x154, lpBuffer=0x1b33a9c, nNumberOfBytesToRead=0x3083, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b33a9c*, lpNumberOfBytesRead=0x2ae5d4*=0x3083, lpOverlapped=0x0) returned 1 [0141.284] CloseHandle (hObject=0x154) returned 1 [0141.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx", lpFilePart=0x0) returned 0x33 [0141.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.297] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx" (normalized: "c:\\users\\eebsym5\\documents\\zjoboq_-gg2cnqk9zfn.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.299] GetFileType (hFile=0x154) returned 0x1 [0141.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.299] GetFileType (hFile=0x154) returned 0x1 [0141.299] WriteFile (in: hFile=0x154, lpBuffer=0x1b8fb58*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b8fb58*, lpNumberOfBytesWritten=0x2ae5c8*=0x3090, lpOverlapped=0x0) returned 1 [0141.300] CloseHandle (hObject=0x154) returned 1 [0141.300] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx", lpFilePart=0x0) returned 0x33 [0141.300] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx.anonymous", lpFilePart=0x0) returned 0x3d [0141.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx" (normalized: "c:\\users\\eebsym5\\documents\\zjoboq_-gg2cnqk9zfn.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f27fd0, ftCreationTime.dwHighDateTime=0x1d3e518, ftLastAccessTime.dwLowDateTime=0x568235e0, ftLastAccessTime.dwHighDateTime=0x1d3c625, ftLastWriteTime.dwLowDateTime=0xf3296590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3090)) returned 1 [0141.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.300] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx" (normalized: "c:\\users\\eebsym5\\documents\\zjoboq_-gg2cnqk9zfn.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\ZJoBOQ_-GG2CNqK9zfN.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\zjoboq_-gg2cnqk9zfn.pptx.anonymous")) returned 1 [0141.301] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx", lpFilePart=0x0) returned 0x26 [0141.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0141.301] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\_lrhld.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.301] GetFileType (hFile=0x154) returned 0x1 [0141.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0141.301] GetFileType (hFile=0x154) returned 0x1 [0141.301] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x15727 [0141.302] ReadFile (in: hFile=0x154, lpBuffer=0x205ac0e0, nNumberOfBytesToRead=0x15727, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x205ac0e0*, lpNumberOfBytesRead=0x2ae5d4*=0x15727, lpOverlapped=0x0) returned 1 [0141.304] CloseHandle (hObject=0x154) returned 1 [0141.345] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx", lpFilePart=0x0) returned 0x26 [0141.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0141.345] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\_lrhld.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.347] GetFileType (hFile=0x154) returned 0x1 [0141.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0141.347] GetFileType (hFile=0x154) returned 0x1 [0141.347] WriteFile (in: hFile=0x154, lpBuffer=0x20617508*, nNumberOfBytesToWrite=0x15730, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x20617508*, lpNumberOfBytesWritten=0x2ae5c8*=0x15730, lpOverlapped=0x0) returned 1 [0141.349] CloseHandle (hObject=0x154) returned 1 [0141.349] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx", lpFilePart=0x0) returned 0x26 [0141.350] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx.anonymous", lpFilePart=0x0) returned 0x30 [0141.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0141.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\_lrhld.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee14cb60, ftCreationTime.dwHighDateTime=0x1d4181f, ftLastAccessTime.dwLowDateTime=0x3122cac0, ftLastAccessTime.dwHighDateTime=0x1d41342, ftLastWriteTime.dwLowDateTime=0xf33089b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15730)) returned 1 [0141.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.350] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\_lrhld.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\_lRhLD.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\_lrhld.xlsx.anonymous")) returned 1 [0141.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0141.350] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4", lpFilePart=0x0) returned 0x2d [0141.351] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\", lpFilePart=0x0) returned 0x2e [0141.351] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.351] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.352] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.352] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.352] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.352] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.352] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0141.352] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0141.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0141.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0141.352] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4", lpFilePart=0x0) returned 0x2d [0141.352] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\", lpFilePart=0x0) returned 0x2e [0141.352] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0141.352] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.353] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0141.354] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0141.354] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0141.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0141.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0141.354] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx", lpFilePart=0x0) returned 0x46 [0141.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.354] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\-xs1a3ez59p4fx94hmc.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.354] GetFileType (hFile=0x154) returned 0x1 [0141.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.354] GetFileType (hFile=0x154) returned 0x1 [0141.354] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc12f [0141.354] ReadFile (in: hFile=0x154, lpBuffer=0x19d4adc, nNumberOfBytesToRead=0xc12f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19d4adc*, lpNumberOfBytesRead=0x2ae560*=0xc12f, lpOverlapped=0x0) returned 1 [0141.356] CloseHandle (hObject=0x154) returned 1 [0141.369] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx", lpFilePart=0x0) returned 0x46 [0141.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.369] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\-xs1a3ez59p4fx94hmc.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.371] GetFileType (hFile=0x154) returned 0x1 [0141.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.371] GetFileType (hFile=0x154) returned 0x1 [0141.371] WriteFile (in: hFile=0x154, lpBuffer=0x1a45dc8*, nNumberOfBytesToWrite=0xc130, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a45dc8*, lpNumberOfBytesWritten=0x2ae554*=0xc130, lpOverlapped=0x0) returned 1 [0141.375] CloseHandle (hObject=0x154) returned 1 [0141.375] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx", lpFilePart=0x0) returned 0x46 [0141.375] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx.anonymous", lpFilePart=0x0) returned 0x50 [0141.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.375] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\-xs1a3ez59p4fx94hmc.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41a0630, ftCreationTime.dwHighDateTime=0x1d41017, ftLastAccessTime.dwLowDateTime=0x75cf2790, ftLastAccessTime.dwHighDateTime=0x1d41a3b, ftLastWriteTime.dwLowDateTime=0xf3354c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc130)) returned 1 [0141.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.376] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\-xs1a3ez59p4fx94hmc.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\-xS1a3Ez59p4Fx94HMc.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\-xs1a3ez59p4fx94hmc.xlsx.anonymous")) returned 1 [0141.376] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf", lpFilePart=0x0) returned 0x3f [0141.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.376] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\6hwrivnjo6io9.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.377] GetFileType (hFile=0x154) returned 0x1 [0141.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.377] GetFileType (hFile=0x154) returned 0x1 [0141.377] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x173b3 [0141.377] ReadFile (in: hFile=0x154, lpBuffer=0x20644eb8, nNumberOfBytesToRead=0x173b3, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x20644eb8*, lpNumberOfBytesRead=0x2ae560*=0x173b3, lpOverlapped=0x0) returned 1 [0141.379] CloseHandle (hObject=0x154) returned 1 [0141.405] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf", lpFilePart=0x0) returned 0x3f [0141.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.405] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\6hwrivnjo6io9.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.410] GetFileType (hFile=0x154) returned 0x1 [0141.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.410] GetFileType (hFile=0x154) returned 0x1 [0141.410] WriteFile (in: hFile=0x154, lpBuffer=0x2068aa28*, nNumberOfBytesToWrite=0x173c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2068aa28*, lpNumberOfBytesWritten=0x2ae554*=0x173c0, lpOverlapped=0x0) returned 1 [0141.412] CloseHandle (hObject=0x154) returned 1 [0141.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf", lpFilePart=0x0) returned 0x3f [0141.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf.anonymous", lpFilePart=0x0) returned 0x49 [0141.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\6hwrivnjo6io9.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c28dd50, ftCreationTime.dwHighDateTime=0x1d41932, ftLastAccessTime.dwLowDateTime=0xb839bbb0, ftLastAccessTime.dwHighDateTime=0x1d41926, ftLastWriteTime.dwLowDateTime=0xf33a0f30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x173c0)) returned 1 [0141.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.413] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\6hwrivnjo6io9.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\6hwRiVNjo6io9.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\6hwrivnjo6io9.pdf.anonymous")) returned 1 [0141.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv", lpFilePart=0x0) returned 0x46 [0141.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.413] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\o_-enchtnlsdgjfi-4n8.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.414] GetFileType (hFile=0x154) returned 0x1 [0141.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.414] GetFileType (hFile=0x154) returned 0x1 [0141.414] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1724c [0141.414] ReadFile (in: hFile=0x154, lpBuffer=0x6a3f798, nNumberOfBytesToRead=0x1724c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x6a3f798*, lpNumberOfBytesRead=0x2ae560*=0x1724c, lpOverlapped=0x0) returned 1 [0141.416] CloseHandle (hObject=0x154) returned 1 [0141.461] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv", lpFilePart=0x0) returned 0x46 [0141.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.461] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\o_-enchtnlsdgjfi-4n8.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.463] GetFileType (hFile=0x154) returned 0x1 [0141.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.463] GetFileType (hFile=0x154) returned 0x1 [0141.463] WriteFile (in: hFile=0x154, lpBuffer=0x6ab3360*, nNumberOfBytesToWrite=0x17250, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x6ab3360*, lpNumberOfBytesWritten=0x2ae554*=0x17250, lpOverlapped=0x0) returned 1 [0141.466] CloseHandle (hObject=0x154) returned 1 [0141.466] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv", lpFilePart=0x0) returned 0x46 [0141.466] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv.anonymous", lpFilePart=0x0) returned 0x50 [0141.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.466] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\o_-enchtnlsdgjfi-4n8.csv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c5a440, ftCreationTime.dwHighDateTime=0x1d41901, ftLastAccessTime.dwLowDateTime=0x19b755b0, ftLastAccessTime.dwHighDateTime=0x1d41bab, ftLastWriteTime.dwLowDateTime=0xf3413350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17250)) returned 1 [0141.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.466] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\o_-enchtnlsdgjfi-4n8.csv"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\O_-EnChtnLSdGjfi-4N8.csv.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\o_-enchtnlsdgjfi-4n8.csv.anonymous")) returned 1 [0141.468] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc", lpFilePart=0x0) returned 0x3c [0141.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.468] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\q-xk2ckhb1.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.468] GetFileType (hFile=0x154) returned 0x1 [0141.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.468] GetFileType (hFile=0x154) returned 0x1 [0141.468] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x15371 [0141.468] ReadFile (in: hFile=0x154, lpBuffer=0x6aca5d0, nNumberOfBytesToRead=0x15371, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x6aca5d0*, lpNumberOfBytesRead=0x2ae560*=0x15371, lpOverlapped=0x0) returned 1 [0141.470] CloseHandle (hObject=0x154) returned 1 [0141.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc", lpFilePart=0x0) returned 0x3c [0141.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.490] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\q-xk2ckhb1.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.492] GetFileType (hFile=0x154) returned 0x1 [0141.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.492] GetFileType (hFile=0x154) returned 0x1 [0141.492] WriteFile (in: hFile=0x154, lpBuffer=0x6b34780*, nNumberOfBytesToWrite=0x15380, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x6b34780*, lpNumberOfBytesWritten=0x2ae554*=0x15380, lpOverlapped=0x0) returned 1 [0141.495] CloseHandle (hObject=0x154) returned 1 [0141.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc", lpFilePart=0x0) returned 0x3c [0141.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc.anonymous", lpFilePart=0x0) returned 0x46 [0141.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.495] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\q-xk2ckhb1.doc"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc561f3e0, ftCreationTime.dwHighDateTime=0x1d41e8d, ftLastAccessTime.dwLowDateTime=0x5321c760, ftLastAccessTime.dwHighDateTime=0x1d41c49, ftLastWriteTime.dwLowDateTime=0xf345f610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15380)) returned 1 [0141.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.495] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\q-xk2ckhb1.doc"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\q-XK2ckHb1.doc.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\q-xk2ckhb1.doc.anonymous")) returned 1 [0141.496] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx", lpFilePart=0x0) returned 0x38 [0141.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.496] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\tqnz7.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.496] GetFileType (hFile=0x154) returned 0x1 [0141.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.496] GetFileType (hFile=0x154) returned 0x1 [0141.496] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3e28 [0141.496] ReadFile (in: hFile=0x154, lpBuffer=0x1b39a0c, nNumberOfBytesToRead=0x3e28, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b39a0c*, lpNumberOfBytesRead=0x2ae560*=0x3e28, lpOverlapped=0x0) returned 1 [0141.497] CloseHandle (hObject=0x154) returned 1 [0141.535] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx", lpFilePart=0x0) returned 0x38 [0141.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.535] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\tqnz7.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.537] GetFileType (hFile=0x154) returned 0x1 [0141.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.537] GetFileType (hFile=0x154) returned 0x1 [0141.537] WriteFile (in: hFile=0x154, lpBuffer=0x199e3ac*, nNumberOfBytesToWrite=0x3e30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x199e3ac*, lpNumberOfBytesWritten=0x2ae554*=0x3e30, lpOverlapped=0x0) returned 1 [0141.538] CloseHandle (hObject=0x154) returned 1 [0141.538] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx", lpFilePart=0x0) returned 0x38 [0141.538] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx.anonymous", lpFilePart=0x0) returned 0x42 [0141.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\tqnz7.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdddb3570, ftCreationTime.dwHighDateTime=0x1d41d35, ftLastAccessTime.dwLowDateTime=0xb1e27ef0, ftLastAccessTime.dwHighDateTime=0x1d417b4, ftLastWriteTime.dwLowDateTime=0xf34d1a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3e30)) returned 1 [0141.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.538] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\tqnz7.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\TqNZ7.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\tqnz7.xlsx.anonymous")) returned 1 [0141.539] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf", lpFilePart=0x0) returned 0x39 [0141.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.539] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\uiyff6z.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.539] GetFileType (hFile=0x154) returned 0x1 [0141.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.539] GetFileType (hFile=0x154) returned 0x1 [0141.539] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8e55 [0141.539] ReadFile (in: hFile=0x154, lpBuffer=0x19a25a4, nNumberOfBytesToRead=0x8e55, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19a25a4*, lpNumberOfBytesRead=0x2ae560*=0x8e55, lpOverlapped=0x0) returned 1 [0141.540] CloseHandle (hObject=0x154) returned 1 [0141.553] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf", lpFilePart=0x0) returned 0x39 [0141.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.553] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\uiyff6z.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.555] GetFileType (hFile=0x154) returned 0x1 [0141.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.555] GetFileType (hFile=0x154) returned 0x1 [0141.555] WriteFile (in: hFile=0x154, lpBuffer=0x1a1bccc*, nNumberOfBytesToWrite=0x8e60, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a1bccc*, lpNumberOfBytesWritten=0x2ae554*=0x8e60, lpOverlapped=0x0) returned 1 [0141.556] CloseHandle (hObject=0x154) returned 1 [0141.556] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf", lpFilePart=0x0) returned 0x39 [0141.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf.anonymous", lpFilePart=0x0) returned 0x43 [0141.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\uiyff6z.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93685d90, ftCreationTime.dwHighDateTime=0x1d410c1, ftLastAccessTime.dwLowDateTime=0x6862e350, ftLastAccessTime.dwHighDateTime=0x1d4170a, ftLastWriteTime.dwLowDateTime=0xf34f7b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8e60)) returned 1 [0141.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.557] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\uiyff6z.rtf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\UiYFf6z.rtf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\uiyff6z.rtf.anonymous")) returned 1 [0141.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx", lpFilePart=0x0) returned 0x44 [0141.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0141.557] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\wue9lfrqwwhyo9yq2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.558] GetFileType (hFile=0x154) returned 0x1 [0141.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0141.558] GetFileType (hFile=0x154) returned 0x1 [0141.558] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2f0f [0141.558] ReadFile (in: hFile=0x154, lpBuffer=0x1a24f24, nNumberOfBytesToRead=0x2f0f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a24f24*, lpNumberOfBytesRead=0x2ae560*=0x2f0f, lpOverlapped=0x0) returned 1 [0141.559] CloseHandle (hObject=0x154) returned 1 [0141.571] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx", lpFilePart=0x0) returned 0x44 [0141.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0141.571] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\wue9lfrqwwhyo9yq2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.572] GetFileType (hFile=0x154) returned 0x1 [0141.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0141.572] GetFileType (hFile=0x154) returned 0x1 [0141.572] WriteFile (in: hFile=0x154, lpBuffer=0x1a80860*, nNumberOfBytesToWrite=0x2f10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a80860*, lpNumberOfBytesWritten=0x2ae554*=0x2f10, lpOverlapped=0x0) returned 1 [0141.574] CloseHandle (hObject=0x154) returned 1 [0141.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx", lpFilePart=0x0) returned 0x44 [0141.574] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx.anonymous", lpFilePart=0x0) returned 0x4e [0141.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0141.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\wue9lfrqwwhyo9yq2.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x878a7110, ftCreationTime.dwHighDateTime=0x1d4187e, ftLastAccessTime.dwLowDateTime=0x40a09a40, ftLastAccessTime.dwHighDateTime=0x1d4160d, ftLastWriteTime.dwLowDateTime=0xf351dcf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f10)) returned 1 [0141.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.574] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\wue9lfrqwwhyo9yq2.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\WUE9LfRqWWHYo9yq2.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\wue9lfrqwwhyo9yq2.pptx.anonymous")) returned 1 [0141.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0141.575] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ", lpFilePart=0x0) returned 0x33 [0141.575] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\", lpFilePart=0x0) returned 0x34 [0141.575] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0141.575] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.575] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.575] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.575] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.575] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.575] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.576] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.576] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.576] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0141.576] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0141.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0141.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0141.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ", lpFilePart=0x0) returned 0x33 [0141.577] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\", lpFilePart=0x0) returned 0x34 [0141.577] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0141.577] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.577] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.577] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.577] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.577] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.577] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.578] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.578] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0141.578] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0141.578] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0141.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0141.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0141.578] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx", lpFilePart=0x0) returned 0x49 [0141.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0141.578] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\gkbawditzqsqc6mt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.578] GetFileType (hFile=0x154) returned 0x1 [0141.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0141.578] GetFileType (hFile=0x154) returned 0x1 [0141.578] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x10495 [0141.578] ReadFile (in: hFile=0x154, lpBuffer=0x1a86640, nNumberOfBytesToRead=0x10495, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a86640*, lpNumberOfBytesRead=0x2ae4ec*=0x10495, lpOverlapped=0x0) returned 1 [0141.580] CloseHandle (hObject=0x154) returned 1 [0141.594] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx", lpFilePart=0x0) returned 0x49 [0141.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0141.594] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\gkbawditzqsqc6mt.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.596] GetFileType (hFile=0x154) returned 0x1 [0141.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0141.596] GetFileType (hFile=0x154) returned 0x1 [0141.596] WriteFile (in: hFile=0x154, lpBuffer=0x1b04220*, nNumberOfBytesToWrite=0x104a0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b04220*, lpNumberOfBytesWritten=0x2ae4e0*=0x104a0, lpOverlapped=0x0) returned 1 [0141.598] CloseHandle (hObject=0x154) returned 1 [0141.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx", lpFilePart=0x0) returned 0x49 [0141.598] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx.anonymous", lpFilePart=0x0) returned 0x53 [0141.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0141.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\gkbawditzqsqc6mt.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3311480, ftCreationTime.dwHighDateTime=0x1d419d5, ftLastAccessTime.dwLowDateTime=0x92f92110, ftLastAccessTime.dwHighDateTime=0x1d40ffd, ftLastWriteTime.dwLowDateTime=0xf3569fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x104a0)) returned 1 [0141.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.598] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\gkbawditzqsqc6mt.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\gkbAwdItzqSQC6mT.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\gkbawditzqsqc6mt.docx.anonymous")) returned 1 [0141.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv", lpFilePart=0x0) returned 0x43 [0141.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0141.599] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\g_qvdhvzgod.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.599] GetFileType (hFile=0x154) returned 0x1 [0141.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0141.599] GetFileType (hFile=0x154) returned 0x1 [0141.599] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x18f50 [0141.600] ReadFile (in: hFile=0x154, lpBuffer=0x6b6a460, nNumberOfBytesToRead=0x18f50, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x6b6a460*, lpNumberOfBytesRead=0x2ae4ec*=0x18f50, lpOverlapped=0x0) returned 1 [0141.602] CloseHandle (hObject=0x154) returned 1 [0141.621] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv", lpFilePart=0x0) returned 0x43 [0141.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0141.621] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\g_qvdhvzgod.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.623] GetFileType (hFile=0x154) returned 0x1 [0141.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0141.623] GetFileType (hFile=0x154) returned 0x1 [0141.623] WriteFile (in: hFile=0x154, lpBuffer=0x6be7170*, nNumberOfBytesToWrite=0x18f60, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x6be7170*, lpNumberOfBytesWritten=0x2ae4e0*=0x18f60, lpOverlapped=0x0) returned 1 [0141.626] CloseHandle (hObject=0x154) returned 1 [0141.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv", lpFilePart=0x0) returned 0x43 [0141.626] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv.anonymous", lpFilePart=0x0) returned 0x4d [0141.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0141.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\g_qvdhvzgod.csv"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81bf6310, ftCreationTime.dwHighDateTime=0x1d41ff1, ftLastAccessTime.dwLowDateTime=0xbb5fe270, ftLastAccessTime.dwHighDateTime=0x1d41e2a, ftLastWriteTime.dwLowDateTime=0xf35b6270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18f60)) returned 1 [0141.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.626] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\g_qvdhvzgod.csv"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\g_QvdhVzGOD.csv.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\g_qvdhvzgod.csv.anonymous")) returned 1 [0141.627] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc", lpFilePart=0x0) returned 0x46 [0141.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0141.627] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\meafmi4_oyqdhv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.627] GetFileType (hFile=0x154) returned 0x1 [0141.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0141.627] GetFileType (hFile=0x154) returned 0x1 [0141.627] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x13539 [0141.627] ReadFile (in: hFile=0x154, lpBuffer=0x1b61d80, nNumberOfBytesToRead=0x13539, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b61d80*, lpNumberOfBytesRead=0x2ae4ec*=0x13539, lpOverlapped=0x0) returned 1 [0141.628] CloseHandle (hObject=0x154) returned 1 [0141.666] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc", lpFilePart=0x0) returned 0x46 [0141.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0141.666] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\meafmi4_oyqdhv.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.667] GetFileType (hFile=0x154) returned 0x1 [0141.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0141.668] GetFileType (hFile=0x154) returned 0x1 [0141.668] WriteFile (in: hFile=0x154, lpBuffer=0x19f8710*, nNumberOfBytesToWrite=0x13540, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19f8710*, lpNumberOfBytesWritten=0x2ae4e0*=0x13540, lpOverlapped=0x0) returned 1 [0141.672] CloseHandle (hObject=0x154) returned 1 [0141.672] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc", lpFilePart=0x0) returned 0x46 [0141.672] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc.anonymous", lpFilePart=0x0) returned 0x50 [0141.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0141.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\meafmi4_oyqdhv.doc"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78fa50, ftCreationTime.dwHighDateTime=0x1d41731, ftLastAccessTime.dwLowDateTime=0xa13b010, ftLastAccessTime.dwHighDateTime=0x1d4143d, ftLastWriteTime.dwLowDateTime=0xf3628690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13540)) returned 1 [0141.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.672] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\meafmi4_oyqdhv.doc"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\MeafMI4_oyQdhV.doc.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\meafmi4_oyqdhv.doc.anonymous")) returned 1 [0141.673] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx", lpFilePart=0x0) returned 0x3d [0141.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0141.673] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\tlyo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.673] GetFileType (hFile=0x154) returned 0x1 [0141.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0141.673] GetFileType (hFile=0x154) returned 0x1 [0141.673] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xa186 [0141.673] ReadFile (in: hFile=0x154, lpBuffer=0x1a0c09c, nNumberOfBytesToRead=0xa186, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a0c09c*, lpNumberOfBytesRead=0x2ae4ec*=0xa186, lpOverlapped=0x0) returned 1 [0141.674] CloseHandle (hObject=0x154) returned 1 [0141.686] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx", lpFilePart=0x0) returned 0x3d [0141.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0141.686] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\tlyo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.688] GetFileType (hFile=0x154) returned 0x1 [0141.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0141.688] GetFileType (hFile=0x154) returned 0x1 [0141.688] WriteFile (in: hFile=0x154, lpBuffer=0x1a8b7b4*, nNumberOfBytesToWrite=0xa190, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a8b7b4*, lpNumberOfBytesWritten=0x2ae4e0*=0xa190, lpOverlapped=0x0) returned 1 [0141.690] CloseHandle (hObject=0x154) returned 1 [0141.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx", lpFilePart=0x0) returned 0x3d [0141.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx.anonymous", lpFilePart=0x0) returned 0x47 [0141.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0141.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\tlyo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf127c2d0, ftCreationTime.dwHighDateTime=0x1d410ef, ftLastAccessTime.dwLowDateTime=0x76cf1180, ftLastAccessTime.dwHighDateTime=0x1d41600, ftLastWriteTime.dwLowDateTime=0xf364e7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa190)) returned 1 [0141.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.690] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\tlyo.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\Tlyo.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\tlyo.xlsx.anonymous")) returned 1 [0141.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0141.690] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu", lpFilePart=0x0) returned 0x44 [0141.691] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\", lpFilePart=0x0) returned 0x45 [0141.691] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.691] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0141.692] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0141.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0141.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0141.692] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu", lpFilePart=0x0) returned 0x44 [0141.692] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\", lpFilePart=0x0) returned 0x45 [0141.692] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0141.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.692] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.693] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.693] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0141.693] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0141.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0141.693] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls", lpFilePart=0x0) returned 0x4e [0141.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0141.693] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\ehvhs.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.693] GetFileType (hFile=0x154) returned 0x1 [0141.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0141.693] GetFileType (hFile=0x154) returned 0x1 [0141.693] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x9f78 [0141.693] ReadFile (in: hFile=0x154, lpBuffer=0x1a98564, nNumberOfBytesToRead=0x9f78, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a98564*, lpNumberOfBytesRead=0x2ae478*=0x9f78, lpOverlapped=0x0) returned 1 [0141.694] CloseHandle (hObject=0x154) returned 1 [0141.707] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls", lpFilePart=0x0) returned 0x4e [0141.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0141.707] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\ehvhs.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.708] GetFileType (hFile=0x154) returned 0x1 [0141.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0141.708] GetFileType (hFile=0x154) returned 0x1 [0141.708] WriteFile (in: hFile=0x154, lpBuffer=0x1b170cc*, nNumberOfBytesToWrite=0x9f80, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b170cc*, lpNumberOfBytesWritten=0x2ae46c*=0x9f80, lpOverlapped=0x0) returned 1 [0141.710] CloseHandle (hObject=0x154) returned 1 [0141.710] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls", lpFilePart=0x0) returned 0x4e [0141.710] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls.anonymous", lpFilePart=0x0) returned 0x58 [0141.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0141.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\ehvhs.xls"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a481590, ftCreationTime.dwHighDateTime=0x1d41fcc, ftLastAccessTime.dwLowDateTime=0x9d7e9260, ftLastAccessTime.dwHighDateTime=0x1d41489, ftLastWriteTime.dwLowDateTime=0xf3674950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9f80)) returned 1 [0141.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.710] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\ehvhs.xls"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\ehvHS.xls.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\ehvhs.xls.anonymous")) returned 1 [0141.711] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx", lpFilePart=0x0) returned 0x50 [0141.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0141.711] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\gta95-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.711] GetFileType (hFile=0x154) returned 0x1 [0141.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0141.711] GetFileType (hFile=0x154) returned 0x1 [0141.711] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x255a [0141.711] ReadFile (in: hFile=0x154, lpBuffer=0x1b214f0, nNumberOfBytesToRead=0x255a, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b214f0*, lpNumberOfBytesRead=0x2ae478*=0x255a, lpOverlapped=0x0) returned 1 [0141.712] CloseHandle (hObject=0x154) returned 1 [0141.724] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx", lpFilePart=0x0) returned 0x50 [0141.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0141.724] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\gta95-.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.726] GetFileType (hFile=0x154) returned 0x1 [0141.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0141.726] GetFileType (hFile=0x154) returned 0x1 [0141.726] WriteFile (in: hFile=0x154, lpBuffer=0x1b79dbc*, nNumberOfBytesToWrite=0x2560, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b79dbc*, lpNumberOfBytesWritten=0x2ae46c*=0x2560, lpOverlapped=0x0) returned 1 [0141.727] CloseHandle (hObject=0x154) returned 1 [0141.727] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx", lpFilePart=0x0) returned 0x50 [0141.727] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx.anonymous", lpFilePart=0x0) returned 0x5a [0141.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0141.727] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\gta95-.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d4abdf0, ftCreationTime.dwHighDateTime=0x1d410ef, ftLastAccessTime.dwLowDateTime=0xbcc1db60, ftLastAccessTime.dwHighDateTime=0x1d41f46, ftLastWriteTime.dwLowDateTime=0xf369aab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2560)) returned 1 [0141.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.727] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\gta95-.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\Gta95-.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\gta95-.pptx.anonymous")) returned 1 [0141.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0141.728] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl", lpFilePart=0x0) returned 0x51 [0141.728] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\", lpFilePart=0x0) returned 0x52 [0141.728] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0141.728] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.728] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.728] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.728] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.728] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.729] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0141.729] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0141.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0141.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0141.729] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl", lpFilePart=0x0) returned 0x51 [0141.729] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\", lpFilePart=0x0) returned 0x52 [0141.729] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0141.729] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.729] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.729] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.729] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.730] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.730] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0141.730] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0141.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0141.730] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf", lpFilePart=0x0) returned 0x5d [0141.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0141.730] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\o2iixuv.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.730] GetFileType (hFile=0x154) returned 0x1 [0141.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0141.730] GetFileType (hFile=0x154) returned 0x1 [0141.730] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x4144 [0141.730] ReadFile (in: hFile=0x154, lpBuffer=0x1b7f018, nNumberOfBytesToRead=0x4144, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7f018*, lpNumberOfBytesRead=0x2ae404*=0x4144, lpOverlapped=0x0) returned 1 [0141.731] CloseHandle (hObject=0x154) returned 1 [0141.765] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf", lpFilePart=0x0) returned 0x5d [0141.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0141.765] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\o2iixuv.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.766] GetFileType (hFile=0x154) returned 0x1 [0141.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0141.766] GetFileType (hFile=0x154) returned 0x1 [0141.766] WriteFile (in: hFile=0x154, lpBuffer=0x19d18e0*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19d18e0*, lpNumberOfBytesWritten=0x2ae3f8*=0x4150, lpOverlapped=0x0) returned 1 [0141.768] CloseHandle (hObject=0x154) returned 1 [0141.768] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf", lpFilePart=0x0) returned 0x5d [0141.768] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf.anonymous", lpFilePart=0x0) returned 0x67 [0141.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0141.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\o2iixuv.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80765d40, ftCreationTime.dwHighDateTime=0x1d4176a, ftLastAccessTime.dwLowDateTime=0xb5a1ae10, ftLastAccessTime.dwHighDateTime=0x1d41bcb, ftLastWriteTime.dwLowDateTime=0xf370ced0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4150)) returned 1 [0141.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0141.768] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\o2iixuv.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\O2IiXUv.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\o2iixuv.pdf.anonymous")) returned 1 [0141.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0141.769] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX", lpFilePart=0x0) returned 0x58 [0141.769] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\", lpFilePart=0x0) returned 0x59 [0141.769] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0141.769] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.769] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.769] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.769] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.769] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0141.770] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0141.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0141.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0141.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0141.770] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX", lpFilePart=0x0) returned 0x58 [0141.770] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\", lpFilePart=0x0) returned 0x59 [0141.770] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0141.770] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.770] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.770] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.770] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.771] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0141.771] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0141.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0141.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0141.771] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt", lpFilePart=0x0) returned 0x6f [0141.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.771] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\mqxcxt-rjnhvqk yov.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.771] GetFileType (hFile=0x154) returned 0x1 [0141.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.771] GetFileType (hFile=0x154) returned 0x1 [0141.771] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xf802 [0141.771] ReadFile (in: hFile=0x154, lpBuffer=0x19d87a8, nNumberOfBytesToRead=0xf802, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x19d87a8*, lpNumberOfBytesRead=0x2ae390*=0xf802, lpOverlapped=0x0) returned 1 [0141.772] CloseHandle (hObject=0x154) returned 1 [0141.786] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt", lpFilePart=0x0) returned 0x6f [0141.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.786] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\mqxcxt-rjnhvqk yov.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.788] GetFileType (hFile=0x154) returned 0x1 [0141.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.788] GetFileType (hFile=0x154) returned 0x1 [0141.788] WriteFile (in: hFile=0x154, lpBuffer=0x1a53f34*, nNumberOfBytesToWrite=0xf810, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a53f34*, lpNumberOfBytesWritten=0x2ae384*=0xf810, lpOverlapped=0x0) returned 1 [0141.797] CloseHandle (hObject=0x154) returned 1 [0141.797] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt", lpFilePart=0x0) returned 0x6f [0141.797] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt.anonymous", lpFilePart=0x0) returned 0x79 [0141.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.797] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\mqxcxt-rjnhvqk yov.ppt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57846c0, ftCreationTime.dwHighDateTime=0x1d417f2, ftLastAccessTime.dwLowDateTime=0x6f87a820, ftLastAccessTime.dwHighDateTime=0x1d41c80, ftLastWriteTime.dwLowDateTime=0xf3759190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf810)) returned 1 [0141.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.797] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\mqxcxt-rjnhvqk yov.ppt"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\mqXcXt-RjNhVqk yoV.ppt.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\mqxcxt-rjnhvqk yov.ppt.anonymous")) returned 1 [0141.798] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx", lpFilePart=0x0) returned 0x6e [0141.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.798] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\vfyayxtgj bqmkxo.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.798] GetFileType (hFile=0x154) returned 0x1 [0141.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.798] GetFileType (hFile=0x154) returned 0x1 [0141.798] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa4d6 [0141.798] ReadFile (in: hFile=0x154, lpBuffer=0x1a63d54, nNumberOfBytesToRead=0xa4d6, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a63d54*, lpNumberOfBytesRead=0x2ae390*=0xa4d6, lpOverlapped=0x0) returned 1 [0141.799] CloseHandle (hObject=0x154) returned 1 [0141.813] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx", lpFilePart=0x0) returned 0x6e [0141.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.813] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\vfyayxtgj bqmkxo.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.815] GetFileType (hFile=0x154) returned 0x1 [0141.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.815] GetFileType (hFile=0x154) returned 0x1 [0141.815] WriteFile (in: hFile=0x154, lpBuffer=0x1ae43a0*, nNumberOfBytesToWrite=0xa4e0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1ae43a0*, lpNumberOfBytesWritten=0x2ae384*=0xa4e0, lpOverlapped=0x0) returned 1 [0141.816] CloseHandle (hObject=0x154) returned 1 [0141.817] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx", lpFilePart=0x0) returned 0x6e [0141.817] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx.anonymous", lpFilePart=0x0) returned 0x78 [0141.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\vfyayxtgj bqmkxo.docx"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce84d3a0, ftCreationTime.dwHighDateTime=0x1d41f16, ftLastAccessTime.dwLowDateTime=0x9921d330, ftLastAccessTime.dwHighDateTime=0x1d41100, ftLastWriteTime.dwLowDateTime=0xf377f2f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa4e0)) returned 1 [0141.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.817] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\vfyayxtgj bqmkxo.docx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\vFyAyxtGj bqmKXO.docx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\vfyayxtgj bqmkxo.docx.anonymous")) returned 1 [0141.818] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx", lpFilePart=0x0) returned 0x69 [0141.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.818] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\yclp4hiwzeb.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.818] GetFileType (hFile=0x154) returned 0x1 [0141.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.818] GetFileType (hFile=0x154) returned 0x1 [0141.818] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x9e59 [0141.818] ReadFile (in: hFile=0x154, lpBuffer=0x1aeee78, nNumberOfBytesToRead=0x9e59, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1aeee78*, lpNumberOfBytesRead=0x2ae390*=0x9e59, lpOverlapped=0x0) returned 1 [0141.819] CloseHandle (hObject=0x154) returned 1 [0141.832] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx", lpFilePart=0x0) returned 0x69 [0141.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.832] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\yclp4hiwzeb.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.833] GetFileType (hFile=0x154) returned 0x1 [0141.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.833] GetFileType (hFile=0x154) returned 0x1 [0141.834] WriteFile (in: hFile=0x154, lpBuffer=0x1b6d444*, nNumberOfBytesToWrite=0x9e60, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b6d444*, lpNumberOfBytesWritten=0x2ae384*=0x9e60, lpOverlapped=0x0) returned 1 [0141.835] CloseHandle (hObject=0x154) returned 1 [0141.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx", lpFilePart=0x0) returned 0x69 [0141.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx.anonymous", lpFilePart=0x0) returned 0x73 [0141.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.835] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\yclp4hiwzeb.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e373b10, ftCreationTime.dwHighDateTime=0x1d41c52, ftLastAccessTime.dwLowDateTime=0x3c388130, ftLastAccessTime.dwHighDateTime=0x1d41b1b, ftLastWriteTime.dwLowDateTime=0xf37a5450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9e60)) returned 1 [0141.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.835] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\yclp4hiwzeb.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\DQLFmX\\YClP4hIwzEb.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\dqlfmx\\yclp4hiwzeb.xlsx.anonymous")) returned 1 [0141.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0141.836] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl", lpFilePart=0x0) returned 0x65 [0141.836] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\", lpFilePart=0x0) returned 0x66 [0141.836] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0141.836] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.836] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.837] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.837] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.837] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.837] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0141.837] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0141.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0141.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0141.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0141.837] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl", lpFilePart=0x0) returned 0x65 [0141.837] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\", lpFilePart=0x0) returned 0x66 [0141.837] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0141.837] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.838] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.838] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.838] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.838] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0141.838] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0141.838] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0141.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0141.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0141.838] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx", lpFilePart=0x0) returned 0x73 [0141.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.838] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\pcctdqrd.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.838] GetFileType (hFile=0x154) returned 0x1 [0141.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.839] GetFileType (hFile=0x154) returned 0x1 [0141.839] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x425b [0141.839] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a858, nNumberOfBytesToRead=0x425b, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b7a858*, lpNumberOfBytesRead=0x2ae390*=0x425b, lpOverlapped=0x0) returned 1 [0141.840] CloseHandle (hObject=0x154) returned 1 [0141.888] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx", lpFilePart=0x0) returned 0x73 [0141.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.888] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\pcctdqrd.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.890] GetFileType (hFile=0x154) returned 0x1 [0141.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.890] GetFileType (hFile=0x154) returned 0x1 [0141.890] WriteFile (in: hFile=0x154, lpBuffer=0x19dc810*, nNumberOfBytesToWrite=0x4260, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x19dc810*, lpNumberOfBytesWritten=0x2ae384*=0x4260, lpOverlapped=0x0) returned 1 [0141.891] CloseHandle (hObject=0x154) returned 1 [0141.891] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx", lpFilePart=0x0) returned 0x73 [0141.891] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx.anonymous", lpFilePart=0x0) returned 0x7d [0141.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\pcctdqrd.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bd620, ftCreationTime.dwHighDateTime=0x1d41520, ftLastAccessTime.dwLowDateTime=0xff6b30e0, ftLastAccessTime.dwHighDateTime=0x1d41075, ftLastWriteTime.dwLowDateTime=0xf383d9d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4260)) returned 1 [0141.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.891] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\pcctdqrd.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\PCcTdqRD.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\pcctdqrd.pptx.anonymous")) returned 1 [0141.892] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt", lpFilePart=0x0) returned 0x77 [0141.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.892] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\tiwdxlm_iexc3.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.892] GetFileType (hFile=0x154) returned 0x1 [0141.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.892] GetFileType (hFile=0x154) returned 0x1 [0141.892] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x17116 [0141.893] ReadFile (in: hFile=0x154, lpBuffer=0x6c45b90, nNumberOfBytesToRead=0x17116, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x6c45b90*, lpNumberOfBytesRead=0x2ae390*=0x17116, lpOverlapped=0x0) returned 1 [0141.895] CloseHandle (hObject=0x154) returned 1 [0141.913] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt", lpFilePart=0x0) returned 0x77 [0141.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.913] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\tiwdxlm_iexc3.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.915] GetFileType (hFile=0x154) returned 0x1 [0141.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.915] GetFileType (hFile=0x154) returned 0x1 [0141.915] WriteFile (in: hFile=0x154, lpBuffer=0x6cb9168*, nNumberOfBytesToWrite=0x17120, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x6cb9168*, lpNumberOfBytesWritten=0x2ae384*=0x17120, lpOverlapped=0x0) returned 1 [0141.917] CloseHandle (hObject=0x154) returned 1 [0141.917] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt", lpFilePart=0x0) returned 0x77 [0141.917] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt.anonymous", lpFilePart=0x0) returned 0x81 [0141.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\tiwdxlm_iexc3.odt"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21368770, ftCreationTime.dwHighDateTime=0x1d4198a, ftLastAccessTime.dwLowDateTime=0x791ac7b0, ftLastAccessTime.dwHighDateTime=0x1d41b0d, ftLastWriteTime.dwLowDateTime=0xf3863b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17120)) returned 1 [0141.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.918] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\tiwdxlm_iexc3.odt"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\TIwdxlM_iExC3.odt.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\tiwdxlm_iexc3.odt.anonymous")) returned 1 [0141.918] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf", lpFilePart=0x0) returned 0x7b [0141.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.918] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\y_qez0yxztfra0b-g.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.919] GetFileType (hFile=0x154) returned 0x1 [0141.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.919] GetFileType (hFile=0x154) returned 0x1 [0141.919] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xdc0f [0141.919] ReadFile (in: hFile=0x154, lpBuffer=0x1a2e644, nNumberOfBytesToRead=0xdc0f, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1a2e644*, lpNumberOfBytesRead=0x2ae390*=0xdc0f, lpOverlapped=0x0) returned 1 [0141.920] CloseHandle (hObject=0x154) returned 1 [0141.934] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf", lpFilePart=0x0) returned 0x7b [0141.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.934] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\y_qez0yxztfra0b-g.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.937] GetFileType (hFile=0x154) returned 0x1 [0141.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.937] GetFileType (hFile=0x154) returned 0x1 [0141.937] WriteFile (in: hFile=0x154, lpBuffer=0x1aa4874*, nNumberOfBytesToWrite=0xdc10, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1aa4874*, lpNumberOfBytesWritten=0x2ae384*=0xdc10, lpOverlapped=0x0) returned 1 [0141.939] CloseHandle (hObject=0x154) returned 1 [0141.939] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf", lpFilePart=0x0) returned 0x7b [0141.939] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf.anonymous", lpFilePart=0x0) returned 0x85 [0141.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\y_qez0yxztfra0b-g.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e356b50, ftCreationTime.dwHighDateTime=0x1d41787, ftLastAccessTime.dwLowDateTime=0x7e9eca20, ftLastAccessTime.dwHighDateTime=0x1d41364, ftLastWriteTime.dwLowDateTime=0xf38afdf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdc10)) returned 1 [0141.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.940] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\y_qez0yxztfra0b-g.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Y_qeZ0YxZTFRA0b-g.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\y_qez0yxztfra0b-g.pdf.anonymous")) returned 1 [0141.940] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx", lpFilePart=0x0) returned 0x6f [0141.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0141.940] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\z9jm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.940] GetFileType (hFile=0x154) returned 0x1 [0141.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0141.940] GetFileType (hFile=0x154) returned 0x1 [0141.940] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb3bf [0141.941] ReadFile (in: hFile=0x154, lpBuffer=0x1ab2ad8, nNumberOfBytesToRead=0xb3bf, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1ab2ad8*, lpNumberOfBytesRead=0x2ae390*=0xb3bf, lpOverlapped=0x0) returned 1 [0141.942] CloseHandle (hObject=0x154) returned 1 [0141.955] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx", lpFilePart=0x0) returned 0x6f [0141.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0141.955] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\z9jm.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.957] GetFileType (hFile=0x154) returned 0x1 [0141.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0141.957] GetFileType (hFile=0x154) returned 0x1 [0141.957] WriteFile (in: hFile=0x154, lpBuffer=0x1b21418*, nNumberOfBytesToWrite=0xb3c0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1b21418*, lpNumberOfBytesWritten=0x2ae384*=0xb3c0, lpOverlapped=0x0) returned 1 [0141.959] CloseHandle (hObject=0x154) returned 1 [0141.959] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx", lpFilePart=0x0) returned 0x6f [0141.959] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx.anonymous", lpFilePart=0x0) returned 0x79 [0141.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0141.959] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\z9jm.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92332e40, ftCreationTime.dwHighDateTime=0x1d41c0c, ftLastAccessTime.dwLowDateTime=0x2d93bfa0, ftLastAccessTime.dwHighDateTime=0x1d4144a, ftLastWriteTime.dwLowDateTime=0xf38d5f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb3c0)) returned 1 [0141.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0141.959] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\z9jm.xlsx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\HFQJxrvfc5YnbLWu\\0jJ-HySiNHkl\\PYNAMC02z9Y8JO4ttVl\\Z9JM.xlsx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\hfqjxrvfc5ynblwu\\0jj-hysinhkl\\pynamc02z9y8jo4ttvl\\z9jm.xlsx.anonymous")) returned 1 [0141.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0141.960] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2", lpFilePart=0x0) returned 0x40 [0141.960] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\", lpFilePart=0x0) returned 0x41 [0141.960] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0141.960] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.960] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.961] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.961] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0141.961] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0141.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0141.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0141.961] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2", lpFilePart=0x0) returned 0x40 [0141.961] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\", lpFilePart=0x0) returned 0x41 [0141.961] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0141.961] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.962] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.962] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0141.962] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0141.962] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0141.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0141.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0141.962] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv", lpFilePart=0x0) returned 0x4b [0141.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0141.962] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\jclm-1.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.962] GetFileType (hFile=0x154) returned 0x1 [0141.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0141.963] GetFileType (hFile=0x154) returned 0x1 [0141.963] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7723 [0141.963] ReadFile (in: hFile=0x154, lpBuffer=0x1b2e954, nNumberOfBytesToRead=0x7723, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2e954*, lpNumberOfBytesRead=0x2ae478*=0x7723, lpOverlapped=0x0) returned 1 [0141.964] CloseHandle (hObject=0x154) returned 1 [0141.985] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv", lpFilePart=0x0) returned 0x4b [0141.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0141.985] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\jclm-1.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.987] GetFileType (hFile=0x154) returned 0x1 [0141.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0141.987] GetFileType (hFile=0x154) returned 0x1 [0141.987] WriteFile (in: hFile=0x154, lpBuffer=0x19a4d98*, nNumberOfBytesToWrite=0x7730, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19a4d98*, lpNumberOfBytesWritten=0x2ae46c*=0x7730, lpOverlapped=0x0) returned 1 [0141.988] CloseHandle (hObject=0x154) returned 1 [0141.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv", lpFilePart=0x0) returned 0x4b [0141.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv.anonymous", lpFilePart=0x0) returned 0x55 [0141.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0141.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\jclm-1.csv"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a00f9d0, ftCreationTime.dwHighDateTime=0x1d41154, ftLastAccessTime.dwLowDateTime=0xfecf2840, ftLastAccessTime.dwHighDateTime=0x1d41f79, ftLastWriteTime.dwLowDateTime=0xf3922210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7730)) returned 1 [0141.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.989] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\jclm-1.csv"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\jCLm-1.csv.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\jclm-1.csv.anonymous")) returned 1 [0141.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0141.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb", lpFilePart=0x0) returned 0x4f [0141.989] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\", lpFilePart=0x0) returned 0x50 [0141.990] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee58 [0141.990] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.990] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.990] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0141.990] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0141.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0141.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0141.990] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb", lpFilePart=0x0) returned 0x4f [0141.990] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\", lpFilePart=0x0) returned 0x50 [0141.991] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee58 [0141.991] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.991] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0141.991] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0141.991] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0141.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0141.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0141.991] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx", lpFilePart=0x0) returned 0x68 [0141.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0141.992] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\neprinjw6mqdcb\\pdyuveyvtjd4-5mdysn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0141.992] GetFileType (hFile=0x154) returned 0x1 [0141.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0141.992] GetFileType (hFile=0x154) returned 0x1 [0141.992] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x16c7 [0141.992] ReadFile (in: hFile=0x154, lpBuffer=0x19ae648, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19ae648*, lpNumberOfBytesRead=0x2ae404*=0x16c7, lpOverlapped=0x0) returned 1 [0141.993] CloseHandle (hObject=0x154) returned 1 [0142.030] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx", lpFilePart=0x0) returned 0x68 [0142.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0142.030] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\neprinjw6mqdcb\\pdyuveyvtjd4-5mdysn.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.032] GetFileType (hFile=0x154) returned 0x1 [0142.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0142.032] GetFileType (hFile=0x154) returned 0x1 [0142.032] WriteFile (in: hFile=0x154, lpBuffer=0x1a027a0*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a027a0*, lpNumberOfBytesWritten=0x2ae3f8*=0x16d0, lpOverlapped=0x0) returned 1 [0142.033] CloseHandle (hObject=0x154) returned 1 [0142.033] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx", lpFilePart=0x0) returned 0x68 [0142.033] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx.anonymous", lpFilePart=0x0) returned 0x72 [0142.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0142.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\neprinjw6mqdcb\\pdyuveyvtjd4-5mdysn.pptx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c3d560, ftCreationTime.dwHighDateTime=0x1d410a1, ftLastAccessTime.dwLowDateTime=0x3111a7f0, ftLastAccessTime.dwHighDateTime=0x1d418cd, ftLastWriteTime.dwLowDateTime=0xf3994630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16d0)) returned 1 [0142.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0142.033] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\neprinjw6mqdcb\\pdyuveyvtjd4-5mdysn.pptx"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\-unIZa 3w56yEdG6L4\\h7gvZ\\yZk-Q78Cj c2\\neprINjW6mQdCb\\pdYUveyvtjd4-5mdysn.pptx.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\-uniza 3w56yedg6l4\\h7gvz\\yzk-q78cj c2\\neprinjw6mqdcb\\pdyuveyvtjd4-5mdysn.pptx.anonymous")) returned 1 [0142.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.034] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Music", lpFilePart=0x0) returned 0x23 [0142.034] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Music\\", lpFilePart=0x0) returned 0x24 [0142.034] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0142.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0142.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.035] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26 [0142.035] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x27 [0142.035] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0142.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0142.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.037] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes", lpFilePart=0x0) returned 0x24 [0142.037] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x25 [0142.037] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0142.037] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.037] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.037] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.037] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.037] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.038] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.038] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes", lpFilePart=0x0) returned 0x24 [0142.038] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x25 [0142.038] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0142.038] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.038] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.038] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.038] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.038] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.038] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.039] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2d [0142.039] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x2e [0142.039] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0142.039] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.039] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.039] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.039] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.040] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2d [0142.040] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x2e [0142.040] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbea18 [0142.040] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.040] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.040] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.040] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.040] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Videos", lpFilePart=0x0) returned 0x24 [0142.040] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x25 [0142.040] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\My Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0142.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0142.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.042] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x28 [0142.042] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x29 [0142.042] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0142.044] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.045] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.045] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.045] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.045] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.046] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x28 [0142.046] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x29 [0142.046] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\Outlook Files\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0142.047] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.047] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.047] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.047] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.048] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.048] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO", lpFilePart=0x0) returned 0x28 [0142.049] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\", lpFilePart=0x0) returned 0x29 [0142.049] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0142.049] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.049] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.049] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.049] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.049] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.049] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.049] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.050] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO", lpFilePart=0x0) returned 0x28 [0142.050] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\", lpFilePart=0x0) returned 0x29 [0142.050] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbea18 [0142.050] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.050] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.050] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.050] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.050] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.050] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.051] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0142.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.051] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc", lpFilePart=0x0) returned 0x39 [0142.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.051] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\3pkviisc4r3h.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.051] GetFileType (hFile=0x154) returned 0x1 [0142.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.051] GetFileType (hFile=0x154) returned 0x1 [0142.051] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x82a [0142.051] ReadFile (in: hFile=0x154, lpBuffer=0x1a0c680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a0c680*, lpNumberOfBytesRead=0x2ae560*=0x82a, lpOverlapped=0x0) returned 1 [0142.052] CloseHandle (hObject=0x154) returned 1 [0142.091] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc", lpFilePart=0x0) returned 0x39 [0142.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.091] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\3pkviisc4r3h.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.092] GetFileType (hFile=0x154) returned 0x1 [0142.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.092] GetFileType (hFile=0x154) returned 0x1 [0142.093] CloseHandle (hObject=0x154) returned 1 [0142.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc", lpFilePart=0x0) returned 0x39 [0142.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc.anonymous", lpFilePart=0x0) returned 0x43 [0142.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\3pkviisc4r3h.doc"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf7a0d0, ftCreationTime.dwHighDateTime=0x1d41720, ftLastAccessTime.dwLowDateTime=0x28c4b740, ftLastAccessTime.dwHighDateTime=0x1d4106c, ftLastWriteTime.dwLowDateTime=0xf3a2cbb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x830)) returned 1 [0142.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.094] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\3pkviisc4r3h.doc"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\3PkviIsC4r3h.doc.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\3pkviisc4r3h.doc.anonymous")) returned 1 [0142.094] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv", lpFilePart=0x0) returned 0x3d [0142.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.094] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\dpvcqnsvdx40nlin.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.095] GetFileType (hFile=0x154) returned 0x1 [0142.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.095] GetFileType (hFile=0x154) returned 0x1 [0142.095] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x147dc [0142.095] ReadFile (in: hFile=0x154, lpBuffer=0x1a5e15c, nNumberOfBytesToRead=0x147dc, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a5e15c*, lpNumberOfBytesRead=0x2ae560*=0x147dc, lpOverlapped=0x0) returned 1 [0142.096] CloseHandle (hObject=0x154) returned 1 [0142.111] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv", lpFilePart=0x0) returned 0x3d [0142.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.112] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\dpvcqnsvdx40nlin.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.114] GetFileType (hFile=0x154) returned 0x1 [0142.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.114] GetFileType (hFile=0x154) returned 0x1 [0142.114] WriteFile (in: hFile=0x154, lpBuffer=0x1ae86f8*, nNumberOfBytesToWrite=0x147e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ae86f8*, lpNumberOfBytesWritten=0x2ae554*=0x147e0, lpOverlapped=0x0) returned 1 [0142.117] CloseHandle (hObject=0x154) returned 1 [0142.118] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv", lpFilePart=0x0) returned 0x3d [0142.118] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv.anonymous", lpFilePart=0x0) returned 0x47 [0142.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\dpvcqnsvdx40nlin.csv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8486f0, ftCreationTime.dwHighDateTime=0x1d41fea, ftLastAccessTime.dwLowDateTime=0xa0e7e5b0, ftLastAccessTime.dwHighDateTime=0x1d41113, ftLastWriteTime.dwLowDateTime=0xf3a52d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x147e0)) returned 1 [0142.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.118] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\dpvcqnsvdx40nlin.csv"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\dpVcqNsvdX40nLIn.csv.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\dpvcqnsvdx40nlin.csv.anonymous")) returned 1 [0142.119] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf", lpFilePart=0x0) returned 0x34 [0142.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.119] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\iajbqm9.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.119] GetFileType (hFile=0x154) returned 0x1 [0142.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.119] GetFileType (hFile=0x154) returned 0x1 [0142.119] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8f13 [0142.119] ReadFile (in: hFile=0x154, lpBuffer=0x1afd2cc, nNumberOfBytesToRead=0x8f13, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1afd2cc*, lpNumberOfBytesRead=0x2ae560*=0x8f13, lpOverlapped=0x0) returned 1 [0142.121] CloseHandle (hObject=0x154) returned 1 [0142.136] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf", lpFilePart=0x0) returned 0x34 [0142.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.136] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\iajbqm9.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.138] GetFileType (hFile=0x154) returned 0x1 [0142.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.138] GetFileType (hFile=0x154) returned 0x1 [0142.138] WriteFile (in: hFile=0x154, lpBuffer=0x1b76c58*, nNumberOfBytesToWrite=0x8f20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b76c58*, lpNumberOfBytesWritten=0x2ae554*=0x8f20, lpOverlapped=0x0) returned 1 [0142.139] CloseHandle (hObject=0x154) returned 1 [0142.139] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf", lpFilePart=0x0) returned 0x34 [0142.139] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf.anonymous", lpFilePart=0x0) returned 0x3e [0142.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\iajbqm9.pdf"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421fd2e0, ftCreationTime.dwHighDateTime=0x1d411bd, ftLastAccessTime.dwLowDateTime=0xc84928c0, ftLastAccessTime.dwHighDateTime=0x1d41ea2, ftLastWriteTime.dwLowDateTime=0xf3a9efd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8f20)) returned 1 [0142.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.140] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\iajbqm9.pdf"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\iaJbQm9.pdf.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\iajbqm9.pdf.anonymous")) returned 1 [0142.140] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt", lpFilePart=0x0) returned 0x3d [0142.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.140] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\sd5ja03v9cyykxmr.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.140] GetFileType (hFile=0x154) returned 0x1 [0142.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.140] GetFileType (hFile=0x154) returned 0x1 [0142.140] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2342 [0142.140] ReadFile (in: hFile=0x154, lpBuffer=0x1b7ff3c, nNumberOfBytesToRead=0x2342, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b7ff3c*, lpNumberOfBytesRead=0x2ae560*=0x2342, lpOverlapped=0x0) returned 1 [0142.141] CloseHandle (hObject=0x154) returned 1 [0142.180] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt", lpFilePart=0x0) returned 0x3d [0142.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.180] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\sd5ja03v9cyykxmr.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.182] GetFileType (hFile=0x154) returned 0x1 [0142.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.182] GetFileType (hFile=0x154) returned 0x1 [0142.182] WriteFile (in: hFile=0x154, lpBuffer=0x19ca608*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19ca608*, lpNumberOfBytesWritten=0x2ae554*=0x2350, lpOverlapped=0x0) returned 1 [0142.183] CloseHandle (hObject=0x154) returned 1 [0142.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt", lpFilePart=0x0) returned 0x3d [0142.183] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt.anonymous", lpFilePart=0x0) returned 0x47 [0142.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\sd5ja03v9cyykxmr.odt"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d3b600, ftCreationTime.dwHighDateTime=0x1d41b68, ftLastAccessTime.dwLowDateTime=0xbbf40280, ftLastAccessTime.dwHighDateTime=0x1d4178f, ftLastWriteTime.dwLowDateTime=0xf3aeb290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2350)) returned 1 [0142.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.183] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\sd5ja03v9cyykxmr.odt"), lpNewFileName="C:\\Users\\EEBsYm5\\Documents\\_khM5U CAfRO\\sD5Ja03v9cyYkXmR.odt.anonymous" (normalized: "c:\\users\\eebsym5\\documents\\_khm5u cafro\\sd5ja03v9cyykxmr.odt.anonymous")) returned 1 [0142.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.184] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Downloads", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Downloads", lpFilePart=0x0) returned 0x1a [0142.184] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Downloads\\", lpFilePart=0x0) returned 0x1b [0142.184] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Downloads\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.185] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.185] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.185] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.185] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.185] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.185] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Downloads", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Downloads", lpFilePart=0x0) returned 0x1a [0142.185] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Downloads\\", lpFilePart=0x0) returned 0x1b [0142.186] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Downloads\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.186] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.186] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.186] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.186] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.186] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.186] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites", lpFilePart=0x0) returned 0x1a [0142.186] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\", lpFilePart=0x0) returned 0x1b [0142.186] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.187] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.187] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.188] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites", lpFilePart=0x0) returned 0x1a [0142.188] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\", lpFilePart=0x0) returned 0x1b [0142.188] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.188] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.188] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.188] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.188] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.188] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.188] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.189] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.189] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Links", lpFilePart=0x0) returned 0x20 [0142.189] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Links\\", lpFilePart=0x0) returned 0x21 [0142.189] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.189] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.189] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.189] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.190] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.190] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.190] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.190] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Links", lpFilePart=0x0) returned 0x20 [0142.190] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Links\\", lpFilePart=0x0) returned 0x21 [0142.190] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.190] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.190] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.190] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.191] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.191] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.191] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.191] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2d [0142.191] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x2e [0142.191] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.215] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.215] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.215] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.215] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.215] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.216] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.216] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.216] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.217] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2d [0142.217] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x2e [0142.217] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.218] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.218] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.218] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.219] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.219] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.219] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.219] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.219] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.220] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x27 [0142.220] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x28 [0142.220] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.229] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.230] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.231] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.233] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x27 [0142.233] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x28 [0142.233] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\MSN Websites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.235] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.235] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.235] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.235] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.236] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.236] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.236] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.236] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.236] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.238] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x27 [0142.238] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x28 [0142.238] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Windows Live\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.247] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.247] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.248] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.248] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.248] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.248] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.248] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.249] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x27 [0142.249] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x28 [0142.249] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Favorites\\Windows Live\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbeb98 [0142.250] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.250] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.250] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.250] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.251] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.251] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.251] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.252] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links", lpFilePart=0x0) returned 0x16 [0142.252] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\", lpFilePart=0x0) returned 0x17 [0142.252] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.252] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.252] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.252] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.253] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.253] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.253] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.253] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.253] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links", lpFilePart=0x0) returned 0x16 [0142.253] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\", lpFilePart=0x0) returned 0x17 [0142.253] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.253] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.253] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.253] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.254] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.254] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.254] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.254] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.254] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x22 [0142.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.254] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk" (normalized: "c:\\users\\eebsym5\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.254] GetFileType (hFile=0x154) returned 0x1 [0142.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.254] GetFileType (hFile=0x154) returned 0x1 [0142.254] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1c1 [0142.254] ReadFile (in: hFile=0x154, lpBuffer=0x19d8840, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19d8840*, lpNumberOfBytesRead=0x2ae5d4*=0x1c1, lpOverlapped=0x0) returned 1 [0142.256] CloseHandle (hObject=0x154) returned 1 [0142.270] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x22 [0142.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.270] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk" (normalized: "c:\\users\\eebsym5\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.272] GetFileType (hFile=0x154) returned 0x1 [0142.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.272] GetFileType (hFile=0x154) returned 0x1 [0142.272] WriteFile (in: hFile=0x154, lpBuffer=0x1a27184*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a27184*, lpNumberOfBytesWritten=0x2ae59c*=0x1d0, lpOverlapped=0x0) returned 1 [0142.273] CloseHandle (hObject=0x154) returned 1 [0142.273] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x22 [0142.273] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Desktop.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk.anonymous", lpFilePart=0x0) returned 0x2c [0142.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.273] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk" (normalized: "c:\\users\\eebsym5\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebeb90, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8ebeb90, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf3bcfad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1 [0142.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.273] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk" (normalized: "c:\\users\\eebsym5\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\Links\\Desktop.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\links\\desktop.lnk.anonymous")) returned 1 [0142.274] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x24 [0142.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.274] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk" (normalized: "c:\\users\\eebsym5\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.276] GetFileType (hFile=0x154) returned 0x1 [0142.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.276] GetFileType (hFile=0x154) returned 0x1 [0142.276] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x350 [0142.276] ReadFile (in: hFile=0x154, lpBuffer=0x1a28700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a28700*, lpNumberOfBytesRead=0x2ae5d4*=0x350, lpOverlapped=0x0) returned 1 [0142.278] CloseHandle (hObject=0x154) returned 1 [0142.294] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x24 [0142.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.294] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk" (normalized: "c:\\users\\eebsym5\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.296] GetFileType (hFile=0x154) returned 0x1 [0142.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.296] GetFileType (hFile=0x154) returned 0x1 [0142.296] WriteFile (in: hFile=0x154, lpBuffer=0x1a776c0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1a776c0*, lpNumberOfBytesWritten=0x2ae59c*=0x360, lpOverlapped=0x0) returned 1 [0142.297] CloseHandle (hObject=0x154) returned 1 [0142.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x24 [0142.297] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\Downloads.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk.anonymous", lpFilePart=0x0) returned 0x2e [0142.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk" (normalized: "c:\\users\\eebsym5\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebeb90, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8ebeb90, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf3c1bd90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x360)) returned 1 [0142.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.297] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk" (normalized: "c:\\users\\eebsym5\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\Links\\Downloads.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\links\\downloads.lnk.anonymous")) returned 1 [0142.298] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x27 [0142.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.298] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\eebsym5\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.298] GetFileType (hFile=0x154) returned 0x1 [0142.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.298] GetFileType (hFile=0x154) returned 0x1 [0142.298] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x16b [0142.299] ReadFile (in: hFile=0x154, lpBuffer=0x1a78a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a78a70*, lpNumberOfBytesRead=0x2ae5d4*=0x16b, lpOverlapped=0x0) returned 1 [0142.300] CloseHandle (hObject=0x154) returned 1 [0142.314] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x27 [0142.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.314] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\eebsym5\\links\\recentplaces.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.316] GetFileType (hFile=0x154) returned 0x1 [0142.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.316] GetFileType (hFile=0x154) returned 0x1 [0142.316] WriteFile (in: hFile=0x154, lpBuffer=0x1ac7084*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1ac7084*, lpNumberOfBytesWritten=0x2ae59c*=0x170, lpOverlapped=0x0) returned 1 [0142.317] CloseHandle (hObject=0x154) returned 1 [0142.317] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x27 [0142.317] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk.anonymous", lpFilePart=0x0) returned 0x31 [0142.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\eebsym5\\links\\recentplaces.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebeb90, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x8ebeb90, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0xf3c41ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1 [0142.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.318] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\eebsym5\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\EEBsYm5\\Links\\RecentPlaces.lnk.anonymous" (normalized: "c:\\users\\eebsym5\\links\\recentplaces.lnk.anonymous")) returned 1 [0142.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.318] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Local Settings", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Local Settings", lpFilePart=0x0) returned 0x1f [0142.319] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Local Settings\\", lpFilePart=0x0) returned 0x20 [0142.319] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Local Settings\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0142.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0142.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.320] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music", lpFilePart=0x0) returned 0x16 [0142.321] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\", lpFilePart=0x0) returned 0x17 [0142.321] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0142.321] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.321] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.321] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.321] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.322] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.322] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.322] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music", lpFilePart=0x0) returned 0x16 [0142.322] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\", lpFilePart=0x0) returned 0x17 [0142.322] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0142.322] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.322] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.323] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.323] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.323] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.323] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.323] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF", lpFilePart=0x0) returned 0x29 [0142.323] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\", lpFilePart=0x0) returned 0x2a [0142.323] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0142.324] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.324] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.324] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.324] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.324] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.325] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.325] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.325] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.325] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.325] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.325] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.326] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.326] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF", lpFilePart=0x0) returned 0x29 [0142.326] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\", lpFilePart=0x0) returned 0x2a [0142.326] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0142.326] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.326] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.327] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.328] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.328] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.328] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.328] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3", lpFilePart=0x0) returned 0x40 [0142.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.328] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6j2dwanuydj92d9qf-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.328] GetFileType (hFile=0x154) returned 0x1 [0142.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.328] GetFileType (hFile=0x154) returned 0x1 [0142.328] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2f8b [0142.329] ReadFile (in: hFile=0x154, lpBuffer=0x1acccfc, nNumberOfBytesToRead=0x2f8b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1acccfc*, lpNumberOfBytesRead=0x2ae560*=0x2f8b, lpOverlapped=0x0) returned 1 [0142.330] CloseHandle (hObject=0x154) returned 1 [0142.365] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3", lpFilePart=0x0) returned 0x40 [0142.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.365] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6j2dwanuydj92d9qf-.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.369] GetFileType (hFile=0x154) returned 0x1 [0142.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.369] GetFileType (hFile=0x154) returned 0x1 [0142.369] WriteFile (in: hFile=0x154, lpBuffer=0x1b288b8*, nNumberOfBytesToWrite=0x2f90, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b288b8*, lpNumberOfBytesWritten=0x2ae554*=0x2f90, lpOverlapped=0x0) returned 1 [0142.370] CloseHandle (hObject=0x154) returned 1 [0142.370] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3", lpFilePart=0x0) returned 0x40 [0142.370] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3.anonymous", lpFilePart=0x0) returned 0x4a [0142.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.370] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6j2dwanuydj92d9qf-.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799348e0, ftCreationTime.dwHighDateTime=0x1d41dc7, ftLastAccessTime.dwLowDateTime=0x1afba900, ftLastAccessTime.dwHighDateTime=0x1d41e7e, ftLastWriteTime.dwLowDateTime=0xf3cb4310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f90)) returned 1 [0142.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.370] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6j2dwanuydj92d9qf-.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6J2DwanUYdj92D9QF-.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6j2dwanuydj92d9qf-.mp3.anonymous")) returned 1 [0142.371] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3", lpFilePart=0x0) returned 0x3f [0142.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.371] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\j3h27caxk1pk03kec.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.371] GetFileType (hFile=0x154) returned 0x1 [0142.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.371] GetFileType (hFile=0x154) returned 0x1 [0142.371] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x175fa [0142.372] ReadFile (in: hFile=0x154, lpBuffer=0x6d2b208, nNumberOfBytesToRead=0x175fa, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x6d2b208*, lpNumberOfBytesRead=0x2ae560*=0x175fa, lpOverlapped=0x0) returned 1 [0142.374] CloseHandle (hObject=0x154) returned 1 [0142.392] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3", lpFilePart=0x0) returned 0x3f [0142.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.392] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\j3h27caxk1pk03kec.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.394] GetFileType (hFile=0x154) returned 0x1 [0142.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.395] GetFileType (hFile=0x154) returned 0x1 [0142.395] WriteFile (in: hFile=0x154, lpBuffer=0x6da0040*, nNumberOfBytesToWrite=0x17600, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x6da0040*, lpNumberOfBytesWritten=0x2ae554*=0x17600, lpOverlapped=0x0) returned 1 [0142.397] CloseHandle (hObject=0x154) returned 1 [0142.397] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3", lpFilePart=0x0) returned 0x3f [0142.397] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3.anonymous", lpFilePart=0x0) returned 0x49 [0142.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\j3h27caxk1pk03kec.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x541f9b40, ftCreationTime.dwHighDateTime=0x1d419cb, ftLastAccessTime.dwLowDateTime=0x9868a820, ftLastAccessTime.dwHighDateTime=0x1d414ec, ftLastWriteTime.dwLowDateTime=0xf3d005d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17600)) returned 1 [0142.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.397] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\j3h27caxk1pk03kec.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\j3H27cAxk1pK03kEC.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\j3h27caxk1pk03kec.mp3.anonymous")) returned 1 [0142.398] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3", lpFilePart=0x0) returned 0x3b [0142.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.398] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\jjyjk9isdbjo7.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.398] GetFileType (hFile=0x154) returned 0x1 [0142.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.398] GetFileType (hFile=0x154) returned 0x1 [0142.398] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x16aa4 [0142.399] ReadFile (in: hFile=0x154, lpBuffer=0x6db7660, nNumberOfBytesToRead=0x16aa4, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x6db7660*, lpNumberOfBytesRead=0x2ae560*=0x16aa4, lpOverlapped=0x0) returned 1 [0142.401] CloseHandle (hObject=0x154) returned 1 [0142.446] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3", lpFilePart=0x0) returned 0x3b [0142.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0142.446] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\jjyjk9isdbjo7.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.448] GetFileType (hFile=0x154) returned 0x1 [0142.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0142.448] GetFileType (hFile=0x154) returned 0x1 [0142.448] WriteFile (in: hFile=0x154, lpBuffer=0x6e28c00*, nNumberOfBytesToWrite=0x16ab0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x6e28c00*, lpNumberOfBytesWritten=0x2ae554*=0x16ab0, lpOverlapped=0x0) returned 1 [0142.451] CloseHandle (hObject=0x154) returned 1 [0142.451] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3", lpFilePart=0x0) returned 0x3b [0142.451] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3.anonymous", lpFilePart=0x0) returned 0x45 [0142.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0142.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\jjyjk9isdbjo7.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921c5360, ftCreationTime.dwHighDateTime=0x1d410b2, ftLastAccessTime.dwLowDateTime=0xf4a59df0, ftLastAccessTime.dwHighDateTime=0x1d415dc, ftLastWriteTime.dwLowDateTime=0xf3d98b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16ab0)) returned 1 [0142.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.451] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\jjyjk9isdbjo7.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\JjYJK9isDbJO7.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\jjyjk9isdbjo7.mp3.anonymous")) returned 1 [0142.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.452] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl", lpFilePart=0x0) returned 0x37 [0142.452] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\", lpFilePart=0x0) returned 0x38 [0142.452] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0142.452] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.452] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.452] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.452] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.453] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0142.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.453] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl", lpFilePart=0x0) returned 0x37 [0142.453] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\", lpFilePart=0x0) returned 0x38 [0142.453] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0142.453] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.453] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.453] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.454] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.454] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0142.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.454] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3", lpFilePart=0x0) returned 0x45 [0142.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0142.454] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\-w a0 spr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.454] GetFileType (hFile=0x154) returned 0x1 [0142.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0142.454] GetFileType (hFile=0x154) returned 0x1 [0142.454] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x365e [0142.454] ReadFile (in: hFile=0x154, lpBuffer=0x19c4ea4, nNumberOfBytesToRead=0x365e, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19c4ea4*, lpNumberOfBytesRead=0x2ae4ec*=0x365e, lpOverlapped=0x0) returned 1 [0142.455] CloseHandle (hObject=0x154) returned 1 [0142.467] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3", lpFilePart=0x0) returned 0x45 [0142.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0142.467] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\-w a0 spr.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.468] GetFileType (hFile=0x154) returned 0x1 [0142.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0142.468] GetFileType (hFile=0x154) returned 0x1 [0142.468] WriteFile (in: hFile=0x154, lpBuffer=0x1a22dcc*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a22dcc*, lpNumberOfBytesWritten=0x2ae4e0*=0x3660, lpOverlapped=0x0) returned 1 [0142.470] CloseHandle (hObject=0x154) returned 1 [0142.470] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3", lpFilePart=0x0) returned 0x45 [0142.470] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3.anonymous", lpFilePart=0x0) returned 0x4f [0142.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0142.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\-w a0 spr.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0350, ftCreationTime.dwHighDateTime=0x1d41032, ftLastAccessTime.dwLowDateTime=0x4ffcf760, ftLastAccessTime.dwHighDateTime=0x1d412eb, ftLastWriteTime.dwLowDateTime=0xf3dbecb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3660)) returned 1 [0142.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.470] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\-w a0 spr.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\-w a0 spr.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\-w a0 spr.mp3.anonymous")) returned 1 [0142.471] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3", lpFilePart=0x0) returned 0x47 [0142.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0142.471] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\6ny9owdjxwn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.471] GetFileType (hFile=0x154) returned 0x1 [0142.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0142.471] GetFileType (hFile=0x154) returned 0x1 [0142.471] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x135df [0142.471] ReadFile (in: hFile=0x154, lpBuffer=0x1a2687c, nNumberOfBytesToRead=0x135df, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a2687c*, lpNumberOfBytesRead=0x2ae4ec*=0x135df, lpOverlapped=0x0) returned 1 [0142.472] CloseHandle (hObject=0x154) returned 1 [0142.486] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3", lpFilePart=0x0) returned 0x47 [0142.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0142.486] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\6ny9owdjxwn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.488] GetFileType (hFile=0x154) returned 0x1 [0142.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0142.488] GetFileType (hFile=0x154) returned 0x1 [0142.488] WriteFile (in: hFile=0x154, lpBuffer=0x1aad81c*, nNumberOfBytesToWrite=0x135e0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1aad81c*, lpNumberOfBytesWritten=0x2ae4e0*=0x135e0, lpOverlapped=0x0) returned 1 [0142.490] CloseHandle (hObject=0x154) returned 1 [0142.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3", lpFilePart=0x0) returned 0x47 [0142.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3.anonymous", lpFilePart=0x0) returned 0x51 [0142.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0142.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\6ny9owdjxwn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x227df750, ftCreationTime.dwHighDateTime=0x1d41302, ftLastAccessTime.dwLowDateTime=0x1670f2b0, ftLastAccessTime.dwHighDateTime=0x1d41568, ftLastWriteTime.dwLowDateTime=0xf3de4e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x135e0)) returned 1 [0142.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.491] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\6ny9owdjxwn.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\6GMfwp9DCgSCl\\6Ny9OwDjxwn.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\6gmfwp9dcgscl\\6ny9owdjxwn.mp3.anonymous")) returned 1 [0142.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.491] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE", lpFilePart=0x0) returned 0x34 [0142.491] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE\\", lpFilePart=0x0) returned 0x35 [0142.491] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0142.491] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.492] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.492] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.492] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.492] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.492] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.492] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.492] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE", lpFilePart=0x0) returned 0x34 [0142.492] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE\\", lpFilePart=0x0) returned 0x35 [0142.492] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\9-XcDQ4eQE\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0142.493] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.493] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.493] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.493] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.493] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.493] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.493] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.494] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO", lpFilePart=0x0) returned 0x31 [0142.494] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\", lpFilePart=0x0) returned 0x32 [0142.494] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0142.494] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.494] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.494] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.494] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.494] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO", lpFilePart=0x0) returned 0x31 [0142.495] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\", lpFilePart=0x0) returned 0x32 [0142.495] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0142.495] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.495] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.495] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.495] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.495] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0142.495] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu", lpFilePart=0x0) returned 0x3b [0142.496] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\", lpFilePart=0x0) returned 0x3c [0142.496] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0142.496] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.496] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.496] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.497] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.497] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.497] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.497] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0142.497] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0142.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0142.497] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu", lpFilePart=0x0) returned 0x3b [0142.497] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\", lpFilePart=0x0) returned 0x3c [0142.497] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0142.497] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.498] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.498] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.498] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.498] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.498] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0142.498] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0142.498] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0142.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0142.499] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x", lpFilePart=0x0) returned 0x4f [0142.499] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\", lpFilePart=0x0) returned 0x50 [0142.499] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0142.499] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.499] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.499] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.499] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.499] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.499] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0142.500] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0142.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0142.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0142.500] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x", lpFilePart=0x0) returned 0x4f [0142.500] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\", lpFilePart=0x0) returned 0x50 [0142.500] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0142.500] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.500] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.500] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.500] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.500] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.500] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0142.501] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0142.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0142.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0142.501] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3", lpFilePart=0x0) returned 0x61 [0142.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0142.501] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\mby-afieamoeh.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.501] GetFileType (hFile=0x154) returned 0x1 [0142.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0142.501] GetFileType (hFile=0x154) returned 0x1 [0142.501] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xaee9 [0142.501] ReadFile (in: hFile=0x154, lpBuffer=0x1ac9c10, nNumberOfBytesToRead=0xaee9, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ac9c10*, lpNumberOfBytesRead=0x2ae404*=0xaee9, lpOverlapped=0x0) returned 1 [0142.502] CloseHandle (hObject=0x154) returned 1 [0142.515] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3", lpFilePart=0x0) returned 0x61 [0142.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0142.516] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\mby-afieamoeh.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.517] GetFileType (hFile=0x154) returned 0x1 [0142.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0142.517] GetFileType (hFile=0x154) returned 0x1 [0142.517] WriteFile (in: hFile=0x154, lpBuffer=0x1b376e0*, nNumberOfBytesToWrite=0xaef0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b376e0*, lpNumberOfBytesWritten=0x2ae3f8*=0xaef0, lpOverlapped=0x0) returned 1 [0142.519] CloseHandle (hObject=0x154) returned 1 [0142.519] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3", lpFilePart=0x0) returned 0x61 [0142.519] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3.anonymous", lpFilePart=0x0) returned 0x6b [0142.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0142.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\mby-afieamoeh.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf85290, ftCreationTime.dwHighDateTime=0x1d41ac7, ftLastAccessTime.dwLowDateTime=0xa3eada10, ftLastAccessTime.dwHighDateTime=0x1d41e88, ftLastWriteTime.dwLowDateTime=0xf3e310d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaef0)) returned 1 [0142.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0142.519] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\mby-afieamoeh.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\mBy-AFIeamoeH.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\mby-afieamoeh.mp3.anonymous")) returned 1 [0142.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0142.520] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD", lpFilePart=0x0) returned 0x64 [0142.520] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\", lpFilePart=0x0) returned 0x65 [0142.520] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf098 [0142.520] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.520] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.520] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.520] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.520] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.520] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.521] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.521] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0142.521] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0142.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0142.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0142.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0142.521] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD", lpFilePart=0x0) returned 0x64 [0142.521] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\", lpFilePart=0x0) returned 0x65 [0142.521] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf098 [0142.521] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.521] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.521] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.521] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.522] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.522] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.522] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 1 [0142.522] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae150 | out: lpFindFileData=0x2ae150) returned 0 [0142.522] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0142.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0142.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0142.522] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3", lpFilePart=0x0) returned 0x7d [0142.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0142.522] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\9k7zzdusa8xo2u xatvb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.522] GetFileType (hFile=0x154) returned 0x1 [0142.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0142.522] GetFileType (hFile=0x154) returned 0x1 [0142.522] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xa8d [0142.522] ReadFile (in: hFile=0x154, lpBuffer=0x1b47108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x1b47108*, lpNumberOfBytesRead=0x2ae390*=0xa8d, lpOverlapped=0x0) returned 1 [0142.523] CloseHandle (hObject=0x154) returned 1 [0142.557] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3", lpFilePart=0x0) returned 0x7d [0142.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0142.557] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\9k7zzdusa8xo2u xatvb.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.559] GetFileType (hFile=0x154) returned 0x1 [0142.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0142.559] GetFileType (hFile=0x154) returned 0x1 [0142.559] WriteFile (in: hFile=0x154, lpBuffer=0x199a14c*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x199a14c*, lpNumberOfBytesWritten=0x2ae358*=0xa90, lpOverlapped=0x0) returned 1 [0142.560] CloseHandle (hObject=0x154) returned 1 [0142.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3", lpFilePart=0x0) returned 0x7d [0142.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3.anonymous", lpFilePart=0x0) returned 0x87 [0142.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0142.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\9k7zzdusa8xo2u xatvb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b4690, ftCreationTime.dwHighDateTime=0x1d41f01, ftLastAccessTime.dwLowDateTime=0xdfd54a40, ftLastAccessTime.dwHighDateTime=0x1d417af, ftLastWriteTime.dwLowDateTime=0xf3ea34f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa90)) returned 1 [0142.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0142.560] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\9k7zzdusa8xo2u xatvb.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\9K7ZZdusA8XO2U XAtvB.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\9k7zzdusa8xo2u xatvb.mp3.anonymous")) returned 1 [0142.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3", nBufferLength=0x105, lpBuffer=0x2adde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3", lpFilePart=0x0) returned 0x79 [0142.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2dc) returned 1 [0142.561] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\deze5uimluiif_7a.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.561] GetFileType (hFile=0x154) returned 0x1 [0142.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2d8) returned 1 [0142.561] GetFileType (hFile=0x154) returned 0x1 [0142.561] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0xb69a [0142.561] ReadFile (in: hFile=0x154, lpBuffer=0x199b658, nNumberOfBytesToRead=0xb69a, lpNumberOfBytesRead=0x2ae390, lpOverlapped=0x0 | out: lpBuffer=0x199b658*, lpNumberOfBytesRead=0x2ae390*=0xb69a, lpOverlapped=0x0) returned 1 [0142.562] CloseHandle (hObject=0x154) returned 1 [0142.577] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3", nBufferLength=0x105, lpBuffer=0x2addd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3", lpFilePart=0x0) returned 0x79 [0142.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae2c8) returned 1 [0142.577] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\deze5uimluiif_7a.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.579] GetFileType (hFile=0x154) returned 0x1 [0142.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae2c4) returned 1 [0142.579] GetFileType (hFile=0x154) returned 0x1 [0142.579] WriteFile (in: hFile=0x154, lpBuffer=0x1a0a994*, nNumberOfBytesToWrite=0xb6a0, lpNumberOfBytesWritten=0x2ae384, lpOverlapped=0x0 | out: lpBuffer=0x1a0a994*, lpNumberOfBytesWritten=0x2ae384*=0xb6a0, lpOverlapped=0x0) returned 1 [0142.580] CloseHandle (hObject=0x154) returned 1 [0142.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3", lpFilePart=0x0) returned 0x79 [0142.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2adf08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3.anonymous", lpFilePart=0x0) returned 0x83 [0142.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae368) returned 1 [0142.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\deze5uimluiif_7a.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d37680, ftCreationTime.dwHighDateTime=0x1d41d34, ftLastAccessTime.dwLowDateTime=0xf8992020, ftLastAccessTime.dwHighDateTime=0x1d41c3b, ftLastWriteTime.dwLowDateTime=0xf3ec9650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb6a0)) returned 1 [0142.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0142.581] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\deze5uimluiif_7a.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\23zHI8OjJbnZsjAdj_x\\3DpYj5ry0ZjBd9iVQIBD\\Deze5uImLuIIF_7a.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\23zhi8ojjbnzsjadj_x\\3dpyj5ry0zjbd9ivqibd\\deze5uimluiif_7a.mp3.anonymous")) returned 1 [0142.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0142.581] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t", lpFilePart=0x0) returned 0x50 [0142.581] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\", lpFilePart=0x0) returned 0x51 [0142.581] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0142.582] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.582] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.582] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.582] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.582] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0142.582] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0142.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0142.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0142.582] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t", lpFilePart=0x0) returned 0x50 [0142.582] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\", lpFilePart=0x0) returned 0x51 [0142.582] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0142.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0142.583] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0142.583] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0142.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0142.583] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3", lpFilePart=0x0) returned 0x5d [0142.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0142.583] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\bjzx2mxi.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.583] GetFileType (hFile=0x154) returned 0x1 [0142.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0142.583] GetFileType (hFile=0x154) returned 0x1 [0142.584] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3dad [0142.584] ReadFile (in: hFile=0x154, lpBuffer=0x1a18a90, nNumberOfBytesToRead=0x3dad, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a18a90*, lpNumberOfBytesRead=0x2ae404*=0x3dad, lpOverlapped=0x0) returned 1 [0142.585] CloseHandle (hObject=0x154) returned 1 [0142.596] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3", lpFilePart=0x0) returned 0x5d [0142.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0142.597] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\bjzx2mxi.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.598] GetFileType (hFile=0x154) returned 0x1 [0142.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0142.598] GetFileType (hFile=0x154) returned 0x1 [0142.598] WriteFile (in: hFile=0x154, lpBuffer=0x1a78cec*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a78cec*, lpNumberOfBytesWritten=0x2ae3f8*=0x3db0, lpOverlapped=0x0) returned 1 [0142.599] CloseHandle (hObject=0x154) returned 1 [0142.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3", lpFilePart=0x0) returned 0x5d [0142.599] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3.anonymous", lpFilePart=0x0) returned 0x67 [0142.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0142.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\bjzx2mxi.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f6eb390, ftCreationTime.dwHighDateTime=0x1d4104c, ftLastAccessTime.dwLowDateTime=0xaa78220, ftLastAccessTime.dwHighDateTime=0x1d415de, ftLastWriteTime.dwLowDateTime=0xf3eef7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3db0)) returned 1 [0142.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0142.599] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\bjzx2mxi.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\BJzX2MXi.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\bjzx2mxi.mp3.anonymous")) returned 1 [0142.658] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3", lpFilePart=0x0) returned 0x59 [0142.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0142.659] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\jfau.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.659] GetFileType (hFile=0x154) returned 0x1 [0142.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0142.659] GetFileType (hFile=0x154) returned 0x1 [0142.659] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x15d57 [0142.659] ReadFile (in: hFile=0x154, lpBuffer=0x6e92db0, nNumberOfBytesToRead=0x15d57, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x6e92db0*, lpNumberOfBytesRead=0x2ae404*=0x15d57, lpOverlapped=0x0) returned 1 [0142.661] CloseHandle (hObject=0x154) returned 1 [0142.679] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3", lpFilePart=0x0) returned 0x59 [0142.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0142.679] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\jfau.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.681] GetFileType (hFile=0x154) returned 0x1 [0142.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0142.681] GetFileType (hFile=0x154) returned 0x1 [0142.681] WriteFile (in: hFile=0x154, lpBuffer=0x6f000c8*, nNumberOfBytesToWrite=0x15d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x6f000c8*, lpNumberOfBytesWritten=0x2ae3f8*=0x15d60, lpOverlapped=0x0) returned 1 [0142.684] CloseHandle (hObject=0x154) returned 1 [0142.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3", lpFilePart=0x0) returned 0x59 [0142.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3.anonymous", lpFilePart=0x0) returned 0x63 [0142.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0142.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\jfau.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fcfc600, ftCreationTime.dwHighDateTime=0x1d41de5, ftLastAccessTime.dwLowDateTime=0x56e5f680, ftLastAccessTime.dwHighDateTime=0x1d41a34, ftLastWriteTime.dwLowDateTime=0xf3fd3ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x15d60)) returned 1 [0142.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0142.684] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\jfau.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\b7nWfnO\\h5WapsuJu\\jFqdjA3RSZtm8vl2Us7t\\Jfau.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\b7nwfno\\h5wapsuju\\jfqdja3rsztm8vl2us7t\\jfau.mp3.anonymous")) returned 1 [0142.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.685] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED", lpFilePart=0x0) returned 0x2f [0142.685] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\", lpFilePart=0x0) returned 0x30 [0142.685] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0142.685] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.685] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.685] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.685] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.685] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.686] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.686] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.686] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.686] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.686] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0142.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.686] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED", lpFilePart=0x0) returned 0x2f [0142.686] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\", lpFilePart=0x0) returned 0x30 [0142.686] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0142.686] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.686] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.687] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.687] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0142.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3", lpFilePart=0x0) returned 0x44 [0142.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0142.688] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\s6ted\\a7veytsgz8nlsdx7.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.688] GetFileType (hFile=0x154) returned 0x1 [0142.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0142.688] GetFileType (hFile=0x154) returned 0x1 [0142.688] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x11466 [0142.688] ReadFile (in: hFile=0x154, lpBuffer=0x1accb80, nNumberOfBytesToRead=0x11466, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1accb80*, lpNumberOfBytesRead=0x2ae4ec*=0x11466, lpOverlapped=0x0) returned 1 [0142.689] CloseHandle (hObject=0x154) returned 1 [0142.704] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3", lpFilePart=0x0) returned 0x44 [0142.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0142.704] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\s6ted\\a7veytsgz8nlsdx7.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.706] GetFileType (hFile=0x154) returned 0x1 [0142.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0142.706] GetFileType (hFile=0x154) returned 0x1 [0142.706] WriteFile (in: hFile=0x154, lpBuffer=0x1b4d6d0*, nNumberOfBytesToWrite=0x11470, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b4d6d0*, lpNumberOfBytesWritten=0x2ae4e0*=0x11470, lpOverlapped=0x0) returned 1 [0142.708] CloseHandle (hObject=0x154) returned 1 [0142.708] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3", lpFilePart=0x0) returned 0x44 [0142.708] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3.anonymous", lpFilePart=0x0) returned 0x4e [0142.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0142.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\s6ted\\a7veytsgz8nlsdx7.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e187960, ftCreationTime.dwHighDateTime=0x1d40fd8, ftLastAccessTime.dwLowDateTime=0xa2aa6860, ftLastAccessTime.dwHighDateTime=0x1d417c5, ftLastWriteTime.dwLowDateTime=0xf3ffa150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11470)) returned 1 [0142.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.709] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\s6ted\\a7veytsgz8nlsdx7.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\s6tED\\A7VEytsGZ8NlsDX7.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\s6ted\\a7veytsgz8nlsdx7.mp3.anonymous")) returned 1 [0142.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.709] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_", lpFilePart=0x0) returned 0x37 [0142.709] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\", lpFilePart=0x0) returned 0x38 [0142.710] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.710] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.710] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0142.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0142.711] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_", lpFilePart=0x0) returned 0x37 [0142.711] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\", lpFilePart=0x0) returned 0x38 [0142.711] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0142.711] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.711] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.711] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.711] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.711] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.711] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0142.712] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0142.712] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0142.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0142.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0142.712] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3", lpFilePart=0x0) returned 0x41 [0142.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0142.712] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\00vl5.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.712] GetFileType (hFile=0x154) returned 0x1 [0142.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0142.712] GetFileType (hFile=0x154) returned 0x1 [0142.712] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x278f [0142.712] ReadFile (in: hFile=0x154, lpBuffer=0x1b61460, nNumberOfBytesToRead=0x278f, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b61460*, lpNumberOfBytesRead=0x2ae4ec*=0x278f, lpOverlapped=0x0) returned 1 [0142.713] CloseHandle (hObject=0x154) returned 1 [0142.749] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3", lpFilePart=0x0) returned 0x41 [0142.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0142.749] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\00vl5.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.750] GetFileType (hFile=0x154) returned 0x1 [0142.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0142.750] GetFileType (hFile=0x154) returned 0x1 [0142.750] WriteFile (in: hFile=0x154, lpBuffer=0x19bb784*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19bb784*, lpNumberOfBytesWritten=0x2ae4e0*=0x2790, lpOverlapped=0x0) returned 1 [0142.752] CloseHandle (hObject=0x154) returned 1 [0142.752] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3", lpFilePart=0x0) returned 0x41 [0142.752] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3.anonymous", lpFilePart=0x0) returned 0x4b [0142.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0142.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\00vl5.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe78858f0, ftCreationTime.dwHighDateTime=0x1d40fca, ftLastAccessTime.dwLowDateTime=0x182b1280, ftLastAccessTime.dwHighDateTime=0x1d41a0d, ftLastWriteTime.dwLowDateTime=0xf406c570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2790)) returned 1 [0142.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.752] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\00vl5.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\00vl5.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\00vl5.mp3.anonymous")) returned 1 [0142.753] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3", lpFilePart=0x0) returned 0x4a [0142.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0142.753] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\frmacqmmcchm4x.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.753] GetFileType (hFile=0x154) returned 0x1 [0142.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0142.753] GetFileType (hFile=0x154) returned 0x1 [0142.753] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x56b9 [0142.753] ReadFile (in: hFile=0x154, lpBuffer=0x19be34c, nNumberOfBytesToRead=0x56b9, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19be34c*, lpNumberOfBytesRead=0x2ae4ec*=0x56b9, lpOverlapped=0x0) returned 1 [0142.754] CloseHandle (hObject=0x154) returned 1 [0142.766] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3", lpFilePart=0x0) returned 0x4a [0142.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0142.766] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\frmacqmmcchm4x.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.767] GetFileType (hFile=0x154) returned 0x1 [0142.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0142.767] GetFileType (hFile=0x154) returned 0x1 [0142.768] WriteFile (in: hFile=0x154, lpBuffer=0x1a26454*, nNumberOfBytesToWrite=0x56c0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a26454*, lpNumberOfBytesWritten=0x2ae4e0*=0x56c0, lpOverlapped=0x0) returned 1 [0142.769] CloseHandle (hObject=0x154) returned 1 [0142.769] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3", lpFilePart=0x0) returned 0x4a [0142.769] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3.anonymous", lpFilePart=0x0) returned 0x54 [0142.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0142.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\frmacqmmcchm4x.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a19e590, ftCreationTime.dwHighDateTime=0x1d41b2a, ftLastAccessTime.dwLowDateTime=0x7ef28580, ftLastAccessTime.dwHighDateTime=0x1d41cd2, ftLastWriteTime.dwLowDateTime=0xf40926d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x56c0)) returned 1 [0142.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.769] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\frmacqmmcchm4x.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\frmaCQMmCchm4x.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\frmacqmmcchm4x.mp3.anonymous")) returned 1 [0142.770] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3", lpFilePart=0x0) returned 0x48 [0142.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0142.770] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\qhu8neaxcajd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.770] GetFileType (hFile=0x154) returned 0x1 [0142.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0142.770] GetFileType (hFile=0x154) returned 0x1 [0142.770] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x134a5 [0142.770] ReadFile (in: hFile=0x154, lpBuffer=0x1a2bfc0, nNumberOfBytesToRead=0x134a5, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a2bfc0*, lpNumberOfBytesRead=0x2ae4ec*=0x134a5, lpOverlapped=0x0) returned 1 [0142.771] CloseHandle (hObject=0x154) returned 1 [0142.785] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3", lpFilePart=0x0) returned 0x48 [0142.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0142.785] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\qhu8neaxcajd.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.787] GetFileType (hFile=0x154) returned 0x1 [0142.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0142.787] GetFileType (hFile=0x154) returned 0x1 [0142.787] WriteFile (in: hFile=0x154, lpBuffer=0x1ab2bd0*, nNumberOfBytesToWrite=0x134b0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1ab2bd0*, lpNumberOfBytesWritten=0x2ae4e0*=0x134b0, lpOverlapped=0x0) returned 1 [0142.789] CloseHandle (hObject=0x154) returned 1 [0142.789] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3", lpFilePart=0x0) returned 0x48 [0142.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3.anonymous", lpFilePart=0x0) returned 0x52 [0142.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0142.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\qhu8neaxcajd.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f90520, ftCreationTime.dwHighDateTime=0x1d41476, ftLastAccessTime.dwLowDateTime=0xebaaf600, ftLastAccessTime.dwHighDateTime=0x1d4171c, ftLastWriteTime.dwLowDateTime=0xf40b8830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x134b0)) returned 1 [0142.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0142.790] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\qhu8neaxcajd.mp3"), lpNewFileName="C:\\Users\\EEBsYm5\\Music\\wB_8nMJAwNyX-Q40vF\\UkRBEL88HcTc_\\qHu8neaXCAJd.mp3.anonymous" (normalized: "c:\\users\\eebsym5\\music\\wb_8nmjawnyx-q40vf\\ukrbel88hctc_\\qhu8neaxcajd.mp3.anonymous")) returned 1 [0142.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\My Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\My Documents", lpFilePart=0x0) returned 0x1d [0142.790] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\My Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\My Documents\\", lpFilePart=0x0) returned 0x1e [0142.790] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\My Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0142.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0142.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.792] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\NetHood", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\NetHood", lpFilePart=0x0) returned 0x18 [0142.792] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\NetHood\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\NetHood\\", lpFilePart=0x0) returned 0x19 [0142.792] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\NetHood\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0142.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0142.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.799] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures", lpFilePart=0x0) returned 0x19 [0142.799] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\", lpFilePart=0x0) returned 0x1a [0142.799] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.799] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.799] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.799] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.799] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.800] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.800] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.800] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.800] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.800] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.800] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.800] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0142.800] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures", lpFilePart=0x0) returned 0x19 [0142.800] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\", lpFilePart=0x0) returned 0x1a [0142.800] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.801] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0142.802] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0142.802] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0142.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0142.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0142.802] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg", lpFilePart=0x0) returned 0x30 [0142.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.802] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\dd5uzuigdkdv9cuxtb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.802] GetFileType (hFile=0x154) returned 0x1 [0142.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.802] GetFileType (hFile=0x154) returned 0x1 [0142.802] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x12ee4 [0142.802] ReadFile (in: hFile=0x154, lpBuffer=0x1ac97d8, nNumberOfBytesToRead=0x12ee4, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1ac97d8*, lpNumberOfBytesRead=0x2ae5d4*=0x12ee4, lpOverlapped=0x0) returned 1 [0142.803] CloseHandle (hObject=0x154) returned 1 [0142.840] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg", lpFilePart=0x0) returned 0x30 [0142.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.840] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\dd5uzuigdkdv9cuxtb.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.842] GetFileType (hFile=0x154) returned 0x1 [0142.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.842] GetFileType (hFile=0x154) returned 0x1 [0142.842] WriteFile (in: hFile=0x154, lpBuffer=0x1b4f2a4*, nNumberOfBytesToWrite=0x12ef0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b4f2a4*, lpNumberOfBytesWritten=0x2ae5c8*=0x12ef0, lpOverlapped=0x0) returned 1 [0142.844] CloseHandle (hObject=0x154) returned 1 [0142.844] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg", lpFilePart=0x0) returned 0x30 [0142.844] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg.anonymous", lpFilePart=0x0) returned 0x3a [0142.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\dd5uzuigdkdv9cuxtb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2b3480, ftCreationTime.dwHighDateTime=0x1d41d63, ftLastAccessTime.dwLowDateTime=0x27b3fb40, ftLastAccessTime.dwHighDateTime=0x1d41274, ftLastWriteTime.dwLowDateTime=0xf4150db0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12ef0)) returned 1 [0142.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.844] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\dd5uzuigdkdv9cuxtb.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\dD5UZUigDkdV9CuxtB.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\dd5uzuigdkdv9cuxtb.jpg.anonymous")) returned 1 [0142.845] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif", lpFilePart=0x0) returned 0x2d [0142.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.845] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif" (normalized: "c:\\users\\eebsym5\\pictures\\gzzbmi9utac4vsv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.845] GetFileType (hFile=0x154) returned 0x1 [0142.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.845] GetFileType (hFile=0x154) returned 0x1 [0142.845] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x6165 [0142.845] ReadFile (in: hFile=0x154, lpBuffer=0x1b62544, nNumberOfBytesToRead=0x6165, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b62544*, lpNumberOfBytesRead=0x2ae5d4*=0x6165, lpOverlapped=0x0) returned 1 [0142.846] CloseHandle (hObject=0x154) returned 1 [0142.896] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif", lpFilePart=0x0) returned 0x2d [0142.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.896] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif" (normalized: "c:\\users\\eebsym5\\pictures\\gzzbmi9utac4vsv.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.898] GetFileType (hFile=0x154) returned 0x1 [0142.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.898] GetFileType (hFile=0x154) returned 0x1 [0142.898] WriteFile (in: hFile=0x154, lpBuffer=0x19d0c40*, nNumberOfBytesToWrite=0x6170, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x19d0c40*, lpNumberOfBytesWritten=0x2ae5c8*=0x6170, lpOverlapped=0x0) returned 1 [0142.899] CloseHandle (hObject=0x154) returned 1 [0142.899] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif", lpFilePart=0x0) returned 0x2d [0142.899] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif.anonymous", lpFilePart=0x0) returned 0x37 [0142.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.899] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif" (normalized: "c:\\users\\eebsym5\\pictures\\gzzbmi9utac4vsv.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81d09f70, ftCreationTime.dwHighDateTime=0x1d4126f, ftLastAccessTime.dwLowDateTime=0xef043c80, ftLastAccessTime.dwHighDateTime=0x1d41974, ftLastWriteTime.dwLowDateTime=0xf41c31d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6170)) returned 1 [0142.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.900] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif" (normalized: "c:\\users\\eebsym5\\pictures\\gzzbmi9utac4vsv.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\GzZbmi9uTAc4vsv.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\gzzbmi9utac4vsv.gif.anonymous")) returned 1 [0142.900] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif", lpFilePart=0x0) returned 0x30 [0142.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.900] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif" (normalized: "c:\\users\\eebsym5\\pictures\\nn77itemj4h9fpnuoi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.900] GetFileType (hFile=0x154) returned 0x1 [0142.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.901] GetFileType (hFile=0x154) returned 0x1 [0142.901] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xfba5 [0142.901] ReadFile (in: hFile=0x154, lpBuffer=0x19d7130, nNumberOfBytesToRead=0xfba5, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x19d7130*, lpNumberOfBytesRead=0x2ae5d4*=0xfba5, lpOverlapped=0x0) returned 1 [0142.904] CloseHandle (hObject=0x154) returned 1 [0142.921] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif", lpFilePart=0x0) returned 0x30 [0142.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.921] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif" (normalized: "c:\\users\\eebsym5\\pictures\\nn77itemj4h9fpnuoi.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.923] GetFileType (hFile=0x154) returned 0x1 [0142.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.923] GetFileType (hFile=0x154) returned 0x1 [0142.923] WriteFile (in: hFile=0x154, lpBuffer=0x1a5339c*, nNumberOfBytesToWrite=0xfbb0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1a5339c*, lpNumberOfBytesWritten=0x2ae5c8*=0xfbb0, lpOverlapped=0x0) returned 1 [0142.925] CloseHandle (hObject=0x154) returned 1 [0142.925] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif", lpFilePart=0x0) returned 0x30 [0142.925] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif.anonymous", lpFilePart=0x0) returned 0x3a [0142.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif" (normalized: "c:\\users\\eebsym5\\pictures\\nn77itemj4h9fpnuoi.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01b3c0, ftCreationTime.dwHighDateTime=0x1d413e3, ftLastAccessTime.dwLowDateTime=0x2a2380a0, ftLastAccessTime.dwHighDateTime=0x1d41bb4, ftLastWriteTime.dwLowDateTime=0xf420f490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xfbb0)) returned 1 [0142.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.925] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif" (normalized: "c:\\users\\eebsym5\\pictures\\nn77itemj4h9fpnuoi.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\Nn77itEMj4H9FpNUOI.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\nn77itemj4h9fpnuoi.gif.anonymous")) returned 1 [0142.926] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png", lpFilePart=0x0) returned 0x28 [0142.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.926] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png" (normalized: "c:\\users\\eebsym5\\pictures\\u9bkaqdezd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.926] GetFileType (hFile=0x154) returned 0x1 [0142.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.926] GetFileType (hFile=0x154) returned 0x1 [0142.926] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xe458 [0142.926] ReadFile (in: hFile=0x154, lpBuffer=0x1a632d4, nNumberOfBytesToRead=0xe458, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1a632d4*, lpNumberOfBytesRead=0x2ae5d4*=0xe458, lpOverlapped=0x0) returned 1 [0142.928] CloseHandle (hObject=0x154) returned 1 [0142.942] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png", lpFilePart=0x0) returned 0x28 [0142.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.943] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png" (normalized: "c:\\users\\eebsym5\\pictures\\u9bkaqdezd.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.944] GetFileType (hFile=0x154) returned 0x1 [0142.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.944] GetFileType (hFile=0x154) returned 0x1 [0142.944] WriteFile (in: hFile=0x154, lpBuffer=0x1adadf0*, nNumberOfBytesToWrite=0xe460, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1adadf0*, lpNumberOfBytesWritten=0x2ae5c8*=0xe460, lpOverlapped=0x0) returned 1 [0142.946] CloseHandle (hObject=0x154) returned 1 [0142.946] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png", lpFilePart=0x0) returned 0x28 [0142.946] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png.anonymous", lpFilePart=0x0) returned 0x32 [0142.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png" (normalized: "c:\\users\\eebsym5\\pictures\\u9bkaqdezd.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62bf1d0, ftCreationTime.dwHighDateTime=0x1d41f3c, ftLastAccessTime.dwLowDateTime=0x6907ee70, ftLastAccessTime.dwHighDateTime=0x1d42035, ftLastWriteTime.dwLowDateTime=0xf42355f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe460)) returned 1 [0142.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.947] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png" (normalized: "c:\\users\\eebsym5\\pictures\\u9bkaqdezd.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\u9BkAqdEzd.png.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\u9bkaqdezd.png.anonymous")) returned 1 [0142.947] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif", lpFilePart=0x0) returned 0x2e [0142.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0142.947] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif" (normalized: "c:\\users\\eebsym5\\pictures\\yloz2wnuafq1vkxb.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.947] GetFileType (hFile=0x154) returned 0x1 [0142.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0142.947] GetFileType (hFile=0x154) returned 0x1 [0142.947] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x164fa [0142.948] ReadFile (in: hFile=0x154, lpBuffer=0x6fc0e88, nNumberOfBytesToRead=0x164fa, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x6fc0e88*, lpNumberOfBytesRead=0x2ae5d4*=0x164fa, lpOverlapped=0x0) returned 1 [0142.950] CloseHandle (hObject=0x154) returned 1 [0142.983] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif", lpFilePart=0x0) returned 0x2e [0142.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0142.983] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif" (normalized: "c:\\users\\eebsym5\\pictures\\yloz2wnuafq1vkxb.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.985] GetFileType (hFile=0x154) returned 0x1 [0142.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0142.985] GetFileType (hFile=0x154) returned 0x1 [0142.985] WriteFile (in: hFile=0x154, lpBuffer=0x70307c0*, nNumberOfBytesToWrite=0x16500, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x70307c0*, lpNumberOfBytesWritten=0x2ae5c8*=0x16500, lpOverlapped=0x0) returned 1 [0142.987] CloseHandle (hObject=0x154) returned 1 [0142.987] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif", lpFilePart=0x0) returned 0x2e [0142.987] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif.anonymous", lpFilePart=0x0) returned 0x38 [0142.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0142.988] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif" (normalized: "c:\\users\\eebsym5\\pictures\\yloz2wnuafq1vkxb.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b11d0, ftCreationTime.dwHighDateTime=0x1d41b42, ftLastAccessTime.dwLowDateTime=0x3b4726d0, ftLastAccessTime.dwHighDateTime=0x1d416fe, ftLastWriteTime.dwLowDateTime=0xf42a7a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16500)) returned 1 [0142.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.988] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif" (normalized: "c:\\users\\eebsym5\\pictures\\yloz2wnuafq1vkxb.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\YlOZ2WnUaFq1vkXB.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\yloz2wnuafq1vkxb.gif.anonymous")) returned 1 [0142.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.988] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50", lpFilePart=0x0) returned 0x22 [0142.988] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\", lpFilePart=0x0) returned 0x23 [0142.988] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.989] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.989] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0142.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0142.989] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50", lpFilePart=0x0) returned 0x22 [0142.989] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\", lpFilePart=0x0) returned 0x23 [0142.990] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0142.990] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0142.991] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0142.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0142.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0142.991] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg", lpFilePart=0x0) returned 0x2f [0142.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0142.991] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\lxkm e7r.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0142.991] GetFileType (hFile=0x154) returned 0x1 [0142.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0142.991] GetFileType (hFile=0x154) returned 0x1 [0142.991] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2f32 [0142.991] ReadFile (in: hFile=0x154, lpBuffer=0x1b384c4, nNumberOfBytesToRead=0x2f32, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1b384c4*, lpNumberOfBytesRead=0x2ae560*=0x2f32, lpOverlapped=0x0) returned 1 [0142.992] CloseHandle (hObject=0x154) returned 1 [0143.007] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg", lpFilePart=0x0) returned 0x2f [0143.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.007] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\lxkm e7r.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.009] GetFileType (hFile=0x154) returned 0x1 [0143.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.009] GetFileType (hFile=0x154) returned 0x1 [0143.009] WriteFile (in: hFile=0x154, lpBuffer=0x1994ad4*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1994ad4*, lpNumberOfBytesWritten=0x2ae554*=0x2f40, lpOverlapped=0x0) returned 1 [0143.010] CloseHandle (hObject=0x154) returned 1 [0143.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg", lpFilePart=0x0) returned 0x2f [0143.010] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg.anonymous", lpFilePart=0x0) returned 0x39 [0143.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\lxkm e7r.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x357f1860, ftCreationTime.dwHighDateTime=0x1d41b37, ftLastAccessTime.dwLowDateTime=0x458305e0, ftLastAccessTime.dwHighDateTime=0x1d41fc5, ftLastWriteTime.dwLowDateTime=0xf42cdb70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f40)) returned 1 [0143.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.010] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\lxkm e7r.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\lXKm e7R.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\lxkm e7r.jpg.anonymous")) returned 1 [0143.011] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp", lpFilePart=0x0) returned 0x38 [0143.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.011] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\m7xrcmqs3zqktqalh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.011] GetFileType (hFile=0x154) returned 0x1 [0143.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.011] GetFileType (hFile=0x154) returned 0x1 [0143.011] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1638f [0143.012] ReadFile (in: hFile=0x154, lpBuffer=0x7046ce0, nNumberOfBytesToRead=0x1638f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x7046ce0*, lpNumberOfBytesRead=0x2ae560*=0x1638f, lpOverlapped=0x0) returned 1 [0143.013] CloseHandle (hObject=0x154) returned 1 [0143.078] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp", lpFilePart=0x0) returned 0x38 [0143.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.078] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\m7xrcmqs3zqktqalh.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.080] GetFileType (hFile=0x154) returned 0x1 [0143.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.081] GetFileType (hFile=0x154) returned 0x1 [0143.081] WriteFile (in: hFile=0x154, lpBuffer=0x70b5ef0*, nNumberOfBytesToWrite=0x16390, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x70b5ef0*, lpNumberOfBytesWritten=0x2ae554*=0x16390, lpOverlapped=0x0) returned 1 [0143.083] CloseHandle (hObject=0x154) returned 1 [0143.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp", lpFilePart=0x0) returned 0x38 [0143.083] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp.anonymous", lpFilePart=0x0) returned 0x42 [0143.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\m7xrcmqs3zqktqalh.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d48650, ftCreationTime.dwHighDateTime=0x1d4109b, ftLastAccessTime.dwLowDateTime=0x88884b10, ftLastAccessTime.dwHighDateTime=0x1d41b89, ftLastWriteTime.dwLowDateTime=0xf438c250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16390)) returned 1 [0143.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.083] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\m7xrcmqs3zqktqalh.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\m7XRcmqs3ZQktQALH.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\m7xrcmqs3zqktqalh.bmp.anonymous")) returned 1 [0143.084] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png", lpFilePart=0x0) returned 0x37 [0143.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.084] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\pewmtpggaxal3w8v.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.084] GetFileType (hFile=0x154) returned 0x1 [0143.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.084] GetFileType (hFile=0x154) returned 0x1 [0143.084] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x77ac [0143.084] ReadFile (in: hFile=0x154, lpBuffer=0x19e50dc, nNumberOfBytesToRead=0x77ac, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19e50dc*, lpNumberOfBytesRead=0x2ae560*=0x77ac, lpOverlapped=0x0) returned 1 [0143.085] CloseHandle (hObject=0x154) returned 1 [0143.098] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png", lpFilePart=0x0) returned 0x37 [0143.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.098] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\pewmtpggaxal3w8v.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.100] GetFileType (hFile=0x154) returned 0x1 [0143.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.100] GetFileType (hFile=0x154) returned 0x1 [0143.100] WriteFile (in: hFile=0x154, lpBuffer=0x1a57534*, nNumberOfBytesToWrite=0x77b0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a57534*, lpNumberOfBytesWritten=0x2ae554*=0x77b0, lpOverlapped=0x0) returned 1 [0143.101] CloseHandle (hObject=0x154) returned 1 [0143.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png", lpFilePart=0x0) returned 0x37 [0143.101] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png.anonymous", lpFilePart=0x0) returned 0x41 [0143.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\pewmtpggaxal3w8v.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4def7640, ftCreationTime.dwHighDateTime=0x1d418a0, ftLastAccessTime.dwLowDateTime=0x39d8ebf0, ftLastAccessTime.dwHighDateTime=0x1d41d00, ftLastWriteTime.dwLowDateTime=0xf43b23b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x77b0)) returned 1 [0143.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.102] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\pewmtpggaxal3w8v.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\PEWMTPGGaXAl3w8V.png.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\pewmtpggaxal3w8v.png.anonymous")) returned 1 [0143.102] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif", lpFilePart=0x0) returned 0x3a [0143.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.102] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\veyax_kx gmcgxb_ocm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.103] GetFileType (hFile=0x154) returned 0x1 [0143.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.103] GetFileType (hFile=0x154) returned 0x1 [0143.103] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xa4d2 [0143.103] ReadFile (in: hFile=0x154, lpBuffer=0x1a5f0cc, nNumberOfBytesToRead=0xa4d2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a5f0cc*, lpNumberOfBytesRead=0x2ae560*=0xa4d2, lpOverlapped=0x0) returned 1 [0143.104] CloseHandle (hObject=0x154) returned 1 [0143.116] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif", lpFilePart=0x0) returned 0x3a [0143.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.116] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\veyax_kx gmcgxb_ocm.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.118] GetFileType (hFile=0x154) returned 0x1 [0143.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.118] GetFileType (hFile=0x154) returned 0x1 [0143.118] WriteFile (in: hFile=0x154, lpBuffer=0x1adf718*, nNumberOfBytesToWrite=0xa4e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1adf718*, lpNumberOfBytesWritten=0x2ae554*=0xa4e0, lpOverlapped=0x0) returned 1 [0143.120] CloseHandle (hObject=0x154) returned 1 [0143.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif", lpFilePart=0x0) returned 0x3a [0143.120] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif.anonymous", lpFilePart=0x0) returned 0x44 [0143.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\veyax_kx gmcgxb_ocm.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf870c220, ftCreationTime.dwHighDateTime=0x1d41e60, ftLastAccessTime.dwLowDateTime=0x116a0340, ftLastAccessTime.dwHighDateTime=0x1d411ff, ftLastWriteTime.dwLowDateTime=0xf43d8510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa4e0)) returned 1 [0143.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.120] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\veyax_kx gmcgxb_ocm.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\VeYaX_KX GmcGXb_ocM.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\veyax_kx gmcgxb_ocm.gif.anonymous")) returned 1 [0143.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.121] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK", lpFilePart=0x0) returned 0x2e [0143.121] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\", lpFilePart=0x0) returned 0x2f [0143.121] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0143.121] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.121] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.121] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.121] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.121] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.121] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.122] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0143.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.122] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK", lpFilePart=0x0) returned 0x2e [0143.122] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\", lpFilePart=0x0) returned 0x2f [0143.122] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0143.122] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.122] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.123] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.123] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0143.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.123] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png", lpFilePart=0x0) returned 0x43 [0143.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.124] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\1onxye82anj2f0ex.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.124] GetFileType (hFile=0x154) returned 0x1 [0143.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.124] GetFileType (hFile=0x154) returned 0x1 [0143.124] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x146f3 [0143.124] ReadFile (in: hFile=0x154, lpBuffer=0x1aec768, nNumberOfBytesToRead=0x146f3, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1aec768*, lpNumberOfBytesRead=0x2ae4ec*=0x146f3, lpOverlapped=0x0) returned 1 [0143.125] CloseHandle (hObject=0x154) returned 1 [0143.140] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png", lpFilePart=0x0) returned 0x43 [0143.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.140] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\1onxye82anj2f0ex.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.142] GetFileType (hFile=0x154) returned 0x1 [0143.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.142] GetFileType (hFile=0x154) returned 0x1 [0143.142] WriteFile (in: hFile=0x154, lpBuffer=0x1b76a68*, nNumberOfBytesToWrite=0x14700, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b76a68*, lpNumberOfBytesWritten=0x2ae4e0*=0x14700, lpOverlapped=0x0) returned 1 [0143.144] CloseHandle (hObject=0x154) returned 1 [0143.144] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png", lpFilePart=0x0) returned 0x43 [0143.145] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png.anonymous", lpFilePart=0x0) returned 0x4d [0143.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\1onxye82anj2f0ex.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd73d8c0, ftCreationTime.dwHighDateTime=0x1d418fc, ftLastAccessTime.dwLowDateTime=0xf362d4d0, ftLastAccessTime.dwHighDateTime=0x1d41839, ftLastWriteTime.dwLowDateTime=0xf44247d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14700)) returned 1 [0143.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.145] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\1onxye82anj2f0ex.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\1OnXyE82AnJ2F0eX.png.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\1onxye82anj2f0ex.png.anonymous")) returned 1 [0143.145] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp", lpFilePart=0x0) returned 0x3e [0143.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.145] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\pqjwgvxhx-w.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.145] GetFileType (hFile=0x154) returned 0x1 [0143.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.146] GetFileType (hFile=0x154) returned 0x1 [0143.146] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x462f [0143.148] ReadFile (in: hFile=0x154, lpBuffer=0x1985d44, nNumberOfBytesToRead=0x462f, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1985d44*, lpNumberOfBytesRead=0x2ae4ec*=0x462f, lpOverlapped=0x0) returned 1 [0143.149] CloseHandle (hObject=0x154) returned 1 [0143.189] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp", lpFilePart=0x0) returned 0x3e [0143.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.189] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\pqjwgvxhx-w.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.191] GetFileType (hFile=0x154) returned 0x1 [0143.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.191] GetFileType (hFile=0x154) returned 0x1 [0143.191] WriteFile (in: hFile=0x154, lpBuffer=0x19e8b7c*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19e8b7c*, lpNumberOfBytesWritten=0x2ae4e0*=0x4630, lpOverlapped=0x0) returned 1 [0143.193] CloseHandle (hObject=0x154) returned 1 [0143.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp", lpFilePart=0x0) returned 0x3e [0143.193] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp.anonymous", lpFilePart=0x0) returned 0x48 [0143.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.193] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\pqjwgvxhx-w.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d343900, ftCreationTime.dwHighDateTime=0x1d4119b, ftLastAccessTime.dwLowDateTime=0xcde0aa80, ftLastAccessTime.dwHighDateTime=0x1d4186a, ftLastWriteTime.dwLowDateTime=0xf4496bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4630)) returned 1 [0143.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.193] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\pqjwgvxhx-w.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\pqJWGvXhx-w.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\pqjwgvxhx-w.bmp.anonymous")) returned 1 [0143.194] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png", lpFilePart=0x0) returned 0x44 [0143.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.194] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\rjbqb4ash4blq6z0s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.194] GetFileType (hFile=0x154) returned 0x1 [0143.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.194] GetFileType (hFile=0x154) returned 0x1 [0143.194] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xcdf7 [0143.194] ReadFile (in: hFile=0x154, lpBuffer=0x19ed5d8, nNumberOfBytesToRead=0xcdf7, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19ed5d8*, lpNumberOfBytesRead=0x2ae4ec*=0xcdf7, lpOverlapped=0x0) returned 1 [0143.196] CloseHandle (hObject=0x154) returned 1 [0143.217] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png", lpFilePart=0x0) returned 0x44 [0143.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.217] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\rjbqb4ash4blq6z0s.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.220] GetFileType (hFile=0x154) returned 0x1 [0143.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.220] GetFileType (hFile=0x154) returned 0x1 [0143.220] WriteFile (in: hFile=0x154, lpBuffer=0x1a60dd8*, nNumberOfBytesToWrite=0xce00, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a60dd8*, lpNumberOfBytesWritten=0x2ae4e0*=0xce00, lpOverlapped=0x0) returned 1 [0143.222] CloseHandle (hObject=0x154) returned 1 [0143.222] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png", lpFilePart=0x0) returned 0x44 [0143.222] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png.anonymous", lpFilePart=0x0) returned 0x4e [0143.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\rjbqb4ash4blq6z0s.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb62f3a0, ftCreationTime.dwHighDateTime=0x1d4180b, ftLastAccessTime.dwLowDateTime=0x5a630bc0, ftLastAccessTime.dwHighDateTime=0x1d41ec8, ftLastWriteTime.dwLowDateTime=0xf44e2eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xce00)) returned 1 [0143.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.222] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\rjbqb4ash4blq6z0s.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\RjBqb4ash4blq6Z0s.png.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\rjbqb4ash4blq6z0s.png.anonymous")) returned 1 [0143.223] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png", lpFilePart=0x0) returned 0x3f [0143.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.223] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\vrgk1btu0osy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.223] GetFileType (hFile=0x154) returned 0x1 [0143.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.223] GetFileType (hFile=0x154) returned 0x1 [0143.223] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x99cf [0143.223] ReadFile (in: hFile=0x154, lpBuffer=0x1a6e02c, nNumberOfBytesToRead=0x99cf, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a6e02c*, lpNumberOfBytesRead=0x2ae4ec*=0x99cf, lpOverlapped=0x0) returned 1 [0143.224] CloseHandle (hObject=0x154) returned 1 [0143.237] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png", lpFilePart=0x0) returned 0x3f [0143.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.237] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\vrgk1btu0osy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.238] GetFileType (hFile=0x154) returned 0x1 [0143.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.239] GetFileType (hFile=0x154) returned 0x1 [0143.239] WriteFile (in: hFile=0x154, lpBuffer=0x1aeaf28*, nNumberOfBytesToWrite=0x99d0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1aeaf28*, lpNumberOfBytesWritten=0x2ae4e0*=0x99d0, lpOverlapped=0x0) returned 1 [0143.240] CloseHandle (hObject=0x154) returned 1 [0143.240] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png", lpFilePart=0x0) returned 0x3f [0143.240] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png.anonymous", lpFilePart=0x0) returned 0x49 [0143.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\vrgk1btu0osy.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd98f750, ftCreationTime.dwHighDateTime=0x1d41185, ftLastAccessTime.dwLowDateTime=0xa8526a30, ftLastAccessTime.dwHighDateTime=0x1d41e99, ftLastWriteTime.dwLowDateTime=0xf4509010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x99d0)) returned 1 [0143.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.240] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\vrgk1btu0osy.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\VRgK1BTu0OSy.png.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\vrgk1btu0osy.png.anonymous")) returned 1 [0143.241] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif", lpFilePart=0x0) returned 0x39 [0143.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.241] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\w0xap6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.241] GetFileType (hFile=0x154) returned 0x1 [0143.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.241] GetFileType (hFile=0x154) returned 0x1 [0143.241] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xd488 [0143.241] ReadFile (in: hFile=0x154, lpBuffer=0x1af4cfc, nNumberOfBytesToRead=0xd488, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1af4cfc*, lpNumberOfBytesRead=0x2ae4ec*=0xd488, lpOverlapped=0x0) returned 1 [0143.242] CloseHandle (hObject=0x154) returned 1 [0143.256] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif", lpFilePart=0x0) returned 0x39 [0143.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.256] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\w0xap6.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.258] GetFileType (hFile=0x154) returned 0x1 [0143.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.258] GetFileType (hFile=0x154) returned 0x1 [0143.258] WriteFile (in: hFile=0x154, lpBuffer=0x1b698a8*, nNumberOfBytesToWrite=0xd490, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b698a8*, lpNumberOfBytesWritten=0x2ae4e0*=0xd490, lpOverlapped=0x0) returned 1 [0143.259] CloseHandle (hObject=0x154) returned 1 [0143.259] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif", lpFilePart=0x0) returned 0x39 [0143.260] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif.anonymous", lpFilePart=0x0) returned 0x43 [0143.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.260] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\w0xap6.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad98980, ftCreationTime.dwHighDateTime=0x1d41b6d, ftLastAccessTime.dwLowDateTime=0x6276ff60, ftLastAccessTime.dwHighDateTime=0x1d42008, ftLastWriteTime.dwLowDateTime=0xf452f170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd490)) returned 1 [0143.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.260] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\w0xap6.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\W0xap6.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\w0xap6.gif.anonymous")) returned 1 [0143.260] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif", lpFilePart=0x0) returned 0x37 [0143.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.261] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\xqoc.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.261] GetFileType (hFile=0x154) returned 0x1 [0143.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.261] GetFileType (hFile=0x154) returned 0x1 [0143.261] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x18a17 [0143.261] ReadFile (in: hFile=0x154, lpBuffer=0x71295c0, nNumberOfBytesToRead=0x18a17, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x71295c0*, lpNumberOfBytesRead=0x2ae4ec*=0x18a17, lpOverlapped=0x0) returned 1 [0143.263] CloseHandle (hObject=0x154) returned 1 [0143.306] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif", lpFilePart=0x0) returned 0x37 [0143.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.306] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\xqoc.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.309] GetFileType (hFile=0x154) returned 0x1 [0143.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.309] GetFileType (hFile=0x154) returned 0x1 [0143.309] WriteFile (in: hFile=0x154, lpBuffer=0x71a4898*, nNumberOfBytesToWrite=0x18a20, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x71a4898*, lpNumberOfBytesWritten=0x2ae4e0*=0x18a20, lpOverlapped=0x0) returned 1 [0143.311] CloseHandle (hObject=0x154) returned 1 [0143.311] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif", lpFilePart=0x0) returned 0x37 [0143.311] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif.anonymous", lpFilePart=0x0) returned 0x41 [0143.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\xqoc.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce3860, ftCreationTime.dwHighDateTime=0x1d41639, ftLastAccessTime.dwLowDateTime=0x4c3830, ftLastAccessTime.dwHighDateTime=0x1d41920, ftLastWriteTime.dwLowDateTime=0xf45c76f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18a20)) returned 1 [0143.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.311] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\xqoc.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\xqOc.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\xqoc.gif.anonymous")) returned 1 [0143.312] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif", lpFilePart=0x0) returned 0x3f [0143.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.312] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\yokylgnsjxgm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.312] GetFileType (hFile=0x154) returned 0x1 [0143.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.312] GetFileType (hFile=0x154) returned 0x1 [0143.312] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x684e [0143.312] ReadFile (in: hFile=0x154, lpBuffer=0x19c44c8, nNumberOfBytesToRead=0x684e, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19c44c8*, lpNumberOfBytesRead=0x2ae4ec*=0x684e, lpOverlapped=0x0) returned 1 [0143.313] CloseHandle (hObject=0x154) returned 1 [0143.326] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif", lpFilePart=0x0) returned 0x3f [0143.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.326] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\yokylgnsjxgm.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.327] GetFileType (hFile=0x154) returned 0x1 [0143.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.327] GetFileType (hFile=0x154) returned 0x1 [0143.327] WriteFile (in: hFile=0x154, lpBuffer=0x1a31da0*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a31da0*, lpNumberOfBytesWritten=0x2ae4e0*=0x6850, lpOverlapped=0x0) returned 1 [0143.328] CloseHandle (hObject=0x154) returned 1 [0143.329] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif", lpFilePart=0x0) returned 0x3f [0143.329] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif.anonymous", lpFilePart=0x0) returned 0x49 [0143.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\yokylgnsjxgm.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86508d0, ftCreationTime.dwHighDateTime=0x1d40fe8, ftLastAccessTime.dwLowDateTime=0x54679c30, ftLastAccessTime.dwHighDateTime=0x1d41bf9, ftLastWriteTime.dwLowDateTime=0xf45ed850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6850)) returned 1 [0143.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.329] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\yokylgnsjxgm.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\5o3Fto50\\hdv_PKiO-SK\\yOkyLgNSjxGM.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\5o3fto50\\hdv_pkio-sk\\yokylgnsjxgm.gif.anonymous")) returned 1 [0143.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.332] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p", lpFilePart=0x0) returned 0x23 [0143.332] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\", lpFilePart=0x0) returned 0x24 [0143.332] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0143.332] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.332] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.332] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.332] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.332] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.333] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0143.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.333] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p", lpFilePart=0x0) returned 0x23 [0143.333] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\", lpFilePart=0x0) returned 0x24 [0143.333] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf098 [0143.333] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.333] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.333] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.333] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.333] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.333] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0143.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.334] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp", lpFilePart=0x0) returned 0x2f [0143.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.334] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\nazj52r.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.334] GetFileType (hFile=0x154) returned 0x1 [0143.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.334] GetFileType (hFile=0x154) returned 0x1 [0143.334] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf4b0 [0143.334] ReadFile (in: hFile=0x154, lpBuffer=0x1a3a124, nNumberOfBytesToRead=0xf4b0, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1a3a124*, lpNumberOfBytesRead=0x2ae560*=0xf4b0, lpOverlapped=0x0) returned 1 [0143.335] CloseHandle (hObject=0x154) returned 1 [0143.349] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp", lpFilePart=0x0) returned 0x2f [0143.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.349] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\nazj52r.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.351] GetFileType (hFile=0x154) returned 0x1 [0143.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.351] GetFileType (hFile=0x154) returned 0x1 [0143.351] WriteFile (in: hFile=0x154, lpBuffer=0x1ab4d60*, nNumberOfBytesToWrite=0xf4c0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ab4d60*, lpNumberOfBytesWritten=0x2ae554*=0xf4c0, lpOverlapped=0x0) returned 1 [0143.352] CloseHandle (hObject=0x154) returned 1 [0143.353] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp", lpFilePart=0x0) returned 0x2f [0143.353] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp.anonymous", lpFilePart=0x0) returned 0x39 [0143.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\nazj52r.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85bb80, ftCreationTime.dwHighDateTime=0x1d4131d, ftLastAccessTime.dwLowDateTime=0x8ad5c390, ftLastAccessTime.dwHighDateTime=0x1d415a1, ftLastWriteTime.dwLowDateTime=0xf46139b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf4c0)) returned 1 [0143.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.353] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\nazj52r.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\nAzj52R.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\nazj52r.bmp.anonymous")) returned 1 [0143.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.353] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs", lpFilePart=0x0) returned 0x35 [0143.354] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\", lpFilePart=0x0) returned 0x36 [0143.354] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0143.354] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.354] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.354] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.355] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.355] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs", lpFilePart=0x0) returned 0x35 [0143.355] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\", lpFilePart=0x0) returned 0x36 [0143.355] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0143.355] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.355] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.355] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.355] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0143.355] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K", lpFilePart=0x0) returned 0x46 [0143.355] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\", lpFilePart=0x0) returned 0x47 [0143.356] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0143.356] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.356] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.356] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.356] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.356] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0143.356] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0143.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0143.356] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K", lpFilePart=0x0) returned 0x46 [0143.356] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\", lpFilePart=0x0) returned 0x47 [0143.357] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0143.357] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.357] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.357] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.357] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0143.357] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0143.357] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0143.357] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp", lpFilePart=0x0) returned 0x50 [0143.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0143.357] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\hdwj1.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.358] GetFileType (hFile=0x154) returned 0x1 [0143.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0143.358] GetFileType (hFile=0x154) returned 0x1 [0143.358] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x15993 [0143.358] ReadFile (in: hFile=0x154, lpBuffer=0x71dbc58, nNumberOfBytesToRead=0x15993, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x71dbc58*, lpNumberOfBytesRead=0x2ae478*=0x15993, lpOverlapped=0x0) returned 1 [0143.360] CloseHandle (hObject=0x154) returned 1 [0143.378] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp", lpFilePart=0x0) returned 0x50 [0143.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0143.378] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\hdwj1.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.380] GetFileType (hFile=0x154) returned 0x1 [0143.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0143.380] GetFileType (hFile=0x154) returned 0x1 [0143.380] WriteFile (in: hFile=0x154, lpBuffer=0x7247ca8*, nNumberOfBytesToWrite=0x159a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x7247ca8*, lpNumberOfBytesWritten=0x2ae46c*=0x159a0, lpOverlapped=0x0) returned 1 [0143.382] CloseHandle (hObject=0x154) returned 1 [0143.382] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp", lpFilePart=0x0) returned 0x50 [0143.382] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp.anonymous", lpFilePart=0x0) returned 0x5a [0143.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0143.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\hdwj1.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff931b30, ftCreationTime.dwHighDateTime=0x1d4193c, ftLastAccessTime.dwLowDateTime=0x9a41d270, ftLastAccessTime.dwHighDateTime=0x1d41d93, ftLastWriteTime.dwLowDateTime=0xf465fc70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x159a0)) returned 1 [0143.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0143.383] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\hdwj1.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\hDWJ1.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\hdwj1.bmp.anonymous")) returned 1 [0143.383] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg", lpFilePart=0x0) returned 0x58 [0143.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0143.383] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\xfkwyoqw4t p-.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.383] GetFileType (hFile=0x154) returned 0x1 [0143.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0143.384] GetFileType (hFile=0x154) returned 0x1 [0143.384] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xf510 [0143.384] ReadFile (in: hFile=0x154, lpBuffer=0x1b1506c, nNumberOfBytesToRead=0xf510, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b1506c*, lpNumberOfBytesRead=0x2ae478*=0xf510, lpOverlapped=0x0) returned 1 [0143.385] CloseHandle (hObject=0x154) returned 1 [0143.406] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg", lpFilePart=0x0) returned 0x58 [0143.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0143.406] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\xfkwyoqw4t p-.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.408] GetFileType (hFile=0x154) returned 0x1 [0143.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0143.408] GetFileType (hFile=0x154) returned 0x1 [0143.408] WriteFile (in: hFile=0x154, lpBuffer=0x19956d0*, nNumberOfBytesToWrite=0xf520, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19956d0*, lpNumberOfBytesWritten=0x2ae46c*=0xf520, lpOverlapped=0x0) returned 1 [0143.410] CloseHandle (hObject=0x154) returned 1 [0143.410] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg", lpFilePart=0x0) returned 0x58 [0143.410] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg.anonymous", lpFilePart=0x0) returned 0x62 [0143.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0143.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\xfkwyoqw4t p-.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbacc590, ftCreationTime.dwHighDateTime=0x1d41be9, ftLastAccessTime.dwLowDateTime=0xa8388cf0, ftLastAccessTime.dwHighDateTime=0x1d411dd, ftLastWriteTime.dwLowDateTime=0xf46abf30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf520)) returned 1 [0143.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0143.410] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\xfkwyoqw4t p-.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\xFkWYOQW4T p-.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\xfkwyoqw4t p-.jpg.anonymous")) returned 1 [0143.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0143.411] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE", lpFilePart=0x0) returned 0x5a [0143.411] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\", lpFilePart=0x0) returned 0x5b [0143.411] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0143.411] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0143.411] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0143.412] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0143.412] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0143.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0143.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0143.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0143.412] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE", lpFilePart=0x0) returned 0x5a [0143.412] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\", lpFilePart=0x0) returned 0x5b [0143.412] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0143.412] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0143.412] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0143.412] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0143.412] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0143.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0143.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0143.413] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp", lpFilePart=0x0) returned 0x64 [0143.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0143.413] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\ku7hnyohpazbdgmdyxe\\eqo31.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.413] GetFileType (hFile=0x154) returned 0x1 [0143.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0143.413] GetFileType (hFile=0x154) returned 0x1 [0143.413] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x18802 [0143.413] ReadFile (in: hFile=0x154, lpBuffer=0x727c0a8, nNumberOfBytesToRead=0x18802, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x727c0a8*, lpNumberOfBytesRead=0x2ae404*=0x18802, lpOverlapped=0x0) returned 1 [0143.415] CloseHandle (hObject=0x154) returned 1 [0143.455] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp", lpFilePart=0x0) returned 0x64 [0143.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0143.455] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\ku7hnyohpazbdgmdyxe\\eqo31.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.457] GetFileType (hFile=0x154) returned 0x1 [0143.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0143.458] GetFileType (hFile=0x154) returned 0x1 [0143.458] WriteFile (in: hFile=0x154, lpBuffer=0x72f6928*, nNumberOfBytesToWrite=0x18810, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x72f6928*, lpNumberOfBytesWritten=0x2ae3f8*=0x18810, lpOverlapped=0x0) returned 1 [0143.487] CloseHandle (hObject=0x154) returned 1 [0143.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp", lpFilePart=0x0) returned 0x64 [0143.487] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp.anonymous", lpFilePart=0x0) returned 0x6e [0143.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0143.488] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\ku7hnyohpazbdgmdyxe\\eqo31.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da4f700, ftCreationTime.dwHighDateTime=0x1d41382, ftLastAccessTime.dwLowDateTime=0x9f8d7b70, ftLastAccessTime.dwHighDateTime=0x1d41afb, ftLastWriteTime.dwLowDateTime=0xf476a610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18810)) returned 1 [0143.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0143.488] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\ku7hnyohpazbdgmdyxe\\eqo31.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\ZiJjA-Ibwg55JKcfs\\ZU2sp0smEPln4K9K\\Ku7HnYOhpazBDGMdYxE\\Eqo31.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\zijja-ibwg55jkcfs\\zu2sp0smepln4k9k\\ku7hnyohpazbdgmdyxe\\eqo31.bmp.anonymous")) returned 1 [0143.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.488] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM", lpFilePart=0x0) returned 0x36 [0143.488] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\", lpFilePart=0x0) returned 0x37 [0143.488] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.489] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.489] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.490] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM", lpFilePart=0x0) returned 0x36 [0143.490] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\", lpFilePart=0x0) returned 0x37 [0143.490] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0143.490] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.490] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.490] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.490] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.490] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.490] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.491] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.491] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.491] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.491] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.491] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif", lpFilePart=0x0) returned 0x44 [0143.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.491] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\fjq8hu0hf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.491] GetFileType (hFile=0x154) returned 0x1 [0143.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.491] GetFileType (hFile=0x154) returned 0x1 [0143.491] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x18bd8 [0143.492] ReadFile (in: hFile=0x154, lpBuffer=0x730f158, nNumberOfBytesToRead=0x18bd8, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x730f158*, lpNumberOfBytesRead=0x2ae4ec*=0x18bd8, lpOverlapped=0x0) returned 1 [0143.494] CloseHandle (hObject=0x154) returned 1 [0143.555] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif", lpFilePart=0x0) returned 0x44 [0143.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.555] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\fjq8hu0hf.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.557] GetFileType (hFile=0x154) returned 0x1 [0143.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.557] GetFileType (hFile=0x154) returned 0x1 [0143.557] WriteFile (in: hFile=0x154, lpBuffer=0x738acf0*, nNumberOfBytesToWrite=0x18be0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x738acf0*, lpNumberOfBytesWritten=0x2ae4e0*=0x18be0, lpOverlapped=0x0) returned 1 [0143.560] CloseHandle (hObject=0x154) returned 1 [0143.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif", lpFilePart=0x0) returned 0x44 [0143.560] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif.anonymous", lpFilePart=0x0) returned 0x4e [0143.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\fjq8hu0hf.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4eea10, ftCreationTime.dwHighDateTime=0x1d41450, ftLastAccessTime.dwLowDateTime=0xe1c34c30, ftLastAccessTime.dwHighDateTime=0x1d4140d, ftLastWriteTime.dwLowDateTime=0xf4828cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x18be0)) returned 1 [0143.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.560] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\fjq8hu0hf.gif"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\fJq8hu0HF.gif.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\fjq8hu0hf.gif.anonymous")) returned 1 [0143.561] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp", lpFilePart=0x0) returned 0x48 [0143.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.561] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\kydfobwqeur2d.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.561] GetFileType (hFile=0x154) returned 0x1 [0143.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.561] GetFileType (hFile=0x154) returned 0x1 [0143.561] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x999 [0143.561] ReadFile (in: hFile=0x154, lpBuffer=0x1a44a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a44a38*, lpNumberOfBytesRead=0x2ae4ec*=0x999, lpOverlapped=0x0) returned 1 [0143.562] CloseHandle (hObject=0x154) returned 1 [0143.576] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp", lpFilePart=0x0) returned 0x48 [0143.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.576] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\kydfobwqeur2d.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.578] GetFileType (hFile=0x154) returned 0x1 [0143.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.578] GetFileType (hFile=0x154) returned 0x1 [0143.578] WriteFile (in: hFile=0x154, lpBuffer=0x1a95980*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a95980*, lpNumberOfBytesWritten=0x2ae4b4*=0x9a0, lpOverlapped=0x0) returned 1 [0143.580] CloseHandle (hObject=0x154) returned 1 [0143.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp", lpFilePart=0x0) returned 0x48 [0143.580] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp.anonymous", lpFilePart=0x0) returned 0x52 [0143.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\kydfobwqeur2d.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a78f5b0, ftCreationTime.dwHighDateTime=0x1d41d72, ftLastAccessTime.dwLowDateTime=0xfd2bbe70, ftLastAccessTime.dwHighDateTime=0x1d412b5, ftLastWriteTime.dwLowDateTime=0xf484ee50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0143.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.580] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\kydfobwqeur2d.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\kydFOBwqEUR2d.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\kydfobwqeur2d.bmp.anonymous")) returned 1 [0143.581] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg", lpFilePart=0x0) returned 0x42 [0143.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.581] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\o8k_mnw.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.582] GetFileType (hFile=0x154) returned 0x1 [0143.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.582] GetFileType (hFile=0x154) returned 0x1 [0143.582] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x17752 [0143.582] ReadFile (in: hFile=0x154, lpBuffer=0x73a38f0, nNumberOfBytesToRead=0x17752, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x73a38f0*, lpNumberOfBytesRead=0x2ae4ec*=0x17752, lpOverlapped=0x0) returned 1 [0143.585] CloseHandle (hObject=0x154) returned 1 [0143.611] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg", lpFilePart=0x0) returned 0x42 [0143.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.611] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\o8k_mnw.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.613] GetFileType (hFile=0x154) returned 0x1 [0143.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.614] GetFileType (hFile=0x154) returned 0x1 [0143.614] WriteFile (in: hFile=0x154, lpBuffer=0x7418e00*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x7418e00*, lpNumberOfBytesWritten=0x2ae4e0*=0x17760, lpOverlapped=0x0) returned 1 [0143.616] CloseHandle (hObject=0x154) returned 1 [0143.616] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg", lpFilePart=0x0) returned 0x42 [0143.616] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg.anonymous", lpFilePart=0x0) returned 0x4c [0143.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\o8k_mnw.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5163b4a0, ftCreationTime.dwHighDateTime=0x1d41b41, ftLastAccessTime.dwLowDateTime=0x22d9b770, ftLastAccessTime.dwHighDateTime=0x1d41cbc, ftLastWriteTime.dwLowDateTime=0xf489b110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17760)) returned 1 [0143.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.616] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\o8k_mnw.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\o8k_mNw.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\o8k_mnw.jpg.anonymous")) returned 1 [0143.617] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png", lpFilePart=0x0) returned 0x4e [0143.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.617] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\q0ihg6qs8jq74wmt-ds.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.617] GetFileType (hFile=0x154) returned 0x1 [0143.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.617] GetFileType (hFile=0x154) returned 0x1 [0143.617] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xb47d [0143.617] ReadFile (in: hFile=0x154, lpBuffer=0x1ae3f14, nNumberOfBytesToRead=0xb47d, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1ae3f14*, lpNumberOfBytesRead=0x2ae4ec*=0xb47d, lpOverlapped=0x0) returned 1 [0143.618] CloseHandle (hObject=0x154) returned 1 [0143.633] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png", lpFilePart=0x0) returned 0x4e [0143.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.633] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\q0ihg6qs8jq74wmt-ds.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.636] GetFileType (hFile=0x154) returned 0x1 [0143.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.636] GetFileType (hFile=0x154) returned 0x1 [0143.636] WriteFile (in: hFile=0x154, lpBuffer=0x1b52a94*, nNumberOfBytesToWrite=0xb480, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b52a94*, lpNumberOfBytesWritten=0x2ae4e0*=0xb480, lpOverlapped=0x0) returned 1 [0143.638] CloseHandle (hObject=0x154) returned 1 [0143.638] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png", lpFilePart=0x0) returned 0x4e [0143.638] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png.anonymous", lpFilePart=0x0) returned 0x58 [0143.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\q0ihg6qs8jq74wmt-ds.png"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112f93c0, ftCreationTime.dwHighDateTime=0x1d4117a, ftLastAccessTime.dwLowDateTime=0x60bbabe0, ftLastAccessTime.dwHighDateTime=0x1d41b07, ftLastWriteTime.dwLowDateTime=0xf48e73d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb480)) returned 1 [0143.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.638] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\q0ihg6qs8jq74wmt-ds.png"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\q0IHg6QS8jQ74wMT-dS.png.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\q0ihg6qs8jq74wmt-ds.png.anonymous")) returned 1 [0143.639] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg", lpFilePart=0x0) returned 0x43 [0143.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.639] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qgeckfb3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.639] GetFileType (hFile=0x154) returned 0x1 [0143.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.639] GetFileType (hFile=0x154) returned 0x1 [0143.639] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xf4db [0143.639] ReadFile (in: hFile=0x154, lpBuffer=0x1b5e3bc, nNumberOfBytesToRead=0xf4db, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b5e3bc*, lpNumberOfBytesRead=0x2ae4ec*=0xf4db, lpOverlapped=0x0) returned 1 [0143.640] CloseHandle (hObject=0x154) returned 1 [0143.684] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg", lpFilePart=0x0) returned 0x43 [0143.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.684] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qgeckfb3.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.686] GetFileType (hFile=0x154) returned 0x1 [0143.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.686] GetFileType (hFile=0x154) returned 0x1 [0143.686] WriteFile (in: hFile=0x154, lpBuffer=0x19d8dac*, nNumberOfBytesToWrite=0xf4e0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19d8dac*, lpNumberOfBytesWritten=0x2ae4e0*=0xf4e0, lpOverlapped=0x0) returned 1 [0143.688] CloseHandle (hObject=0x154) returned 1 [0143.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg", lpFilePart=0x0) returned 0x43 [0143.688] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg.anonymous", lpFilePart=0x0) returned 0x4d [0143.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qgeckfb3.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x231b2160, ftCreationTime.dwHighDateTime=0x1d41947, ftLastAccessTime.dwLowDateTime=0x8796e0d0, ftLastAccessTime.dwHighDateTime=0x1d41b76, ftLastWriteTime.dwLowDateTime=0xf49597f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf4e0)) returned 1 [0143.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.688] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qgeckfb3.jpg"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qgeCkfb3.jpg.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qgeckfb3.jpg.anonymous")) returned 1 [0143.689] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp", lpFilePart=0x0) returned 0x44 [0143.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.689] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qovrlpplb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.689] GetFileType (hFile=0x154) returned 0x1 [0143.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.689] GetFileType (hFile=0x154) returned 0x1 [0143.689] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6c52 [0143.689] ReadFile (in: hFile=0x154, lpBuffer=0x19e86c4, nNumberOfBytesToRead=0x6c52, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x19e86c4*, lpNumberOfBytesRead=0x2ae4ec*=0x6c52, lpOverlapped=0x0) returned 1 [0143.690] CloseHandle (hObject=0x154) returned 1 [0143.703] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp", lpFilePart=0x0) returned 0x44 [0143.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.703] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qovrlpplb.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.704] GetFileType (hFile=0x154) returned 0x1 [0143.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.704] GetFileType (hFile=0x154) returned 0x1 [0143.704] WriteFile (in: hFile=0x154, lpBuffer=0x1a573ec*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a573ec*, lpNumberOfBytesWritten=0x2ae4e0*=0x6c60, lpOverlapped=0x0) returned 1 [0143.706] CloseHandle (hObject=0x154) returned 1 [0143.706] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp", lpFilePart=0x0) returned 0x44 [0143.706] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp.anonymous", lpFilePart=0x0) returned 0x4e [0143.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qovrlpplb.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28a3950, ftCreationTime.dwHighDateTime=0x1d41d96, ftLastAccessTime.dwLowDateTime=0x36044f10, ftLastAccessTime.dwHighDateTime=0x1d41c15, ftLastWriteTime.dwLowDateTime=0xf497f950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6c60)) returned 1 [0143.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.706] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qovrlpplb.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\qOvrlPPlb.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\qovrlpplb.bmp.anonymous")) returned 1 [0143.707] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp", lpFilePart=0x0) returned 0x44 [0143.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.707] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\rromc4h_s.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.707] GetFileType (hFile=0x154) returned 0x1 [0143.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.707] GetFileType (hFile=0x154) returned 0x1 [0143.707] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x9eb9 [0143.707] ReadFile (in: hFile=0x154, lpBuffer=0x1a5e494, nNumberOfBytesToRead=0x9eb9, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1a5e494*, lpNumberOfBytesRead=0x2ae4ec*=0x9eb9, lpOverlapped=0x0) returned 1 [0143.708] CloseHandle (hObject=0x154) returned 1 [0143.722] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp", lpFilePart=0x0) returned 0x44 [0143.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.722] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\rromc4h_s.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.724] GetFileType (hFile=0x154) returned 0x1 [0143.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.724] GetFileType (hFile=0x154) returned 0x1 [0143.724] WriteFile (in: hFile=0x154, lpBuffer=0x1adcc40*, nNumberOfBytesToWrite=0x9ec0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1adcc40*, lpNumberOfBytesWritten=0x2ae4e0*=0x9ec0, lpOverlapped=0x0) returned 1 [0143.726] CloseHandle (hObject=0x154) returned 1 [0143.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp", lpFilePart=0x0) returned 0x44 [0143.726] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp.anonymous", lpFilePart=0x0) returned 0x4e [0143.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\rromc4h_s.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07ab490, ftCreationTime.dwHighDateTime=0x1d41522, ftLastAccessTime.dwLowDateTime=0x17f264f0, ftLastAccessTime.dwHighDateTime=0x1d41a7e, ftLastWriteTime.dwLowDateTime=0xf49a5ab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9ec0)) returned 1 [0143.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.726] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\rromc4h_s.bmp"), lpNewFileName="C:\\Users\\EEBsYm5\\Pictures\\F8xvCF21p\\_OoYy V oRzKyIRWOM\\RROmC4h_S.bmp.anonymous" (normalized: "c:\\users\\eebsym5\\pictures\\f8xvcf21p\\_ooyy v orzkyirwom\\rromc4h_s.bmp.anonymous")) returned 1 [0143.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.727] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\PrintHood", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\PrintHood", lpFilePart=0x0) returned 0x1a [0143.727] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\PrintHood\\", lpFilePart=0x0) returned 0x1b [0143.727] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\PrintHood\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0143.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0143.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.729] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Recent", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Recent", lpFilePart=0x0) returned 0x17 [0143.729] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Recent\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Recent\\", lpFilePart=0x0) returned 0x18 [0143.730] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Recent\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0143.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0143.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.731] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Saved Games", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Saved Games", lpFilePart=0x0) returned 0x1c [0143.731] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Saved Games\\", lpFilePart=0x0) returned 0x1d [0143.731] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Saved Games\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0143.731] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.732] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.732] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.732] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.732] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Saved Games", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Saved Games", lpFilePart=0x0) returned 0x1c [0143.732] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Saved Games\\", lpFilePart=0x0) returned 0x1d [0143.732] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Saved Games\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0143.732] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.732] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.733] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.733] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.733] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Searches", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Searches", lpFilePart=0x0) returned 0x19 [0143.733] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Searches\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Searches\\", lpFilePart=0x0) returned 0x1a [0143.733] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Searches\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0143.733] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.733] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.733] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.733] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.734] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.734] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.734] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Searches", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Searches", lpFilePart=0x0) returned 0x19 [0143.734] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Searches\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Searches\\", lpFilePart=0x0) returned 0x1a [0143.734] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Searches\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0143.734] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.734] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.734] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.734] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.735] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.735] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.735] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\SendTo", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\SendTo", lpFilePart=0x0) returned 0x17 [0143.735] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\SendTo\\", lpFilePart=0x0) returned 0x18 [0143.735] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\SendTo\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0143.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0143.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.737] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Start Menu", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Start Menu", lpFilePart=0x0) returned 0x1b [0143.737] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Start Menu\\", lpFilePart=0x0) returned 0x1c [0143.737] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Start Menu\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0143.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0143.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.738] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Templates", lpFilePart=0x0) returned 0x1a [0143.738] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Templates\\", lpFilePart=0x0) returned 0x1b [0143.738] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xffffffff [0143.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae620) returned 1 [0143.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.739] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos", lpFilePart=0x0) returned 0x17 [0143.739] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\", lpFilePart=0x0) returned 0x18 [0143.739] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.740] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.741] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.741] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.741] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.741] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos", lpFilePart=0x0) returned 0x17 [0143.741] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\", lpFilePart=0x0) returned 0x18 [0143.741] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0143.741] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.741] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.741] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.742] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.742] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.743] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9", lpFilePart=0x0) returned 0x28 [0143.743] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\", lpFilePart=0x0) returned 0x29 [0143.743] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee58 [0143.743] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.743] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.743] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.743] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.743] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.744] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.744] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.744] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.744] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9", lpFilePart=0x0) returned 0x28 [0143.744] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\", lpFilePart=0x0) returned 0x29 [0143.744] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee58 [0143.744] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.744] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.744] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.745] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.745] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.745] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.745] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.745] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0143.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.745] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv", lpFilePart=0x0) returned 0x34 [0143.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.745] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\xl0iev_.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.745] GetFileType (hFile=0x154) returned 0x1 [0143.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.746] GetFileType (hFile=0x154) returned 0x1 [0143.746] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2f2b [0143.746] ReadFile (in: hFile=0x154, lpBuffer=0x1aefd08, nNumberOfBytesToRead=0x2f2b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x1aefd08*, lpNumberOfBytesRead=0x2ae560*=0x2f2b, lpOverlapped=0x0) returned 1 [0143.747] CloseHandle (hObject=0x154) returned 1 [0143.785] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv", lpFilePart=0x0) returned 0x34 [0143.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.785] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\xl0iev_.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.786] GetFileType (hFile=0x154) returned 0x1 [0143.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.786] GetFileType (hFile=0x154) returned 0x1 [0143.786] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b6e4*, nNumberOfBytesToWrite=0x2f30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b4b6e4*, lpNumberOfBytesWritten=0x2ae554*=0x2f30, lpOverlapped=0x0) returned 1 [0143.787] CloseHandle (hObject=0x154) returned 1 [0143.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv", lpFilePart=0x0) returned 0x34 [0143.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv.anonymous", lpFilePart=0x0) returned 0x3e [0143.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\xl0iev_.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ba5a850, ftCreationTime.dwHighDateTime=0x1d41bbd, ftLastAccessTime.dwLowDateTime=0xa37670e0, ftLastAccessTime.dwHighDateTime=0x1d41d29, ftLastWriteTime.dwLowDateTime=0xf4a3e030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f30)) returned 1 [0143.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.788] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\xl0iev_.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\Xl0iEv_.flv.anonymous" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\xl0iev_.flv.anonymous")) returned 1 [0143.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.788] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui", lpFilePart=0x0) returned 0x37 [0143.789] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\", lpFilePart=0x0) returned 0x38 [0143.789] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0143.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.789] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.789] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0143.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.789] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui", lpFilePart=0x0) returned 0x37 [0143.789] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\", lpFilePart=0x0) returned 0x38 [0143.790] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0143.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.790] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.790] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0143.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.790] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv", lpFilePart=0x0) returned 0x40 [0143.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0143.791] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\w95s vzdyibkui\\bglz.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.791] GetFileType (hFile=0x154) returned 0x1 [0143.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0143.791] GetFileType (hFile=0x154) returned 0x1 [0143.791] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6b4d [0143.791] ReadFile (in: hFile=0x154, lpBuffer=0x1b50734, nNumberOfBytesToRead=0x6b4d, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x1b50734*, lpNumberOfBytesRead=0x2ae4ec*=0x6b4d, lpOverlapped=0x0) returned 1 [0143.792] CloseHandle (hObject=0x154) returned 1 [0143.835] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv", lpFilePart=0x0) returned 0x40 [0143.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0143.835] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\w95s vzdyibkui\\bglz.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.836] GetFileType (hFile=0x154) returned 0x1 [0143.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0143.837] GetFileType (hFile=0x154) returned 0x1 [0143.837] WriteFile (in: hFile=0x154, lpBuffer=0x19b6264*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19b6264*, lpNumberOfBytesWritten=0x2ae4e0*=0x6b50, lpOverlapped=0x0) returned 1 [0143.838] CloseHandle (hObject=0x154) returned 1 [0143.838] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv", lpFilePart=0x0) returned 0x40 [0143.838] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv.anonymous", lpFilePart=0x0) returned 0x4a [0143.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0143.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\w95s vzdyibkui\\bglz.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5feb80, ftCreationTime.dwHighDateTime=0x1d41458, ftLastAccessTime.dwLowDateTime=0xb33f15b0, ftLastAccessTime.dwHighDateTime=0x1d411f6, ftLastWriteTime.dwLowDateTime=0xf4ad65b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6b50)) returned 1 [0143.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0143.838] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\w95s vzdyibkui\\bglz.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\Videos\\8HMaRtU-2LKA3 p9\\w95s vZdyibKui\\Bglz.flv.anonymous" (normalized: "c:\\users\\eebsym5\\videos\\8hmartu-2lka3 p9\\w95s vzdyibkui\\bglz.flv.anonymous")) returned 1 [0143.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.839] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h", lpFilePart=0x0) returned 0x2a [0143.839] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\", lpFilePart=0x0) returned 0x2b [0143.839] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbef18 [0143.839] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.839] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.840] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.840] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.840] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.840] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0143.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.840] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h", lpFilePart=0x0) returned 0x2a [0143.840] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\", lpFilePart=0x0) returned 0x2b [0143.840] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbef18 [0143.840] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.840] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.841] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.841] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.841] FindNextFileW (in: hFindFile=0xbef18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.841] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0143.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.841] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv", lpFilePart=0x0) returned 0x3a [0143.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.841] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv" (normalized: "c:\\users\\eebsym5\\videos\\mtgl88wkcvnnh2_o1h\\zx22w9jelux.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.841] GetFileType (hFile=0x154) returned 0x1 [0143.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.841] GetFileType (hFile=0x154) returned 0x1 [0143.841] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1025e [0143.841] ReadFile (in: hFile=0x154, lpBuffer=0x19beb28, nNumberOfBytesToRead=0x1025e, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x19beb28*, lpNumberOfBytesRead=0x2ae560*=0x1025e, lpOverlapped=0x0) returned 1 [0143.843] CloseHandle (hObject=0x154) returned 1 [0143.857] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv", lpFilePart=0x0) returned 0x3a [0143.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.857] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv" (normalized: "c:\\users\\eebsym5\\videos\\mtgl88wkcvnnh2_o1h\\zx22w9jelux.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.859] GetFileType (hFile=0x154) returned 0x1 [0143.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.859] GetFileType (hFile=0x154) returned 0x1 [0143.859] WriteFile (in: hFile=0x154, lpBuffer=0x1a3c1a4*, nNumberOfBytesToWrite=0x10260, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a3c1a4*, lpNumberOfBytesWritten=0x2ae554*=0x10260, lpOverlapped=0x0) returned 1 [0143.861] CloseHandle (hObject=0x154) returned 1 [0143.861] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv", lpFilePart=0x0) returned 0x3a [0143.861] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv.anonymous", lpFilePart=0x0) returned 0x44 [0143.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv" (normalized: "c:\\users\\eebsym5\\videos\\mtgl88wkcvnnh2_o1h\\zx22w9jelux.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920424e0, ftCreationTime.dwHighDateTime=0x1d41b91, ftLastAccessTime.dwLowDateTime=0xb459e9b0, ftLastAccessTime.dwHighDateTime=0x1d413a5, ftLastWriteTime.dwLowDateTime=0xf4afc710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10260)) returned 1 [0143.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.861] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv" (normalized: "c:\\users\\eebsym5\\videos\\mtgl88wkcvnnh2_o1h\\zx22w9jelux.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\ZX22W9JelUx.flv.anonymous" (normalized: "c:\\users\\eebsym5\\videos\\mtgl88wkcvnnh2_o1h\\zx22w9jelux.flv.anonymous")) returned 1 [0143.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.862] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC", lpFilePart=0x0) returned 0x3a [0143.862] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC\\", lpFilePart=0x0) returned 0x3b [0143.862] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0143.862] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.862] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.863] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0143.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.863] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC", lpFilePart=0x0) returned 0x3a [0143.863] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC\\", lpFilePart=0x0) returned 0x3b [0143.863] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\MTGl88WkCvNNh2_o1h\\k4JfjzV5sv15IeC\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf2d8 [0143.863] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.864] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.864] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.864] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.864] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.864] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.864] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0143.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.864] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw", lpFilePart=0x0) returned 0x21 [0143.864] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\", lpFilePart=0x0) returned 0x22 [0143.865] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf2d8 [0143.865] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.865] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.865] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.865] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.865] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.865] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0143.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.865] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw", lpFilePart=0x0) returned 0x21 [0143.865] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\", lpFilePart=0x0) returned 0x22 [0143.865] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf2d8 [0143.866] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.866] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.866] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.866] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.866] FindNextFileW (in: hFindFile=0xbf2d8, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.866] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0143.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.866] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv", lpFilePart=0x0) returned 0x39 [0143.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0143.866] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv" (normalized: "c:\\users\\eebsym5\\videos\\rrnbpsokw\\g9pgaul1dr zn_vdegy.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.867] GetFileType (hFile=0x154) returned 0x1 [0143.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0143.867] GetFileType (hFile=0x154) returned 0x1 [0143.867] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x178f9 [0143.867] ReadFile (in: hFile=0x154, lpBuffer=0x7485d00, nNumberOfBytesToRead=0x178f9, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x7485d00*, lpNumberOfBytesRead=0x2ae560*=0x178f9, lpOverlapped=0x0) returned 1 [0143.880] CloseHandle (hObject=0x154) returned 1 [0143.899] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv", lpFilePart=0x0) returned 0x39 [0143.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0143.900] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv" (normalized: "c:\\users\\eebsym5\\videos\\rrnbpsokw\\g9pgaul1dr zn_vdegy.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.902] GetFileType (hFile=0x154) returned 0x1 [0143.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0143.903] GetFileType (hFile=0x154) returned 0x1 [0143.903] WriteFile (in: hFile=0x154, lpBuffer=0x74fba38*, nNumberOfBytesToWrite=0x17900, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x74fba38*, lpNumberOfBytesWritten=0x2ae554*=0x17900, lpOverlapped=0x0) returned 1 [0143.905] CloseHandle (hObject=0x154) returned 1 [0143.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv", lpFilePart=0x0) returned 0x39 [0143.905] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv.anonymous", lpFilePart=0x0) returned 0x43 [0143.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0143.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv" (normalized: "c:\\users\\eebsym5\\videos\\rrnbpsokw\\g9pgaul1dr zn_vdegy.flv"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c484350, ftCreationTime.dwHighDateTime=0x1d4174a, ftLastAccessTime.dwLowDateTime=0x868825a0, ftLastAccessTime.dwHighDateTime=0x1d41d47, ftLastWriteTime.dwLowDateTime=0xf4b6eb30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17900)) returned 1 [0143.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.905] MoveFileW (lpExistingFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv" (normalized: "c:\\users\\eebsym5\\videos\\rrnbpsokw\\g9pgaul1dr zn_vdegy.flv"), lpNewFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\g9pgAuL1DR zn_VDeGy.flv.anonymous" (normalized: "c:\\users\\eebsym5\\videos\\rrnbpsokw\\g9pgaul1dr zn_vdegy.flv.anonymous")) returned 1 [0143.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.906] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF", lpFilePart=0x0) returned 0x27 [0143.906] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF\\", lpFilePart=0x0) returned 0x28 [0143.906] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0143.906] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.907] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.907] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.907] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.907] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.907] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.907] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0143.907] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF", lpFilePart=0x0) returned 0x27 [0143.907] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF\\", lpFilePart=0x0) returned 0x28 [0143.907] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\RrnbpSokw\\cDtOF\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee98 [0143.908] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.908] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.908] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.908] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.908] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0143.908] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0143.908] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0143.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0143.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.908] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM", lpFilePart=0x0) returned 0x2c [0143.908] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM\\", lpFilePart=0x0) returned 0x2d [0143.909] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0143.909] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.909] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.909] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.909] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.909] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.909] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.909] GetFullPathNameW (in: lpFileName="\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM", lpFilePart=0x0) returned 0x2c [0143.909] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM\\", lpFilePart=0x0) returned 0x2d [0143.909] FindFirstFileW (in: lpFileName="C:\\Users\\EEBsYm5\\Videos\\uR0OE5x8RV-XW8ku5ZbM\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0143.910] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.910] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.910] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.910] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0143.910] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0143.910] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0143.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0143.910] GetFullPathNameW (in: lpFileName="\\Users\\Public", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0143.910] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\", lpFilePart=0x0) returned 0x10 [0143.911] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee98 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.911] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.912] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.912] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.912] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.912] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.912] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0143.912] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0143.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0143.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0143.912] GetFullPathNameW (in: lpFileName="\\Users\\Public", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0143.912] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\", lpFilePart=0x0) returned 0x10 [0143.912] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee98 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.913] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.914] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0143.914] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0143.914] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0143.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0143.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.914] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0143.914] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\", lpFilePart=0x0) returned 0x18 [0143.914] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee98 [0143.914] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.914] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.914] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.915] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.915] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.915] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.915] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.915] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0143.915] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\", lpFilePart=0x0) returned 0x18 [0143.915] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee98 [0143.915] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.916] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.916] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.916] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.916] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.916] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.916] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0143.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.917] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Adobe Reader X.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk", lpFilePart=0x0) returned 0x2a [0143.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0143.917] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.917] GetFileType (hFile=0x154) returned 0x1 [0143.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0143.917] GetFileType (hFile=0x154) returned 0x1 [0143.917] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x7cb [0143.917] ReadFile (in: hFile=0x154, lpBuffer=0x1aa448c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1aa448c*, lpNumberOfBytesRead=0x2ae5d4*=0x7cb, lpOverlapped=0x0) returned 1 [0143.918] CloseHandle (hObject=0x154) returned 1 [0143.929] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Adobe Reader X.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk", lpFilePart=0x0) returned 0x2a [0143.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0143.930] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.931] GetFileType (hFile=0x154) returned 0x1 [0143.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0143.931] GetFileType (hFile=0x154) returned 0x1 [0143.931] WriteFile (in: hFile=0x154, lpBuffer=0x1af4a8c*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1af4a8c*, lpNumberOfBytesWritten=0x2ae59c*=0x7d0, lpOverlapped=0x0) returned 1 [0143.932] CloseHandle (hObject=0x154) returned 1 [0143.933] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Adobe Reader X.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk", lpFilePart=0x0) returned 0x2a [0143.933] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Adobe Reader X.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.anonymous", lpFilePart=0x0) returned 0x34 [0143.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0143.933] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f02380, ftCreationTime.dwHighDateTime=0x1d2da17, ftLastAccessTime.dwLowDateTime=0xe1f02380, ftLastAccessTime.dwHighDateTime=0x1d2da17, ftLastWriteTime.dwLowDateTime=0xf4bbadf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0143.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.933] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.anonymous" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.anonymous")) returned 1 [0143.934] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29 [0143.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0143.935] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.935] GetFileType (hFile=0x154) returned 0x1 [0143.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0143.935] GetFileType (hFile=0x154) returned 0x1 [0143.935] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x897 [0143.935] ReadFile (in: hFile=0x154, lpBuffer=0x1af65a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1af65a8*, lpNumberOfBytesRead=0x2ae5d4*=0x897, lpOverlapped=0x0) returned 1 [0143.936] CloseHandle (hObject=0x154) returned 1 [0143.947] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29 [0143.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0143.948] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.949] GetFileType (hFile=0x154) returned 0x1 [0143.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0143.949] GetFileType (hFile=0x154) returned 0x1 [0143.949] WriteFile (in: hFile=0x154, lpBuffer=0x1b46fb4*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1b46fb4*, lpNumberOfBytesWritten=0x2ae59c*=0x8a0, lpOverlapped=0x0) returned 1 [0143.950] CloseHandle (hObject=0x154) returned 1 [0143.950] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFilePart=0x0) returned 0x29 [0143.950] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.anonymous", lpFilePart=0x0) returned 0x33 [0143.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0143.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe218dc90, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0xe218dc90, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xf4be0f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8a0)) returned 1 [0143.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.951] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.anonymous" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.anonymous")) returned 1 [0143.952] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b [0143.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0143.952] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.952] GetFileType (hFile=0x154) returned 0x1 [0143.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0143.952] GetFileType (hFile=0x154) returned 0x1 [0143.952] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x457 [0143.952] ReadFile (in: hFile=0x154, lpBuffer=0x1b48674, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b48674*, lpNumberOfBytesRead=0x2ae5d4*=0x457, lpOverlapped=0x0) returned 1 [0143.953] CloseHandle (hObject=0x154) returned 1 [0143.988] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b [0143.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0143.988] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0143.990] GetFileType (hFile=0x154) returned 0x1 [0143.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0143.990] GetFileType (hFile=0x154) returned 0x1 [0143.990] WriteFile (in: hFile=0x154, lpBuffer=0x1990e98*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1990e98*, lpNumberOfBytesWritten=0x2ae59c*=0x460, lpOverlapped=0x0) returned 1 [0143.991] CloseHandle (hObject=0x154) returned 1 [0143.991] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x2b [0143.991] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.anonymous", lpFilePart=0x0) returned 0x35 [0143.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0143.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77057c10, ftCreationTime.dwHighDateTime=0x1d2da1b, ftLastAccessTime.dwLowDateTime=0x7707dd70, ftLastAccessTime.dwHighDateTime=0x1d2da1b, ftLastWriteTime.dwLowDateTime=0xf4c2d210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0143.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0143.991] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.anonymous" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.anonymous")) returned 1 [0143.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.992] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0143.992] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\", lpFilePart=0x0) returned 0x1a [0143.992] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0143.992] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.993] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.993] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.993] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.993] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.993] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.993] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0143.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.993] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0143.993] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\", lpFilePart=0x0) returned 0x1a [0143.993] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0143.994] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.994] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.994] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.994] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.994] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.994] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.994] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0143.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.994] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0143.994] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music\\", lpFilePart=0x0) returned 0x23 [0143.995] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0143.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0143.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.996] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0143.996] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x26 [0143.996] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0143.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0143.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0143.997] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0143.997] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x24 [0143.997] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xffffffff [0143.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5ac) returned 1 [0143.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.998] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0143.998] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\", lpFilePart=0x0) returned 0x1a [0143.998] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0143.999] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.999] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0143.999] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0143.999] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0143.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0143.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0143.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0143.999] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0143.999] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\", lpFilePart=0x0) returned 0x1a [0143.999] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0143.999] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.000] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.000] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.000] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0144.000] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites", lpFilePart=0x0) returned 0x19 [0144.000] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\", lpFilePart=0x0) returned 0x1a [0144.000] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0144.000] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.000] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.000] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0144.001] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Favorites", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites", lpFilePart=0x0) returned 0x19 [0144.001] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\", lpFilePart=0x0) returned 0x1a [0144.001] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0144.001] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.001] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.001] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0144.001] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19 [0144.001] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\", lpFilePart=0x0) returned 0x1a [0144.001] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0144.002] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.002] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.002] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.002] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.002] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0144.002] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19 [0144.002] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\", lpFilePart=0x0) returned 0x1a [0144.002] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0144.002] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.003] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.003] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.003] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.003] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0144.003] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0144.003] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\", lpFilePart=0x0) returned 0x16 [0144.003] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0144.003] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.003] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.003] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.004] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.004] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0144.004] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0144.004] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\", lpFilePart=0x0) returned 0x16 [0144.004] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0144.004] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.004] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.004] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0144.004] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0144.005] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0144.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0144.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0144.005] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0144.005] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\", lpFilePart=0x0) returned 0x23 [0144.005] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0144.176] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.176] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.176] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.176] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.176] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.177] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0144.177] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0144.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0144.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0144.178] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0144.178] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\", lpFilePart=0x0) returned 0x23 [0144.178] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0144.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0144.179] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0144.180] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0144.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0144.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0144.181] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", lpFilePart=0x0) returned 0x2e [0144.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0144.181] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0144.182] GetFileType (hFile=0x154) returned 0x1 [0144.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0144.182] GetFileType (hFile=0x154) returned 0x1 [0144.182] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8064f1 [0144.207] ReadFile (in: hFile=0x154, lpBuffer=0xc0d1018, nNumberOfBytesToRead=0x8064f1, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0xc0d1018*, lpNumberOfBytesRead=0x2ae560*=0x8064f1, lpOverlapped=0x0) returned 1 [0144.593] CloseHandle (hObject=0x154) returned 1 [0145.280] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", lpFilePart=0x0) returned 0x2e [0145.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0145.280] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0145.281] GetFileType (hFile=0x154) returned 0x1 [0145.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0145.282] GetFileType (hFile=0x154) returned 0x1 [0145.282] WriteFile (in: hFile=0x154, lpBuffer=0x236bda18*, nNumberOfBytesToWrite=0x806500, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x236bda18*, lpNumberOfBytesWritten=0x2ae554*=0x806500, lpOverlapped=0x0) returned 1 [0145.474] CloseHandle (hObject=0x154) returned 1 [0145.474] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", lpFilePart=0x0) returned 0x2e [0145.474] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.anonymous", lpFilePart=0x0) returned 0x38 [0145.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0145.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d54062, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf5a4f4b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x806500)) returned 1 [0145.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0145.475] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.anonymous" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.anonymous")) returned 1 [0145.475] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", lpFilePart=0x0) returned 0x40 [0145.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0145.476] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0145.476] GetFileType (hFile=0x154) returned 0x1 [0145.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0145.476] GetFileType (hFile=0x154) returned 0x1 [0145.476] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x3ec5d2 [0145.488] ReadFile (in: hFile=0x154, lpBuffer=0x7513358, nNumberOfBytesToRead=0x3ec5d2, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x7513358*, lpNumberOfBytesRead=0x2ae560*=0x3ec5d2, lpOverlapped=0x0) returned 1 [0145.733] CloseHandle (hObject=0x154) returned 1 [0146.004] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", lpFilePart=0x0) returned 0x40 [0146.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0146.004] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0146.015] GetFileType (hFile=0x154) returned 0x1 [0146.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0146.015] GetFileType (hFile=0x154) returned 0x1 [0146.015] WriteFile (in: hFile=0x154, lpBuffer=0x21eb7528*, nNumberOfBytesToWrite=0x3ec5e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x21eb7528*, lpNumberOfBytesWritten=0x2ae554*=0x3ec5e0, lpOverlapped=0x0) returned 1 [0146.105] CloseHandle (hObject=0x154) returned 1 [0146.106] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", lpFilePart=0x0) returned 0x40 [0146.106] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.anonymous", lpFilePart=0x0) returned 0x4a [0146.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0146.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d2df02, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6068d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5e0)) returned 1 [0146.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0146.106] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.anonymous" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.anonymous")) returned 1 [0146.107] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", lpFilePart=0x0) returned 0x31 [0146.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0146.107] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0146.107] GetFileType (hFile=0x154) returned 0x1 [0146.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0146.107] GetFileType (hFile=0x154) returned 0x1 [0146.107] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x49e459 [0146.121] ReadFile (in: hFile=0x154, lpBuffer=0x23ec3f38, nNumberOfBytesToRead=0x49e459, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x23ec3f38*, lpNumberOfBytesRead=0x2ae560*=0x49e459, lpOverlapped=0x0) returned 1 [0146.392] CloseHandle (hObject=0x154) returned 1 [0146.714] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", lpFilePart=0x0) returned 0x31 [0146.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0146.714] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0146.722] GetFileType (hFile=0x154) returned 0x1 [0146.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0146.722] GetFileType (hFile=0x154) returned 0x1 [0146.722] WriteFile (in: hFile=0x154, lpBuffer=0x24fed8f8*, nNumberOfBytesToWrite=0x49e460, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x24fed8f8*, lpNumberOfBytesWritten=0x2ae554*=0x49e460, lpOverlapped=0x0) returned 1 [0146.833] CloseHandle (hObject=0x154) returned 1 [0146.833] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", lpFilePart=0x0) returned 0x31 [0146.833] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.anonymous", lpFilePart=0x0) returned 0x3b [0146.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0146.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d07da2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6740c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x49e460)) returned 1 [0146.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0146.833] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.anonymous" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.anonymous")) returned 1 [0146.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0146.834] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0146.834] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\", lpFilePart=0x0) returned 0x19 [0146.834] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee98 [0146.834] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0146.834] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0146.834] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0146.835] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0146.835] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0146.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0146.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0146.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0146.835] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0146.835] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\", lpFilePart=0x0) returned 0x19 [0146.835] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee98 [0146.835] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0146.835] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0146.835] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0146.835] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0146.835] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0146.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0146.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0146.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0146.836] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0146.836] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\", lpFilePart=0x0) returned 0x29 [0146.836] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0146.851] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.851] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.851] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.851] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.851] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.852] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.852] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.852] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.852] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.852] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.852] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0146.852] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0146.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0146.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0146.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0146.853] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0146.853] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\", lpFilePart=0x0) returned 0x29 [0146.853] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0146.854] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.855] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.856] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0146.856] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0146.856] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0146.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0146.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0146.857] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a [0146.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0146.857] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0146.858] GetFileType (hFile=0x154) returned 0x1 [0146.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0146.858] GetFileType (hFile=0x154) returned 0x1 [0146.858] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd6b22 [0146.861] ReadFile (in: hFile=0x154, lpBuffer=0x78ff948, nNumberOfBytesToRead=0xd6b22, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x78ff948*, lpNumberOfBytesRead=0x2ae560*=0xd6b22, lpOverlapped=0x0) returned 1 [0146.914] CloseHandle (hObject=0x154) returned 1 [0147.090] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a [0147.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.090] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.102] GetFileType (hFile=0x154) returned 0x1 [0147.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.102] GetFileType (hFile=0x154) returned 0x1 [0147.102] WriteFile (in: hFile=0x154, lpBuffer=0x243623b0*, nNumberOfBytesToWrite=0xd6b30, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x243623b0*, lpNumberOfBytesWritten=0x2ae554*=0xd6b30, lpOverlapped=0x0) returned 1 [0147.118] CloseHandle (hObject=0x154) returned 1 [0147.119] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a [0147.119] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.anonymous", lpFilePart=0x0) returned 0x44 [0147.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d07da2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6a14670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd6b30)) returned 1 [0147.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.119] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.anonymous")) returned 1 [0147.120] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33 [0147.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.120] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.120] GetFileType (hFile=0x154) returned 0x1 [0147.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.120] GetFileType (hFile=0x154) returned 0x1 [0147.120] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xce875 [0147.123] ReadFile (in: hFile=0x154, lpBuffer=0x24438f00, nNumberOfBytesToRead=0xce875, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x24438f00*, lpNumberOfBytesRead=0x2ae560*=0xce875, lpOverlapped=0x0) returned 1 [0147.179] CloseHandle (hObject=0x154) returned 1 [0147.249] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33 [0147.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.250] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.300] GetFileType (hFile=0x154) returned 0x1 [0147.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.300] GetFileType (hFile=0x154) returned 0x1 [0147.300] WriteFile (in: hFile=0x154, lpBuffer=0x25fed8d8*, nNumberOfBytesToWrite=0xce880, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x25fed8d8*, lpNumberOfBytesWritten=0x2ae554*=0xce880, lpOverlapped=0x0) returned 1 [0147.316] CloseHandle (hObject=0x154) returned 1 [0147.317] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33 [0147.317] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.anonymous", lpFilePart=0x0) returned 0x3d [0147.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f3de2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1ce1c42, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6bdd6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xce880)) returned 1 [0147.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.317] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.anonymous")) returned 1 [0147.318] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37 [0147.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.318] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.321] GetFileType (hFile=0x154) returned 0x1 [0147.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.321] GetFileType (hFile=0x154) returned 0x1 [0147.321] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x91554 [0147.323] ReadFile (in: hFile=0x154, lpBuffer=0x225fe808, nNumberOfBytesToRead=0x91554, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x225fe808*, lpNumberOfBytesRead=0x2ae560*=0x91554, lpOverlapped=0x0) returned 1 [0147.354] CloseHandle (hObject=0x154) returned 1 [0147.425] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37 [0147.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.425] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.432] GetFileType (hFile=0x154) returned 0x1 [0147.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.432] GetFileType (hFile=0x154) returned 0x1 [0147.432] WriteFile (in: hFile=0x154, lpBuffer=0x26301718*, nNumberOfBytesToWrite=0x91560, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x26301718*, lpNumberOfBytesWritten=0x2ae554*=0x91560, lpOverlapped=0x0) returned 1 [0147.444] CloseHandle (hObject=0x154) returned 1 [0147.444] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37 [0147.444] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.anonymous", lpFilePart=0x0) returned 0x41 [0147.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f3de2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1ce1c42, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6d34350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x91560)) returned 1 [0147.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.444] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.anonymous")) returned 1 [0147.445] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36 [0147.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.445] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.445] GetFileType (hFile=0x154) returned 0x1 [0147.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.445] GetFileType (hFile=0x154) returned 0x1 [0147.445] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xbd616 [0147.448] ReadFile (in: hFile=0x154, lpBuffer=0x26392c98, nNumberOfBytesToRead=0xbd616, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x26392c98*, lpNumberOfBytesRead=0x2ae560*=0xbd616, lpOverlapped=0x0) returned 1 [0147.476] CloseHandle (hObject=0x154) returned 1 [0147.565] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36 [0147.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.565] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.575] GetFileType (hFile=0x154) returned 0x1 [0147.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.575] GetFileType (hFile=0x154) returned 0x1 [0147.575] WriteFile (in: hFile=0x154, lpBuffer=0x265caf30*, nNumberOfBytesToWrite=0xbd620, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x265caf30*, lpNumberOfBytesWritten=0x2ae554*=0xbd620, lpOverlapped=0x0) returned 1 [0147.590] CloseHandle (hObject=0x154) returned 1 [0147.590] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36 [0147.590] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.anonymous", lpFilePart=0x0) returned 0x40 [0147.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f3de2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1ce1c42, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6e8afb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbd620)) returned 1 [0147.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.590] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.anonymous")) returned 1 [0147.591] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32 [0147.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.591] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.592] GetFileType (hFile=0x154) returned 0x1 [0147.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.592] GetFileType (hFile=0x154) returned 0x1 [0147.592] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xbea1f [0147.594] ReadFile (in: hFile=0x154, lpBuffer=0x2682bc58, nNumberOfBytesToRead=0xbea1f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2682bc58*, lpNumberOfBytesRead=0x2ae560*=0xbea1f, lpOverlapped=0x0) returned 1 [0147.625] CloseHandle (hObject=0x154) returned 1 [0147.689] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32 [0147.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.689] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.698] GetFileType (hFile=0x154) returned 0x1 [0147.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.698] GetFileType (hFile=0x154) returned 0x1 [0147.698] WriteFile (in: hFile=0x154, lpBuffer=0x26be4f38*, nNumberOfBytesToWrite=0xbea20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x26be4f38*, lpNumberOfBytesWritten=0x2ae554*=0xbea20, lpOverlapped=0x0) returned 1 [0147.713] CloseHandle (hObject=0x154) returned 1 [0147.713] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32 [0147.713] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.anonymous", lpFilePart=0x0) returned 0x3c [0147.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f3de2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1ce1c42, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf6fbbab0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbea20)) returned 1 [0147.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.713] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.anonymous")) returned 1 [0147.714] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37 [0147.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.714] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.714] GetFileType (hFile=0x154) returned 0x1 [0147.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.714] GetFileType (hFile=0x154) returned 0x1 [0147.714] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8907c [0147.716] ReadFile (in: hFile=0x154, lpBuffer=0x26ca3978, nNumberOfBytesToRead=0x8907c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x26ca3978*, lpNumberOfBytesRead=0x2ae560*=0x8907c, lpOverlapped=0x0) returned 1 [0147.752] CloseHandle (hObject=0x154) returned 1 [0147.799] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37 [0147.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.799] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.806] GetFileType (hFile=0x154) returned 0x1 [0147.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.806] GetFileType (hFile=0x154) returned 0x1 [0147.806] WriteFile (in: hFile=0x154, lpBuffer=0x26f50c30*, nNumberOfBytesToWrite=0x89080, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x26f50c30*, lpNumberOfBytesWritten=0x2ae554*=0x89080, lpOverlapped=0x0) returned 1 [0147.819] CloseHandle (hObject=0x154) returned 1 [0147.819] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37 [0147.819] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.anonymous", lpFilePart=0x0) returned 0x41 [0147.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d07da2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf70c6450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x89080)) returned 1 [0147.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.819] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.anonymous")) returned 1 [0147.820] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35 [0147.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.820] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.821] GetFileType (hFile=0x154) returned 0x1 [0147.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.821] GetFileType (hFile=0x154) returned 0x1 [0147.821] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xbde6b [0147.824] ReadFile (in: hFile=0x154, lpBuffer=0x26fd9cd0, nNumberOfBytesToRead=0xbde6b, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x26fd9cd0*, lpNumberOfBytesRead=0x2ae560*=0xbde6b, lpOverlapped=0x0) returned 1 [0147.861] CloseHandle (hObject=0x154) returned 1 [0147.943] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35 [0147.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0147.943] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.951] GetFileType (hFile=0x154) returned 0x1 [0147.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0147.951] GetFileType (hFile=0x154) returned 0x1 [0147.951] WriteFile (in: hFile=0x154, lpBuffer=0x2738f538*, nNumberOfBytesToWrite=0xbde70, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2738f538*, lpNumberOfBytesWritten=0x2ae554*=0xbde70, lpOverlapped=0x0) returned 1 [0147.966] CloseHandle (hObject=0x154) returned 1 [0147.967] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35 [0147.967] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.anonymous", lpFilePart=0x0) returned 0x3f [0147.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0147.967] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f3de2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1ce1c42, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf721d0b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbde70)) returned 1 [0147.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0147.967] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.anonymous")) returned 1 [0147.968] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33 [0147.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0147.968] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0147.968] GetFileType (hFile=0x154) returned 0x1 [0147.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0147.968] GetFileType (hFile=0x154) returned 0x1 [0147.968] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x97958 [0147.970] ReadFile (in: hFile=0x154, lpBuffer=0x2744d3c8, nNumberOfBytesToRead=0x97958, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2744d3c8*, lpNumberOfBytesRead=0x2ae560*=0x97958, lpOverlapped=0x0) returned 1 [0148.027] CloseHandle (hObject=0x154) returned 1 [0148.079] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33 [0148.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0148.079] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0148.087] GetFileType (hFile=0x154) returned 0x1 [0148.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0148.087] GetFileType (hFile=0x154) returned 0x1 [0148.087] WriteFile (in: hFile=0x154, lpBuffer=0x27614020*, nNumberOfBytesToWrite=0x97960, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x27614020*, lpNumberOfBytesWritten=0x2ae554*=0x97960, lpOverlapped=0x0) returned 1 [0148.107] CloseHandle (hObject=0x154) returned 1 [0148.107] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33 [0148.107] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.anonymous", lpFilePart=0x0) returned 0x3d [0148.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0148.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5119f42, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xe1d07da2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf7373d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x97960)) returned 1 [0148.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.107] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.anonymous" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.anonymous")) returned 1 [0148.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.108] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Recorded TV", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV", lpFilePart=0x0) returned 0x1b [0148.108] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\", lpFilePart=0x0) returned 0x1c [0148.108] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0148.108] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.109] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.109] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.109] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.109] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.109] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Recorded TV", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV", lpFilePart=0x0) returned 0x1b [0148.109] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\", lpFilePart=0x0) returned 0x1c [0148.109] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0148.109] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.109] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.110] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.110] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.110] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.110] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Recorded TV\\Sample Media", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media", lpFilePart=0x0) returned 0x28 [0148.110] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\", lpFilePart=0x0) returned 0x29 [0148.110] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0148.110] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.110] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.110] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.111] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.111] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.111] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Recorded TV\\Sample Media", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media", lpFilePart=0x0) returned 0x28 [0148.111] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\", lpFilePart=0x0) returned 0x29 [0148.111] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0148.111] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.111] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.112] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.112] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.112] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.112] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0148.112] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\", lpFilePart=0x0) returned 0x17 [0148.112] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0148.112] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.112] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.112] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.113] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.113] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.113] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0148.113] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\", lpFilePart=0x0) returned 0x17 [0148.113] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0148.113] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.113] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.114] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.114] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.114] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.114] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0148.114] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\", lpFilePart=0x0) returned 0x25 [0148.114] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0148.114] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.114] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.114] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.115] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.115] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.115] GetFullPathNameW (in: lpFileName="\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0148.115] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\", lpFilePart=0x0) returned 0x25 [0148.115] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0148.115] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.115] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.115] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.115] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.116] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0148.116] GetFullPathNameW (in: lpFileName="\\Windows", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0148.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\", lpFilePart=0x0) returned 0xb [0148.116] FindFirstFileW (in: lpFileName="C:\\Windows\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbf198 [0148.116] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.116] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.116] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.116] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.117] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.118] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.119] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.120] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.121] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.122] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.123] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.124] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.125] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0148.126] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0148.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0148.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae744) returned 1 [0148.126] GetFullPathNameW (in: lpFileName="\\Windows", nBufferLength=0x105, lpBuffer=0x2ae24c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0148.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\", nBufferLength=0x105, lpBuffer=0x2ae220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\", lpFilePart=0x0) returned 0xb [0148.126] FindFirstFileW (in: lpFileName="C:\\Windows\\*", lpFindFileData=0x2ae46c | out: lpFindFileData=0x2ae46c) returned 0xbf198 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.126] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.127] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.128] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.129] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 1 [0148.130] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae47c | out: lpFindFileData=0x2ae47c) returned 0 [0148.130] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0148.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae704) returned 1 [0148.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae710) returned 1 [0148.130] GetFullPathNameW (in: lpFileName="\\Windows\\Professional.xml", nBufferLength=0x105, lpBuffer=0x2ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Professional.xml", lpFilePart=0x0) returned 0x1b [0148.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae608) returned 1 [0148.130] CreateFileW (lpFileName="C:\\Windows\\Professional.xml" (normalized: "c:\\windows\\professional.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0148.131] GetFileType (hFile=0x154) returned 0x1 [0148.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae604) returned 1 [0148.131] GetFileType (hFile=0x154) returned 0x1 [0148.131] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae710 | out: lpFileSizeHigh=0x2ae710*=0x0) returned 0xd12f [0148.131] ReadFile (in: hFile=0x154, lpBuffer=0x1addb3c, nNumberOfBytesToRead=0xd12f, lpNumberOfBytesRead=0x2ae6bc, lpOverlapped=0x0 | out: lpBuffer=0x1addb3c*, lpNumberOfBytesRead=0x2ae6bc*=0xd12f, lpOverlapped=0x0) returned 1 [0148.202] CloseHandle (hObject=0x154) returned 1 [0148.239] GetFullPathNameW (in: lpFileName="\\Windows\\Professional.xml", nBufferLength=0x105, lpBuffer=0x2ae100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Professional.xml", lpFilePart=0x0) returned 0x1b [0148.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5f4) returned 1 [0148.240] CreateFileW (lpFileName="C:\\Windows\\Professional.xml" (normalized: "c:\\windows\\professional.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0148.241] GetFileType (hFile=0x154) returned 0x1 [0148.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5f0) returned 1 [0148.242] GetFileType (hFile=0x154) returned 0x1 [0148.242] WriteFile (in: hFile=0x154, lpBuffer=0x1b51ccc*, nNumberOfBytesToWrite=0xd130, lpNumberOfBytesWritten=0x2ae6b0, lpOverlapped=0x0 | out: lpBuffer=0x1b51ccc*, lpNumberOfBytesWritten=0x2ae6b0*=0xd130, lpOverlapped=0x0) returned 1 [0148.244] CloseHandle (hObject=0x154) returned 1 [0148.244] GetFullPathNameW (in: lpFileName="\\Windows\\Professional.xml", nBufferLength=0x105, lpBuffer=0x2ae234, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Professional.xml", lpFilePart=0x0) returned 0x1b [0148.244] GetFullPathNameW (in: lpFileName="\\Windows\\Professional.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae234, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Professional.xml.anonymous", lpFilePart=0x0) returned 0x25 [0148.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae694) returned 1 [0148.244] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Professional.xml" (normalized: "c:\\windows\\professional.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae710 | out: lpFileInformation=0x2ae710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97a0f1a, ftCreationTime.dwHighDateTime=0x1ca0457, ftLastAccessTime.dwLowDateTime=0xf97c7172, ftLastAccessTime.dwHighDateTime=0x1ca0457, ftLastWriteTime.dwLowDateTime=0xf74ca970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd130)) returned 1 [0148.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.244] MoveFileW (lpExistingFileName="C:\\Windows\\Professional.xml" (normalized: "c:\\windows\\professional.xml"), lpNewFileName="C:\\Windows\\Professional.xml.anonymous" (normalized: "c:\\windows\\professional.xml.anonymous")) returned 1 [0148.245] GetFullPathNameW (in: lpFileName="\\Windows\\Starter.xml", nBufferLength=0x105, lpBuffer=0x2ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Starter.xml", lpFilePart=0x0) returned 0x16 [0148.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae608) returned 1 [0148.245] CreateFileW (lpFileName="C:\\Windows\\Starter.xml" (normalized: "c:\\windows\\starter.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0148.246] GetFileType (hFile=0x154) returned 0x1 [0148.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae604) returned 1 [0148.246] GetFileType (hFile=0x154) returned 0x1 [0148.246] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae710 | out: lpFileSizeHigh=0x2ae710*=0x0) returned 0xbc49 [0148.246] ReadFile (in: hFile=0x154, lpBuffer=0x1b5f0e4, nNumberOfBytesToRead=0xbc49, lpNumberOfBytesRead=0x2ae6bc, lpOverlapped=0x0 | out: lpBuffer=0x1b5f0e4*, lpNumberOfBytesRead=0x2ae6bc*=0xbc49, lpOverlapped=0x0) returned 1 [0148.278] CloseHandle (hObject=0x154) returned 1 [0148.320] GetFullPathNameW (in: lpFileName="\\Windows\\Starter.xml", nBufferLength=0x105, lpBuffer=0x2ae100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Starter.xml", lpFilePart=0x0) returned 0x16 [0148.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5f4) returned 1 [0148.320] CreateFileW (lpFileName="C:\\Windows\\Starter.xml" (normalized: "c:\\windows\\starter.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0148.322] GetFileType (hFile=0x154) returned 0x1 [0148.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5f0) returned 1 [0148.322] GetFileType (hFile=0x154) returned 0x1 [0148.322] WriteFile (in: hFile=0x154, lpBuffer=0x19d588c*, nNumberOfBytesToWrite=0xbc50, lpNumberOfBytesWritten=0x2ae6b0, lpOverlapped=0x0 | out: lpBuffer=0x19d588c*, lpNumberOfBytesWritten=0x2ae6b0*=0xbc50, lpOverlapped=0x0) returned 1 [0148.323] CloseHandle (hObject=0x154) returned 1 [0148.324] GetFullPathNameW (in: lpFileName="\\Windows\\Starter.xml", nBufferLength=0x105, lpBuffer=0x2ae234, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Starter.xml", lpFilePart=0x0) returned 0x16 [0148.324] GetFullPathNameW (in: lpFileName="\\Windows\\Starter.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae234, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Starter.xml.anonymous", lpFilePart=0x0) returned 0x20 [0148.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae694) returned 1 [0148.324] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Starter.xml" (normalized: "c:\\windows\\starter.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae710 | out: lpFileInformation=0x2ae710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494b31f3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x494b31f3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf7589050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbc50)) returned 1 [0148.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.324] MoveFileW (lpExistingFileName="C:\\Windows\\Starter.xml" (normalized: "c:\\windows\\starter.xml"), lpNewFileName="C:\\Windows\\Starter.xml.anonymous" (normalized: "c:\\windows\\starter.xml.anonymous")) returned 1 [0148.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.324] GetFullPathNameW (in: lpFileName="\\Windows\\addins", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\addins", lpFilePart=0x0) returned 0x11 [0148.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\addins\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\addins\\", lpFilePart=0x0) returned 0x12 [0148.325] FindFirstFileW (in: lpFileName="C:\\Windows\\addins\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.325] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.325] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.325] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.325] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.325] GetFullPathNameW (in: lpFileName="\\Windows\\addins", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\addins", lpFilePart=0x0) returned 0x11 [0148.325] GetFullPathNameW (in: lpFileName="C:\\Windows\\addins\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\addins\\", lpFilePart=0x0) returned 0x12 [0148.325] FindFirstFileW (in: lpFileName="C:\\Windows\\addins\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.326] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.326] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.326] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.326] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.326] GetFullPathNameW (in: lpFileName="\\Windows\\AppCompat", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat", lpFilePart=0x0) returned 0x14 [0148.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppCompat\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat\\", lpFilePart=0x0) returned 0x15 [0148.326] FindFirstFileW (in: lpFileName="C:\\Windows\\AppCompat\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.326] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.327] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.327] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.327] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.327] GetFullPathNameW (in: lpFileName="\\Windows\\AppCompat", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat", lpFilePart=0x0) returned 0x14 [0148.327] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppCompat\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat\\", lpFilePart=0x0) returned 0x15 [0148.327] FindFirstFileW (in: lpFileName="C:\\Windows\\AppCompat\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.327] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.327] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.327] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.327] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.328] GetFullPathNameW (in: lpFileName="\\Windows\\AppCompat\\Programs", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat\\Programs", lpFilePart=0x0) returned 0x1d [0148.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppCompat\\Programs\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat\\Programs\\", lpFilePart=0x0) returned 0x1e [0148.328] FindFirstFileW (in: lpFileName="C:\\Windows\\AppCompat\\Programs\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.328] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.328] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.328] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.328] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.328] GetFullPathNameW (in: lpFileName="\\Windows\\AppCompat\\Programs", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat\\Programs", lpFilePart=0x0) returned 0x1d [0148.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppCompat\\Programs\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppCompat\\Programs\\", lpFilePart=0x0) returned 0x1e [0148.328] FindFirstFileW (in: lpFileName="C:\\Windows\\AppCompat\\Programs\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.329] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.329] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.329] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.329] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.329] GetFullPathNameW (in: lpFileName="\\Windows\\AppPatch", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch", lpFilePart=0x0) returned 0x13 [0148.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppPatch\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\", lpFilePart=0x0) returned 0x14 [0148.329] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.330] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.331] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.331] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.331] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.331] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.331] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.331] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.331] GetFullPathNameW (in: lpFileName="\\Windows\\AppPatch", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch", lpFilePart=0x0) returned 0x13 [0148.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppPatch\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\", lpFilePart=0x0) returned 0x14 [0148.331] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.332] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.333] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.333] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.333] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.333] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.333] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.333] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.333] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.333] GetFullPathNameW (in: lpFileName="\\Windows\\AppPatch\\Custom", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\Custom", lpFilePart=0x0) returned 0x1a [0148.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\Custom\\", lpFilePart=0x0) returned 0x1b [0148.334] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.334] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.334] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.334] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.334] GetFullPathNameW (in: lpFileName="\\Windows\\AppPatch\\Custom", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\Custom", lpFilePart=0x0) returned 0x1a [0148.334] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\Custom\\", lpFilePart=0x0) returned 0x1b [0148.334] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.335] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.335] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.335] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.335] GetFullPathNameW (in: lpFileName="\\Windows\\AppPatch\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\en-US", lpFilePart=0x0) returned 0x19 [0148.335] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\en-US\\", lpFilePart=0x0) returned 0x1a [0148.335] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.336] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.336] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.336] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.336] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.336] GetFullPathNameW (in: lpFileName="\\Windows\\AppPatch\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\en-US", lpFilePart=0x0) returned 0x19 [0148.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\AppPatch\\en-US\\", lpFilePart=0x0) returned 0x1a [0148.336] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.336] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.336] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.337] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.337] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.337] GetFullPathNameW (in: lpFileName="\\Windows\\assembly", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly", lpFilePart=0x0) returned 0x13 [0148.337] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\", lpFilePart=0x0) returned 0x14 [0148.337] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.337] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.337] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.337] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.337] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.338] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.338] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0148.339] GetFullPathNameW (in: lpFileName="\\Windows\\assembly", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly", lpFilePart=0x0) returned 0x13 [0148.339] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\", lpFilePart=0x0) returned 0x14 [0148.339] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbed18 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.339] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.340] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.340] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.340] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.340] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0148.340] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0148.340] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0148.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0148.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.340] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC", lpFilePart=0x0) returned 0x17 [0148.340] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\", lpFilePart=0x0) returned 0x18 [0148.340] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.341] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.342] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.342] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.343] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC", lpFilePart=0x0) returned 0x17 [0148.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\", lpFilePart=0x0) returned 0x18 [0148.343] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.344] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.344] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.344] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.344] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.344] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.345] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.345] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.345] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.345] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.345] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0148.345] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.347] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\ADODB", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB", lpFilePart=0x0) returned 0x1d [0148.347] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB\\", lpFilePart=0x0) returned 0x1e [0148.347] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.348] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.349] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.349] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.349] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.349] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\ADODB", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB", lpFilePart=0x0) returned 0x1d [0148.349] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB\\", lpFilePart=0x0) returned 0x1e [0148.349] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.349] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.349] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.349] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.350] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.350] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x3a [0148.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x3b [0148.350] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.351] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.351] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x3a [0148.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x3b [0148.351] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.351] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.351] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.352] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Extensibility", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility", lpFilePart=0x0) returned 0x25 [0148.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility\\", lpFilePart=0x0) returned 0x26 [0148.352] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.352] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.352] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.352] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.352] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.353] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Extensibility", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility", lpFilePart=0x0) returned 0x25 [0148.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility\\", lpFilePart=0x0) returned 0x26 [0148.353] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.353] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.353] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.353] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.353] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.353] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x42 [0148.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x43 [0148.353] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.354] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.354] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x42 [0148.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x43 [0148.354] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.354] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.354] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.355] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.Ink", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink", lpFilePart=0x0) returned 0x25 [0148.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\", lpFilePart=0x0) returned 0x26 [0148.355] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.355] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.355] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.Ink", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink", lpFilePart=0x0) returned 0x25 [0148.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\", lpFilePart=0x0) returned 0x26 [0148.355] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.355] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.356] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.356] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.356] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x42 [0148.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x43 [0148.356] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.356] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.356] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.356] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.356] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.356] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.356] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x42 [0148.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x43 [0148.356] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.356] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.357] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.357] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35", lpFilePart=0x0) returned 0x45 [0148.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x46 [0148.357] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.357] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.357] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.357] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35", lpFilePart=0x0) returned 0x45 [0148.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x46 [0148.357] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.358] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.358] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.mshtml", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml", lpFilePart=0x0) returned 0x28 [0148.358] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\", lpFilePart=0x0) returned 0x29 [0148.358] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.358] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.358] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.359] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.mshtml", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml", lpFilePart=0x0) returned 0x28 [0148.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\", lpFilePart=0x0) returned 0x29 [0148.359] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.359] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.359] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x45 [0148.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x46 [0148.359] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.359] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.359] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.360] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x45 [0148.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x46 [0148.360] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.360] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.360] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.360] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.360] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.360] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.360] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.StdFormat", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat", lpFilePart=0x0) returned 0x2b [0148.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\", lpFilePart=0x0) returned 0x2c [0148.360] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.361] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.361] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.361] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.361] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.361] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.StdFormat", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat", lpFilePart=0x0) returned 0x2b [0148.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\", lpFilePart=0x0) returned 0x2c [0148.361] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.361] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.361] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.361] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.362] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.362] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x48 [0148.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x49 [0148.362] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.362] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.362] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.362] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.362] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.362] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.363] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x48 [0148.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x49 [0148.363] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.363] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.363] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.363] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.363] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.363] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.363] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\mscomctl", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl", lpFilePart=0x0) returned 0x20 [0148.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl\\", lpFilePart=0x0) returned 0x21 [0148.363] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.364] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.365] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.365] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.365] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.365] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\mscomctl", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl", lpFilePart=0x0) returned 0x20 [0148.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl\\", lpFilePart=0x0) returned 0x21 [0148.365] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.365] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.365] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.365] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.365] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.366] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3e [0148.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3f [0148.366] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.366] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.366] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.366] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.366] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.366] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.366] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3e [0148.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3f [0148.366] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\mscomctl\\10.0.4504.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.367] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.367] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.367] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.367] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.367] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.367] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\MSDATASRC", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC", lpFilePart=0x0) returned 0x21 [0148.367] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC\\", lpFilePart=0x0) returned 0x22 [0148.367] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.368] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.368] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.368] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.368] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.368] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\MSDATASRC", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC", lpFilePart=0x0) returned 0x21 [0148.368] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC\\", lpFilePart=0x0) returned 0x22 [0148.368] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.368] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.368] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.368] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.368] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.368] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x3e [0148.369] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x3f [0148.369] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.369] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.369] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.369] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.369] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.369] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.370] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x3e [0148.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x3f [0148.370] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.370] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.370] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.370] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.370] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.370] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.370] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\stdole", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole", lpFilePart=0x0) returned 0x1e [0148.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole\\", lpFilePart=0x0) returned 0x1f [0148.370] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.370] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.370] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.371] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.371] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.371] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\stdole", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole", lpFilePart=0x0) returned 0x1e [0148.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole\\", lpFilePart=0x0) returned 0x1f [0148.371] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.371] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.371] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0148.371] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 0 [0148.371] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.371] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x3b [0148.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x3c [0148.371] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.371] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.371] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.372] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.372] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.372] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.372] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x3b [0148.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x3c [0148.372] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.372] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.372] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.372] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0148.372] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0148.372] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.372] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32", lpFilePart=0x0) returned 0x1a [0148.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\", lpFilePart=0x0) returned 0x1b [0148.372] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.373] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.374] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.375] FindNextFileW (in: hFindFile=0xbed18, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0148.375] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0148.376] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32", lpFilePart=0x0) returned 0x1a [0148.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\", lpFilePart=0x0) returned 0x1b [0148.376] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.377] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0148.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0148.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.379] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop", lpFilePart=0x0) returned 0x3c [0148.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\", lpFilePart=0x0) returned 0x3d [0148.379] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.380] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.380] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop", lpFilePart=0x0) returned 0x3c [0148.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\", lpFilePart=0x0) returned 0x3d [0148.380] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.380] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.381] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x56 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x57 [0148.381] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.381] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.381] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x56 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x57 [0148.381] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.381] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.381] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\BDATunePIA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA", lpFilePart=0x0) returned 0x25 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\", lpFilePart=0x0) returned 0x26 [0148.381] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.382] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.382] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\BDATunePIA", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA", lpFilePart=0x0) returned 0x25 [0148.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\", lpFilePart=0x0) returned 0x26 [0148.382] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.382] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.382] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3f [0148.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x40 [0148.382] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.383] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.383] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3f [0148.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x40 [0148.383] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.383] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.383] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\CustomMarshalers", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers", lpFilePart=0x0) returned 0x2b [0148.383] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\", lpFilePart=0x0) returned 0x2c [0148.383] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.383] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.384] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\CustomMarshalers", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers", lpFilePart=0x0) returned 0x2b [0148.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\", lpFilePart=0x0) returned 0x2c [0148.384] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.384] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.384] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x45 [0148.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x46 [0148.384] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.384] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.384] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x45 [0148.384] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x46 [0148.384] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.385] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.385] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\ISymWrapper", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper", lpFilePart=0x0) returned 0x26 [0148.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\", lpFilePart=0x0) returned 0x27 [0148.385] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.385] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.385] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\ISymWrapper", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper", lpFilePart=0x0) returned 0x26 [0148.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\", lpFilePart=0x0) returned 0x27 [0148.385] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.385] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.386] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x40 [0148.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x41 [0148.386] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.386] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.386] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a", lpFilePart=0x0) returned 0x40 [0148.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\", lpFilePart=0x0) returned 0x41 [0148.386] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.386] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.386] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcstoredb", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb", lpFilePart=0x0) returned 0x24 [0148.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\", lpFilePart=0x0) returned 0x25 [0148.386] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.387] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.387] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcstoredb", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb", lpFilePart=0x0) returned 0x24 [0148.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\", lpFilePart=0x0) returned 0x25 [0148.387] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.387] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.387] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3e [0148.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3f [0148.387] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.387] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.388] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3e [0148.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3f [0148.388] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.388] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.388] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcupdate", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate", lpFilePart=0x0) returned 0x23 [0148.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate\\", lpFilePart=0x0) returned 0x24 [0148.388] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.388] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.388] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcupdate", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate", lpFilePart=0x0) returned 0x23 [0148.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate\\", lpFilePart=0x0) returned 0x24 [0148.388] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.389] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.389] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3d [0148.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3e [0148.389] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.389] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.389] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3d [0148.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3e [0148.389] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.389] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.390] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Mcx2Dvcs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs", lpFilePart=0x0) returned 0x23 [0148.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\", lpFilePart=0x0) returned 0x24 [0148.390] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.390] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.391] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Mcx2Dvcs", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs", lpFilePart=0x0) returned 0x23 [0148.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\", lpFilePart=0x0) returned 0x24 [0148.391] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.391] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.392] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3d [0148.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3e [0148.392] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.392] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0148.392] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x3d [0148.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x3e [0148.392] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.392] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0148.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.392] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop", lpFilePart=0x0) returned 0x53 [0148.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\", lpFilePart=0x0) returned 0x54 [0148.392] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.393] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0148.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0148.393] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop", lpFilePart=0x0) returned 0x53 [0148.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\", lpFilePart=0x0) returned 0x54 [0148.393] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.393] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0148.393] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x6d [0148.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x6e [0148.393] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.393] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.394] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x6d [0148.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x6e [0148.394] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.394] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.394] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor", lpFilePart=0x0) returned 0x3e [0148.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\", lpFilePart=0x0) returned 0x3f [0148.394] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.394] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.394] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor", lpFilePart=0x0) returned 0x3e [0148.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\", lpFilePart=0x0) returned 0x3f [0148.394] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.394] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.395] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x58 [0148.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x59 [0148.395] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.395] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.395] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x58 [0148.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x59 [0148.395] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.395] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.395] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources", lpFilePart=0x0) returned 0x48 [0148.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\", lpFilePart=0x0) returned 0x49 [0148.395] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.396] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.396] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources", lpFilePart=0x0) returned 0x48 [0148.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\", lpFilePart=0x0) returned 0x49 [0148.396] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.396] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.396] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35", lpFilePart=0x0) returned 0x64 [0148.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\", lpFilePart=0x0) returned 0x65 [0148.396] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.396] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.396] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35", lpFilePart=0x0) returned 0x64 [0148.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\", lpFilePart=0x0) returned 0x65 [0148.396] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.396] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.396] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop", lpFilePart=0x0) returned 0x38 [0148.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\", lpFilePart=0x0) returned 0x39 [0148.397] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.397] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.397] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop", lpFilePart=0x0) returned 0x38 [0148.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\", lpFilePart=0x0) returned 0x39 [0148.397] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.397] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.397] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x52 [0148.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x53 [0148.397] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.397] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.398] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x52 [0148.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x53 [0148.398] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.398] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.398] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Ink", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink", lpFilePart=0x0) returned 0x28 [0148.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\", lpFilePart=0x0) returned 0x29 [0148.398] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.398] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.398] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Ink", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink", lpFilePart=0x0) returned 0x28 [0148.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\", lpFilePart=0x0) returned 0x29 [0148.398] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.398] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.399] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x42 [0148.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x43 [0148.399] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.399] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.399] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x42 [0148.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x43 [0148.399] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.399] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.399] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles", lpFilePart=0x0) returned 0x3d [0148.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\", lpFilePart=0x0) returned 0x3e [0148.399] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.400] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.400] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles", lpFilePart=0x0) returned 0x3d [0148.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\", lpFilePart=0x0) returned 0x3e [0148.400] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.400] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.400] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x57 [0148.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x58 [0148.400] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.400] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.400] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x57 [0148.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x58 [0148.400] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.400] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.400] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop", lpFilePart=0x0) returned 0x38 [0148.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\", lpFilePart=0x0) returned 0x39 [0148.401] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.401] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.401] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop", lpFilePart=0x0) returned 0x38 [0148.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\", lpFilePart=0x0) returned 0x39 [0148.401] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.401] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.401] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x52 [0148.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x53 [0148.401] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.401] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.401] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x52 [0148.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x53 [0148.402] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.402] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.402] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media", lpFilePart=0x0) returned 0x3a [0148.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\", lpFilePart=0x0) returned 0x3b [0148.402] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.402] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.402] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media", lpFilePart=0x0) returned 0x3a [0148.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\", lpFilePart=0x0) returned 0x3b [0148.402] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.402] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.402] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x54 [0148.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x55 [0148.403] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.403] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.403] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x54 [0148.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x55 [0148.403] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.403] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.403] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg", lpFilePart=0x0) returned 0x35 [0148.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\", lpFilePart=0x0) returned 0x36 [0148.403] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.403] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.404] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg", lpFilePart=0x0) returned 0x35 [0148.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\", lpFilePart=0x0) returned 0x36 [0148.404] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.404] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.404] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x4f [0148.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x50 [0148.404] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.404] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.404] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x4f [0148.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x50 [0148.404] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.404] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.404] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback", lpFilePart=0x0) returned 0x39 [0148.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\", lpFilePart=0x0) returned 0x3a [0148.404] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.405] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.405] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback", lpFilePart=0x0) returned 0x39 [0148.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\", lpFilePart=0x0) returned 0x3a [0148.405] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.405] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.405] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x53 [0148.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x54 [0148.405] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.405] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.405] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x53 [0148.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x54 [0148.406] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.406] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.406] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop", lpFilePart=0x0) returned 0x42 [0148.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\", lpFilePart=0x0) returned 0x43 [0148.406] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.406] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.406] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop", lpFilePart=0x0) returned 0x42 [0148.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\", lpFilePart=0x0) returned 0x43 [0148.406] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.406] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.406] GetFullPathNameW (in: lpFileName="\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35", lpFilePart=0x0) returned 0x5c [0148.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\", lpFilePart=0x0) returned 0x5d [0148.407] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.407] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.407] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.407] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.407] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.408] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.408] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.408] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.408] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.Access.BusinessDataCatalog\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.409] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.409] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.Access.BusinessDataCatalog\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.409] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.409] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.409] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.410] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.410] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.410] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.BusinessData\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.410] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.410] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.BusinessData\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.410] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.410] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.411] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.411] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.411] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.411] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.411] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.411] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.412] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.412] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.412] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.412] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.412] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.412] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.413] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.413] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.413] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.413] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.SharePoint.BusinessData.Administration.Client\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.413] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.413] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.SharePoint.BusinessData.Administration.Client\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.413] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.414] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.SharePoint.BusinessData.Administration.Client\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.422] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.422] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.SharePoint.BusinessData.Administration.Client\\14.0.0.0__71e9bce111e9429c\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.422] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.423] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.423] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.423] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.423] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.423] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.423] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.423] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.424] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.424] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.424] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.425] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.425] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.425] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\\8.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.425] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.425] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\\8.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.425] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.425] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.426] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.426] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.426] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.426] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.426] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.426] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.427] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.427] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.428] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.428] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.428] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.428] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.428] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.428] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.428] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.428] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.429] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.429] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.429] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.429] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.448] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.449] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.450] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.451] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\napcrypt\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.451] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.451] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\napcrypt\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.452] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.452] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\napcrypt\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.452] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.452] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\napcrypt\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.452] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.452] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\naphlpr\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.452] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.452] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\naphlpr\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.453] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.453] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\naphlpr\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.453] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.453] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\naphlpr\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.453] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.453] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.453] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.453] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.454] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.454] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.454] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.454] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.454] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.454] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.455] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.455] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.455] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.455] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.455] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.456] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.456] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.456] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.456] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.456] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.456] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.456] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.456] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.457] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.457] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.457] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.7.Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.458] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.460] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.7.Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.460] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.460] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.7.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.460] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.460] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.7.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.460] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.461] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.6.0.Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.461] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.461] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.6.0.Microsoft.Ink\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.461] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.461] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.6.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.461] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.461] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.6.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.461] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.461] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.462] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.462] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.462] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.462] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.462] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.462] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.462] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.463] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.463] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.463] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.463] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.463] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.463] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.463] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.463] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.463] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.464] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.464] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.464] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.464] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.464] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.464] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.464] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.464] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.465] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.465] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.465] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.465] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.465] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.465] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.465] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.465] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.466] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.466] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.466] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.466] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.466] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.466] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.466] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.466] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.467] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.467] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.467] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.467] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.467] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.467] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.467] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.467] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.468] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.468] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.468] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.468] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.468] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.468] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.468] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.468] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.485] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.485] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbed18 [0148.486] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.486] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.487] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.487] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.487] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.487] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.487] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.487] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.487] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.487] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\AspNetMMCExt\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.488] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.488] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\AspNetMMCExt\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.488] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.488] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\AspNetMMCExt\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.488] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.488] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\AspNetMMCExt\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.488] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.488] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.489] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.489] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.489] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.489] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.489] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.489] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.489] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.489] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.490] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.490] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.490] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.490] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\8.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.490] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.490] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\8.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.490] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.490] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.491] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.491] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.491] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.491] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.491] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.491] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.491] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.492] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehCIR\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.492] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.492] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehCIR\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.492] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.492] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehCIR\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.492] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.492] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehCIR\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.492] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.493] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehexthost\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.493] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.493] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehexthost\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbed18 [0148.493] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.493] FindFirstFileW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehexthost\\6.1.0.0__31bf3856ad364e35\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed18 [0148.493] FindClose (in: hFindFile=0xbed18 | out: hFindFile=0xbed18) returned 1 [0148.562] CreateFileW (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll-Help.xml" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.security.applicationid.policymanagement.cmdlets.resources\\6.1.0.0_en_31bf3856ad364e35\\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0148.567] GetFileType (hFile=0x154) returned 0x1 [0148.567] GetFileType (hFile=0x154) returned 0x1 [0148.567] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1405b [0148.586] CloseHandle (hObject=0x154) returned 1 [0148.601] CreateFileW (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll-Help.xml" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.security.applicationid.policymanagement.cmdlets.resources\\6.1.0.0_en_31bf3856ad364e35\\microsoft.security.applicationid.policymanagement.cmdlets.dll-help.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0151.590] CreateFileW (lpFileName="C:\\Windows\\diagnostics\\index\\AeroDiagnostic.xml" (normalized: "c:\\windows\\diagnostics\\index\\aerodiagnostic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0151.592] GetFileType (hFile=0x154) returned 0x1 [0151.593] GetFileType (hFile=0x154) returned 0x1 [0151.593] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x7a7 [0151.599] CloseHandle (hObject=0x154) returned 1 [0151.617] CreateFileW (lpFileName="C:\\Windows\\diagnostics\\index\\AeroDiagnostic.xml" (normalized: "c:\\windows\\diagnostics\\index\\aerodiagnostic.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0151.921] CreateFileW (lpFileName="C:\\Windows\\ehome\\mcetuningoverrides.xml" (normalized: "c:\\windows\\ehome\\mcetuningoverrides.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0151.951] GetFileType (hFile=0x154) returned 0x1 [0151.951] GetFileType (hFile=0x154) returned 0x1 [0151.951] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x478ff [0151.953] ReadFile (in: hFile=0x154, lpBuffer=0x25650f38, nNumberOfBytesToRead=0x478ff, lpNumberOfBytesRead=0x2ae648, lpOverlapped=0x0 | out: lpBuffer=0x25650f38*, lpNumberOfBytesRead=0x2ae648*=0x478ff, lpOverlapped=0x0) returned 1 [0151.983] CloseHandle (hObject=0x154) returned 1 [0152.014] CreateFileW (lpFileName="C:\\Windows\\ehome\\mcetuningoverrides.xml" (normalized: "c:\\windows\\ehome\\mcetuningoverrides.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0152.024] CreateFileW (lpFileName="C:\\Windows\\Fonts\\fms_metadata.xml" (normalized: "c:\\windows\\fonts\\fms_metadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0152.024] GetFileType (hFile=0x154) returned 0x1 [0152.024] GetFileType (hFile=0x154) returned 0x1 [0152.024] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x11c20 [0152.043] CloseHandle (hObject=0x154) returned 1 [0152.056] CreateFileW (lpFileName="C:\\Windows\\Fonts\\fms_metadata.xml" (normalized: "c:\\windows\\fonts\\fms_metadata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0152.085] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-AU\\Wallpaper\\AU-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-au\\wallpaper\\au-wp1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0152.087] GetFileType (hFile=0x154) returned 0x1 [0152.087] GetFileType (hFile=0x154) returned 0x1 [0152.087] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xc1f01 [0152.089] ReadFile (in: hFile=0x154, lpBuffer=0x27946018, nNumberOfBytesToRead=0xc1f01, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x27946018*, lpNumberOfBytesRead=0x2ae4ec*=0xc1f01, lpOverlapped=0x0) returned 1 [0152.122] CloseHandle (hObject=0x154) returned 1 [0152.184] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-AU\\Wallpaper\\AU-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-au\\wallpaper\\au-wp1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0152.190] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-CA\\Wallpaper\\CA-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-ca\\wallpaper\\ca-wp1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0152.192] GetFileType (hFile=0x154) returned 0x1 [0152.192] GetFileType (hFile=0x154) returned 0x1 [0152.192] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xcdba6 [0152.194] ReadFile (in: hFile=0x154, lpBuffer=0x27dd1ac8, nNumberOfBytesToRead=0xcdba6, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x27dd1ac8*, lpNumberOfBytesRead=0x2ae4ec*=0xcdba6, lpOverlapped=0x0) returned 1 [0152.257] CloseHandle (hObject=0x154) returned 1 [0152.320] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-CA\\Wallpaper\\CA-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-ca\\wallpaper\\ca-wp1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0152.339] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\Wallpaper\\GB-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-gb\\wallpaper\\gb-wp1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0152.340] GetFileType (hFile=0x154) returned 0x1 [0152.340] GetFileType (hFile=0x154) returned 0x1 [0152.340] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x5a67b [0152.342] ReadFile (in: hFile=0x154, lpBuffer=0x282a4140, nNumberOfBytesToRead=0x5a67b, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x282a4140*, lpNumberOfBytesRead=0x2ae4ec*=0x5a67b, lpOverlapped=0x0) returned 1 [0152.366] CloseHandle (hObject=0x154) returned 1 [0152.400] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\Wallpaper\\GB-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-gb\\wallpaper\\gb-wp1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0152.412] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\Wallpaper\\US-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-us\\wallpaper\\us-wp1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0152.414] GetFileType (hFile=0x154) returned 0x1 [0152.414] GetFileType (hFile=0x154) returned 0x1 [0152.414] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xab683 [0152.416] ReadFile (in: hFile=0x154, lpBuffer=0x284c2898, nNumberOfBytesToRead=0xab683, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x284c2898*, lpNumberOfBytesRead=0x2ae4ec*=0xab683, lpOverlapped=0x0) returned 1 [0152.442] CloseHandle (hObject=0x154) returned 1 [0152.498] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\Wallpaper\\US-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-us\\wallpaper\\us-wp1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0152.513] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-ZA\\Wallpaper\\ZA-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-za\\wallpaper\\za-wp1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0152.515] GetFileType (hFile=0x154) returned 0x1 [0152.515] GetFileType (hFile=0x154) returned 0x1 [0152.515] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x9e2ec [0152.517] ReadFile (in: hFile=0x154, lpBuffer=0x2895ea88, nNumberOfBytesToRead=0x9e2ec, lpNumberOfBytesRead=0x2ae4ec, lpOverlapped=0x0 | out: lpBuffer=0x2895ea88*, lpNumberOfBytesRead=0x2ae4ec*=0x9e2ec, lpOverlapped=0x0) returned 1 [0152.557] CloseHandle (hObject=0x154) returned 1 [0152.608] CreateFileW (lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-ZA\\Wallpaper\\ZA-wp1.jpg" (normalized: "c:\\windows\\globalization\\mct\\mct-za\\wallpaper\\za-wp1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.068] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\000041094B0090400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\000041094b0090400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.070] GetFileType (hFile=0x154) returned 0x1 [0153.071] GetFileType (hFile=0x154) returned 0x1 [0153.071] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6 [0153.072] CloseHandle (hObject=0x154) returned 1 [0153.090] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\000041094B0090400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\000041094b0090400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.096] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109E60090400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109e60090400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.096] GetFileType (hFile=0x154) returned 0x1 [0153.096] GetFileType (hFile=0x154) returned 0x1 [0153.096] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6 [0153.097] CloseHandle (hObject=0x154) returned 1 [0153.115] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109E60090400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109e60090400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.117] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F10090400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109f10090400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.118] GetFileType (hFile=0x154) returned 0x1 [0153.118] GetFileType (hFile=0x154) returned 0x1 [0153.118] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6 [0153.119] CloseHandle (hObject=0x154) returned 1 [0153.138] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F10090400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109f10090400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.140] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100A0C00000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109f100a0c00000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.141] GetFileType (hFile=0x154) returned 0x1 [0153.141] GetFileType (hFile=0x154) returned 0x1 [0153.141] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6 [0153.142] CloseHandle (hObject=0x154) returned 1 [0153.160] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100A0C00000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109f100a0c00000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.162] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100C0400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109f100c0400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.163] GetFileType (hFile=0x154) returned 0x1 [0153.163] GetFileType (hFile=0x154) returned 0x1 [0153.163] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x6 [0153.164] CloseHandle (hObject=0x154) returned 1 [0153.177] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100C0400000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004109f100c0400000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.217] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119750000000000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004119750000000000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.217] GetFileType (hFile=0x154) returned 0x1 [0153.217] GetFileType (hFile=0x154) returned 0x1 [0153.217] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x7 [0153.218] CloseHandle (hObject=0x154) returned 1 [0153.229] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119750000000000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004119750000000000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.231] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119B30000000000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004119b30000000000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.231] GetFileType (hFile=0x154) returned 0x1 [0153.231] GetFileType (hFile=0x154) returned 0x1 [0153.231] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x7 [0153.232] CloseHandle (hObject=0x154) returned 1 [0153.244] CreateFileW (lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119B30000000000000000F01FEC\\CacheSize.txt" (normalized: "c:\\windows\\installer\\$patchcache$\\managed\\00004119b30000000000000000f01fec\\cachesize.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.332] CreateFileW (lpFileName="C:\\Windows\\Media\\flourish.mid" (normalized: "c:\\windows\\media\\flourish.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.352] GetFileType (hFile=0x154) returned 0x1 [0153.352] GetFileType (hFile=0x154) returned 0x1 [0153.352] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x5ebd [0153.362] CloseHandle (hObject=0x154) returned 1 [0153.375] CreateFileW (lpFileName="C:\\Windows\\Media\\flourish.mid" (normalized: "c:\\windows\\media\\flourish.mid"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0153.529] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.543] GetFileType (hFile=0x154) returned 0x1 [0153.544] GetFileType (hFile=0x154) returned 0x1 [0153.544] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x601b [0153.553] CloseHandle (hObject=0x154) returned 1 [0153.565] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.566] GetFileType (hFile=0x154) returned 0x1 [0153.566] GetFileType (hFile=0x154) returned 0x1 [0153.566] WriteFile (in: hFile=0x154, lpBuffer=0x1b3cb24*, nNumberOfBytesToWrite=0x6020, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b3cb24*, lpNumberOfBytesWritten=0x2ae554*=0x6020, lpOverlapped=0x0) returned 1 [0153.567] CloseHandle (hObject=0x154) returned 1 [0153.568] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf4a28f, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cf4a28f, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfa785e50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6020)) returned 1 [0153.568] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql.anonymous")) returned 1 [0153.568] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.569] GetFileType (hFile=0x154) returned 0x1 [0153.569] GetFileType (hFile=0x154) returned 0x1 [0153.569] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdb09 [0153.634] CloseHandle (hObject=0x154) returned 1 [0153.649] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.651] GetFileType (hFile=0x154) returned 0x1 [0153.652] GetFileType (hFile=0x154) returned 0x1 [0153.652] WriteFile (in: hFile=0x154, lpBuffer=0x19c6208*, nNumberOfBytesToWrite=0xdb10, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c6208*, lpNumberOfBytesWritten=0x2ae554*=0xdb10, lpOverlapped=0x0) returned 1 [0153.653] CloseHandle (hObject=0x154) returned 1 [0153.654] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de2abab, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de2abab, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfa86a690, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdb10)) returned 1 [0153.654] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql.anonymous")) returned 1 [0153.655] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.656] GetFileType (hFile=0x154) returned 0x1 [0153.656] GetFileType (hFile=0x154) returned 0x1 [0153.656] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xcc7b [0153.667] CloseHandle (hObject=0x154) returned 1 [0153.681] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.683] GetFileType (hFile=0x154) returned 0x1 [0153.683] GetFileType (hFile=0x154) returned 0x1 [0153.683] WriteFile (in: hFile=0x154, lpBuffer=0x1a47660*, nNumberOfBytesToWrite=0xcc80, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a47660*, lpNumberOfBytesWritten=0x2ae554*=0xcc80, lpOverlapped=0x0) returned 1 [0153.685] CloseHandle (hObject=0x154) returned 1 [0153.685] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5e72f7, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e5e72f7, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfa8b6950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcc80)) returned 1 [0153.685] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql.anonymous")) returned 1 [0153.686] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.686] GetFileType (hFile=0x154) returned 0x1 [0153.686] GetFileType (hFile=0x154) returned 0x1 [0153.686] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8886 [0153.706] CloseHandle (hObject=0x154) returned 1 [0153.718] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.720] GetFileType (hFile=0x154) returned 0x1 [0153.720] GetFileType (hFile=0x154) returned 0x1 [0153.720] WriteFile (in: hFile=0x154, lpBuffer=0x1acc044*, nNumberOfBytesToWrite=0x8890, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1acc044*, lpNumberOfBytesWritten=0x2ae554*=0x8890, lpOverlapped=0x0) returned 1 [0153.722] CloseHandle (hObject=0x154) returned 1 [0153.722] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da00547, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8da00547, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfa902c10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8890)) returned 1 [0153.722] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql.anonymous")) returned 1 [0153.723] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.724] GetFileType (hFile=0x154) returned 0x1 [0153.724] GetFileType (hFile=0x154) returned 0x1 [0153.724] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x85d8 [0153.727] CloseHandle (hObject=0x154) returned 1 [0153.739] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.741] GetFileType (hFile=0x154) returned 0x1 [0153.741] GetFileType (hFile=0x154) returned 0x1 [0153.741] WriteFile (in: hFile=0x154, lpBuffer=0x1b4b8b4*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b4b8b4*, lpNumberOfBytesWritten=0x2ae554*=0x85e0, lpOverlapped=0x0) returned 1 [0153.742] CloseHandle (hObject=0x154) returned 1 [0153.742] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c84c21e, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8c84c21e, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfa928d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x85e0)) returned 1 [0153.742] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql.anonymous")) returned 1 [0153.743] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.744] GetFileType (hFile=0x154) returned 0x1 [0153.744] GetFileType (hFile=0x154) returned 0x1 [0153.744] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xcba3 [0153.769] CloseHandle (hObject=0x154) returned 1 [0153.785] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.786] GetFileType (hFile=0x154) returned 0x1 [0153.786] GetFileType (hFile=0x154) returned 0x1 [0153.786] WriteFile (in: hFile=0x154, lpBuffer=0x19c64d8*, nNumberOfBytesToWrite=0xcbb0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c64d8*, lpNumberOfBytesWritten=0x2ae554*=0xcbb0, lpOverlapped=0x0) returned 1 [0153.788] CloseHandle (hObject=0x154) returned 1 [0153.788] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7d9e01, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8c7d9e01, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfa99b190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xcbb0)) returned 1 [0153.788] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql.anonymous")) returned 1 [0153.789] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.789] GetFileType (hFile=0x154) returned 0x1 [0153.789] GetFileType (hFile=0x154) returned 0x1 [0153.789] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd28f [0153.830] CloseHandle (hObject=0x154) returned 1 [0153.844] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.845] GetFileType (hFile=0x154) returned 0x1 [0153.845] GetFileType (hFile=0x154) returned 0x1 [0153.846] WriteFile (in: hFile=0x154, lpBuffer=0x1a47bec*, nNumberOfBytesToWrite=0xd290, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a47bec*, lpNumberOfBytesWritten=0x2ae554*=0xd290, lpOverlapped=0x0) returned 1 [0153.847] CloseHandle (hObject=0x154) returned 1 [0153.847] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1bcc93, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e1bcc93, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaa33710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd290)) returned 1 [0153.848] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql.anonymous")) returned 1 [0153.848] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.849] GetFileType (hFile=0x154) returned 0x1 [0153.849] GetFileType (hFile=0x154) returned 0x1 [0153.849] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1939 [0153.853] CloseHandle (hObject=0x154) returned 1 [0153.864] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.866] GetFileType (hFile=0x154) returned 0x1 [0153.866] GetFileType (hFile=0x154) returned 0x1 [0153.866] WriteFile (in: hFile=0x154, lpBuffer=0x1aa9f90*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aa9f90*, lpNumberOfBytesWritten=0x2ae554*=0x1940, lpOverlapped=0x0) returned 1 [0153.867] CloseHandle (hObject=0x154) returned 1 [0153.867] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caad80e, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8caad80e, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaa59870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0153.867] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql.anonymous")) returned 1 [0153.868] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.885] GetFileType (hFile=0x154) returned 0x1 [0153.885] GetFileType (hFile=0x154) returned 0x1 [0153.885] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf32 [0153.904] CloseHandle (hObject=0x154) returned 1 [0153.915] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.916] GetFileType (hFile=0x154) returned 0x1 [0153.916] GetFileType (hFile=0x154) returned 0x1 [0153.917] CloseHandle (hObject=0x154) returned 1 [0153.923] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf4a28f, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cf4a28f, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaaf1df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0153.923] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql.anonymous")) returned 1 [0153.924] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.924] GetFileType (hFile=0x154) returned 0x1 [0153.924] GetFileType (hFile=0x154) returned 0x1 [0153.924] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1afd [0153.940] CloseHandle (hObject=0x154) returned 1 [0153.951] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.953] GetFileType (hFile=0x154) returned 0x1 [0153.953] GetFileType (hFile=0x154) returned 0x1 [0153.953] WriteFile (in: hFile=0x154, lpBuffer=0x1b56a5c*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b56a5c*, lpNumberOfBytesWritten=0x2ae554*=0x1b00, lpOverlapped=0x0) returned 1 [0153.954] CloseHandle (hObject=0x154) returned 1 [0153.954] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de2abab, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de2abab, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfab3e0b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b00)) returned 1 [0153.954] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql.anonymous")) returned 1 [0153.955] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.956] GetFileType (hFile=0x154) returned 0x1 [0153.956] GetFileType (hFile=0x154) returned 0x1 [0153.956] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x27d3 [0153.972] CloseHandle (hObject=0x154) returned 1 [0153.986] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.988] GetFileType (hFile=0x154) returned 0x1 [0153.988] GetFileType (hFile=0x154) returned 0x1 [0153.988] WriteFile (in: hFile=0x154, lpBuffer=0x19a7b84*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19a7b84*, lpNumberOfBytesWritten=0x2ae554*=0x27e0, lpOverlapped=0x0) returned 1 [0153.989] CloseHandle (hObject=0x154) returned 1 [0153.989] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de50d0a, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de50d0a, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfab8a370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27e0)) returned 1 [0153.989] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql.anonymous")) returned 1 [0153.990] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0153.990] GetFileType (hFile=0x154) returned 0x1 [0153.990] GetFileType (hFile=0x154) returned 0x1 [0153.990] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1d41 [0154.003] CloseHandle (hObject=0x154) returned 1 [0154.015] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.016] GetFileType (hFile=0x154) returned 0x1 [0154.016] GetFileType (hFile=0x154) returned 0x1 [0154.016] WriteFile (in: hFile=0x154, lpBuffer=0x1a00a00*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a00a00*, lpNumberOfBytesWritten=0x2ae554*=0x1d50, lpOverlapped=0x0) returned 1 [0154.017] CloseHandle (hObject=0x154) returned 1 [0154.019] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da00547, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8da00547, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfabd6630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d50)) returned 1 [0154.019] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql.anonymous")) returned 1 [0154.020] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.021] GetFileType (hFile=0x154) returned 0x1 [0154.021] GetFileType (hFile=0x154) returned 0x1 [0154.021] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x16ed [0154.026] CloseHandle (hObject=0x154) returned 1 [0154.037] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.038] GetFileType (hFile=0x154) returned 0x1 [0154.038] GetFileType (hFile=0x154) returned 0x1 [0154.039] WriteFile (in: hFile=0x154, lpBuffer=0x1a56ca0*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a56ca0*, lpNumberOfBytesWritten=0x2ae554*=0x16f0, lpOverlapped=0x0) returned 1 [0154.040] CloseHandle (hObject=0x154) returned 1 [0154.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8260bf, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8c8260bf, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfabfc790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16f0)) returned 1 [0154.040] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql.anonymous")) returned 1 [0154.041] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.042] GetFileType (hFile=0x154) returned 0x1 [0154.042] GetFileType (hFile=0x154) returned 0x1 [0154.042] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x25db [0154.052] CloseHandle (hObject=0x154) returned 1 [0154.063] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.065] GetFileType (hFile=0x154) returned 0x1 [0154.065] GetFileType (hFile=0x154) returned 0x1 [0154.065] WriteFile (in: hFile=0x154, lpBuffer=0x1ab131c*, nNumberOfBytesToWrite=0x25e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ab131c*, lpNumberOfBytesWritten=0x2ae554*=0x25e0, lpOverlapped=0x0) returned 1 [0154.066] CloseHandle (hObject=0x154) returned 1 [0154.066] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8cfa4f, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d8cfa4f, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfac48a50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25e0)) returned 1 [0154.066] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql.anonymous")) returned 1 [0154.067] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.067] GetFileType (hFile=0x154) returned 0x1 [0154.067] GetFileType (hFile=0x154) returned 0x1 [0154.068] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2e15 [0154.076] CloseHandle (hObject=0x154) returned 1 [0154.088] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.090] GetFileType (hFile=0x154) returned 0x1 [0154.090] GetFileType (hFile=0x154) returned 0x1 [0154.090] WriteFile (in: hFile=0x154, lpBuffer=0x1b0f1fc*, nNumberOfBytesToWrite=0x2e20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b0f1fc*, lpNumberOfBytesWritten=0x2ae554*=0x2e20, lpOverlapped=0x0) returned 1 [0154.091] CloseHandle (hObject=0x154) returned 1 [0154.091] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8e479a, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8c8e479a, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfac94d10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2e20)) returned 1 [0154.091] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql.anonymous")) returned 1 [0154.092] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.093] GetFileType (hFile=0x154) returned 0x1 [0154.093] GetFileType (hFile=0x154) returned 0x1 [0154.093] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xbbe [0154.103] CloseHandle (hObject=0x154) returned 1 [0154.115] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.116] GetFileType (hFile=0x154) returned 0x1 [0154.116] GetFileType (hFile=0x154) returned 0x1 [0154.117] CloseHandle (hObject=0x154) returned 1 [0154.117] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caad80e, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8caad80e, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfacbae70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbc0)) returned 1 [0154.117] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql.anonymous")) returned 1 [0154.124] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\default.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.126] GetFileType (hFile=0x154) returned 0x1 [0154.126] GetFileType (hFile=0x154) returned 0x1 [0154.126] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x10fd [0154.137] CloseHandle (hObject=0x154) returned 1 [0154.151] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\default.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.153] GetFileType (hFile=0x154) returned 0x1 [0154.153] GetFileType (hFile=0x154) returned 0x1 [0154.153] WriteFile (in: hFile=0x154, lpBuffer=0x19c2018*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19c2018*, lpNumberOfBytesWritten=0x2ae4e0*=0x1100, lpOverlapped=0x0) returned 1 [0154.154] CloseHandle (hObject=0x154) returned 1 [0154.154] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\default.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dd6c4d0, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8dd6c4d0, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfad2d290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1100)) returned 1 [0154.154] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\default.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\default.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\default.aspx.anonymous")) returned 1 [0154.155] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\error.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.155] GetFileType (hFile=0x154) returned 0x1 [0154.155] GetFileType (hFile=0x154) returned 0x1 [0154.155] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a91 [0154.165] CloseHandle (hObject=0x154) returned 1 [0154.177] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\error.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.178] GetFileType (hFile=0x154) returned 0x1 [0154.178] GetFileType (hFile=0x154) returned 0x1 [0154.178] WriteFile (in: hFile=0x154, lpBuffer=0x1a18a24*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a18a24*, lpNumberOfBytesWritten=0x2ae4e0*=0x1aa0, lpOverlapped=0x0) returned 1 [0154.179] CloseHandle (hObject=0x154) returned 1 [0154.180] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\error.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ddb878e, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ddb878e, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfad533f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1aa0)) returned 1 [0154.180] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\error.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\error.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\error.aspx.anonymous")) returned 1 [0154.180] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home0.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.181] GetFileType (hFile=0x154) returned 0x1 [0154.181] GetFileType (hFile=0x154) returned 0x1 [0154.182] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x551 [0154.193] CloseHandle (hObject=0x154) returned 1 [0154.205] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home0.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.206] GetFileType (hFile=0x154) returned 0x1 [0154.206] GetFileType (hFile=0x154) returned 0x1 [0154.206] WriteFile (in: hFile=0x154, lpBuffer=0x1a6a8c0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a6a8c0*, lpNumberOfBytesWritten=0x2ae4b4*=0x560, lpOverlapped=0x0) returned 1 [0154.207] CloseHandle (hObject=0x154) returned 1 [0154.208] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home0.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ddb878e, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ddb878e, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfad9f6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0154.208] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home0.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home0.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home0.aspx.anonymous")) returned 1 [0154.208] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home1.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.209] GetFileType (hFile=0x154) returned 0x1 [0154.209] GetFileType (hFile=0x154) returned 0x1 [0154.209] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2e4 [0154.217] CloseHandle (hObject=0x154) returned 1 [0154.228] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home1.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.230] GetFileType (hFile=0x154) returned 0x1 [0154.230] GetFileType (hFile=0x154) returned 0x1 [0154.230] WriteFile (in: hFile=0x154, lpBuffer=0x1abacf0*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1abacf0*, lpNumberOfBytesWritten=0x2ae4b4*=0x2f0, lpOverlapped=0x0) returned 1 [0154.231] CloseHandle (hObject=0x154) returned 1 [0154.231] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home1.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dd9262f, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8dd9262f, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfadeb970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0154.231] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home1.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home1.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home1.aspx.anonymous")) returned 1 [0154.232] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home2.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.232] GetFileType (hFile=0x154) returned 0x1 [0154.232] GetFileType (hFile=0x154) returned 0x1 [0154.232] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x412 [0154.253] CloseHandle (hObject=0x154) returned 1 [0154.265] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home2.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.266] GetFileType (hFile=0x154) returned 0x1 [0154.266] GetFileType (hFile=0x154) returned 0x1 [0154.267] CloseHandle (hObject=0x154) returned 1 [0154.268] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home2.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dd9262f, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8dd9262f, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfae37c30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x420)) returned 1 [0154.268] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home2.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\home2.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\home2.aspx.anonymous")) returned 1 [0154.268] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.269] GetFileType (hFile=0x154) returned 0x1 [0154.269] GetFileType (hFile=0x154) returned 0x1 [0154.269] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a52 [0154.285] CloseHandle (hObject=0x154) returned 1 [0154.297] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.298] GetFileType (hFile=0x154) returned 0x1 [0154.298] GetFileType (hFile=0x154) returned 0x1 [0154.298] WriteFile (in: hFile=0x154, lpBuffer=0x1b61e00*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b61e00*, lpNumberOfBytesWritten=0x2ae4e0*=0x1a60, lpOverlapped=0x0) returned 1 [0154.299] CloseHandle (hObject=0x154) returned 1 [0154.299] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de9cfc8, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de9cfc8, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfae83ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a60)) returned 1 [0154.300] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp.aspx.anonymous")) returned 1 [0154.300] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_application.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.311] GetFileType (hFile=0x154) returned 0x1 [0154.311] GetFileType (hFile=0x154) returned 0x1 [0154.312] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3503 [0154.333] CloseHandle (hObject=0x154) returned 1 [0154.348] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_application.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.349] GetFileType (hFile=0x154) returned 0x1 [0154.349] GetFileType (hFile=0x154) returned 0x1 [0154.350] WriteFile (in: hFile=0x154, lpBuffer=0x19c389c*, nNumberOfBytesToWrite=0x3510, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19c389c*, lpNumberOfBytesWritten=0x2ae4e0*=0x3510, lpOverlapped=0x0) returned 1 [0154.351] CloseHandle (hObject=0x154) returned 1 [0154.351] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_application.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de76e69, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de76e69, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaef6310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3510)) returned 1 [0154.351] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_application.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_application.aspx.anonymous")) returned 1 [0154.352] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.352] GetFileType (hFile=0x154) returned 0x1 [0154.352] GetFileType (hFile=0x154) returned 0x1 [0154.352] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xfec [0154.364] CloseHandle (hObject=0x154) returned 1 [0154.376] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.378] GetFileType (hFile=0x154) returned 0x1 [0154.378] GetFileType (hFile=0x154) returned 0x1 [0154.379] CloseHandle (hObject=0x154) returned 1 [0154.379] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de50d0a, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de50d0a, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaf425d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xff0)) returned 1 [0154.379] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_internals.aspx.anonymous")) returned 1 [0154.380] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.381] GetFileType (hFile=0x154) returned 0x1 [0154.381] GetFileType (hFile=0x154) returned 0x1 [0154.381] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a2d [0154.388] CloseHandle (hObject=0x154) returned 1 [0154.400] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.401] GetFileType (hFile=0x154) returned 0x1 [0154.401] GetFileType (hFile=0x154) returned 0x1 [0154.401] WriteFile (in: hFile=0x154, lpBuffer=0x1a7189c*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a7189c*, lpNumberOfBytesWritten=0x2ae4e0*=0x1a30, lpOverlapped=0x0) returned 1 [0154.402] CloseHandle (hObject=0x154) returned 1 [0154.402] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de76e69, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de76e69, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaf8e890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a30)) returned 1 [0154.402] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_provider.aspx.anonymous")) returned 1 [0154.403] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_security.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.403] GetFileType (hFile=0x154) returned 0x1 [0154.403] GetFileType (hFile=0x154) returned 0x1 [0154.403] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2943 [0154.415] CloseHandle (hObject=0x154) returned 1 [0154.427] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_security.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.429] GetFileType (hFile=0x154) returned 0x1 [0154.429] GetFileType (hFile=0x154) returned 0x1 [0154.429] WriteFile (in: hFile=0x154, lpBuffer=0x1acd4b8*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1acd4b8*, lpNumberOfBytesWritten=0x2ae4e0*=0x2950, lpOverlapped=0x0) returned 1 [0154.431] CloseHandle (hObject=0x154) returned 1 [0154.431] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_security.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de76e69, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8de76e69, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfafdab50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2950)) returned 1 [0154.431] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_security.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\webadminhelp_security.aspx.anonymous")) returned 1 [0154.443] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.445] GetFileType (hFile=0x154) returned 0x1 [0154.445] GetFileType (hFile=0x154) returned 0x1 [0154.445] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1fa4 [0154.455] CloseHandle (hObject=0x154) returned 1 [0154.468] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.470] GetFileType (hFile=0x154) returned 0x1 [0154.470] GetFileType (hFile=0x154) returned 0x1 [0154.470] WriteFile (in: hFile=0x154, lpBuffer=0x1b2aec8*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b2aec8*, lpNumberOfBytesWritten=0x2ae46c*=0x1fb0, lpOverlapped=0x0) returned 1 [0154.472] CloseHandle (hObject=0x154) returned 1 [0154.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d98e12a, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d98e12a, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb026e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1fb0)) returned 1 [0154.472] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx.anonymous")) returned 1 [0154.473] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.474] GetFileType (hFile=0x154) returned 0x1 [0154.474] GetFileType (hFile=0x154) returned 0x1 [0154.474] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xe55 [0154.502] CloseHandle (hObject=0x154) returned 1 [0154.515] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.516] GetFileType (hFile=0x154) returned 0x1 [0154.516] GetFileType (hFile=0x154) returned 0x1 [0154.516] WriteFile (in: hFile=0x154, lpBuffer=0x1b809ac*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b809ac*, lpNumberOfBytesWritten=0x2ae440*=0xe60, lpOverlapped=0x0) returned 1 [0154.517] CloseHandle (hObject=0x154) returned 1 [0154.517] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d967fcb, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d967fcb, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb099230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0154.518] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx.anonymous")) returned 1 [0154.518] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.520] GetFileType (hFile=0x154) returned 0x1 [0154.520] GetFileType (hFile=0x154) returned 0x1 [0154.521] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2fdd [0154.553] CloseHandle (hObject=0x154) returned 1 [0154.568] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.569] GetFileType (hFile=0x154) returned 0x1 [0154.570] GetFileType (hFile=0x154) returned 0x1 [0154.570] WriteFile (in: hFile=0x154, lpBuffer=0x19dde20*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19dde20*, lpNumberOfBytesWritten=0x2ae46c*=0x2fe0, lpOverlapped=0x0) returned 1 [0154.571] CloseHandle (hObject=0x154) returned 1 [0154.571] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d941e6c, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d941e6c, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb1317b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2fe0)) returned 1 [0154.571] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx.anonymous")) returned 1 [0154.572] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.572] GetFileType (hFile=0x154) returned 0x1 [0154.572] GetFileType (hFile=0x154) returned 0x1 [0154.572] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x46fd [0154.599] CloseHandle (hObject=0x154) returned 1 [0154.612] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.613] GetFileType (hFile=0x154) returned 0x1 [0154.613] GetFileType (hFile=0x154) returned 0x1 [0154.613] WriteFile (in: hFile=0x154, lpBuffer=0x1a445b4*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a445b4*, lpNumberOfBytesWritten=0x2ae46c*=0x4700, lpOverlapped=0x0) returned 1 [0154.615] CloseHandle (hObject=0x154) returned 1 [0154.615] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d967fcb, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d967fcb, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb17da70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4700)) returned 1 [0154.615] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx.anonymous")) returned 1 [0154.616] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.617] GetFileType (hFile=0x154) returned 0x1 [0154.617] GetFileType (hFile=0x154) returned 0x1 [0154.617] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x900 [0154.626] CloseHandle (hObject=0x154) returned 1 [0154.638] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.640] GetFileType (hFile=0x154) returned 0x1 [0154.640] GetFileType (hFile=0x154) returned 0x1 [0154.641] CloseHandle (hObject=0x154) returned 1 [0154.641] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d941e6c, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d941e6c, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb1c9d30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0154.641] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx.anonymous")) returned 1 [0154.642] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.642] GetFileType (hFile=0x154) returned 0x1 [0154.642] GetFileType (hFile=0x154) returned 0x1 [0154.642] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3b5c [0154.676] CloseHandle (hObject=0x154) returned 1 [0154.697] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.699] GetFileType (hFile=0x154) returned 0x1 [0154.699] GetFileType (hFile=0x154) returned 0x1 [0154.699] WriteFile (in: hFile=0x154, lpBuffer=0x1afb2dc*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1afb2dc*, lpNumberOfBytesWritten=0x2ae46c*=0x3b60, lpOverlapped=0x0) returned 1 [0154.701] CloseHandle (hObject=0x154) returned 1 [0154.701] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d967fcb, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d967fcb, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb2622b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b60)) returned 1 [0154.701] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx.anonymous")) returned 1 [0154.702] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.703] GetFileType (hFile=0x154) returned 0x1 [0154.703] GetFileType (hFile=0x154) returned 0x1 [0154.703] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x457b [0154.705] CloseHandle (hObject=0x154) returned 1 [0154.723] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.725] GetFileType (hFile=0x154) returned 0x1 [0154.725] GetFileType (hFile=0x154) returned 0x1 [0154.725] WriteFile (in: hFile=0x154, lpBuffer=0x1b61d30*, nNumberOfBytesToWrite=0x4580, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b61d30*, lpNumberOfBytesWritten=0x2ae46c*=0x4580, lpOverlapped=0x0) returned 1 [0154.726] CloseHandle (hObject=0x154) returned 1 [0154.727] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d967fcb, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d967fcb, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb2ae570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4580)) returned 1 [0154.727] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx.anonymous")) returned 1 [0154.769] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.770] GetFileType (hFile=0x154) returned 0x1 [0154.770] GetFileType (hFile=0x154) returned 0x1 [0154.770] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x13d [0154.771] CloseHandle (hObject=0x154) returned 1 [0154.791] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.793] GetFileType (hFile=0x154) returned 0x1 [0154.793] GetFileType (hFile=0x154) returned 0x1 [0154.794] CloseHandle (hObject=0x154) returned 1 [0154.795] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c97cd16, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8c97cd16, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb346af0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x140)) returned 1 [0154.795] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\app_data\\groupedproviders.xml.anonymous")) returned 1 [0154.810] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.813] GetFileType (hFile=0x154) returned 0x1 [0154.813] GetFileType (hFile=0x154) returned 0x1 [0154.813] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3b8 [0154.820] CloseHandle (hObject=0x154) returned 1 [0154.838] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.839] GetFileType (hFile=0x154) returned 0x1 [0154.840] GetFileType (hFile=0x154) returned 0x1 [0154.840] WriteFile (in: hFile=0x154, lpBuffer=0x1a1a4b4*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a1a4b4*, lpNumberOfBytesWritten=0x2ae440*=0x3c0, lpOverlapped=0x0) returned 1 [0154.841] CloseHandle (hObject=0x154) returned 1 [0154.841] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce3f8f6, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce3f8f6, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb3b8f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0154.841] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.anonymous")) returned 1 [0154.842] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.842] GetFileType (hFile=0x154) returned 0x1 [0154.842] GetFileType (hFile=0x154) returned 0x1 [0154.842] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x57e4 [0154.863] CloseHandle (hObject=0x154) returned 1 [0154.913] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.913] GetFileType (hFile=0x154) returned 0x1 [0154.914] GetFileType (hFile=0x154) returned 0x1 [0154.914] WriteFile (in: hFile=0x154, lpBuffer=0x1a83e20*, nNumberOfBytesToWrite=0x57f0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a83e20*, lpNumberOfBytesWritten=0x2ae46c*=0x57f0, lpOverlapped=0x0) returned 1 [0154.916] CloseHandle (hObject=0x154) returned 1 [0154.916] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ced7e72, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ced7e72, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb4775f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x57f0)) returned 1 [0154.916] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.anonymous")) returned 1 [0154.923] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.933] GetFileType (hFile=0x154) returned 0x1 [0154.933] GetFileType (hFile=0x154) returned 0x1 [0154.934] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x79 [0154.935] CloseHandle (hObject=0x154) returned 1 [0154.947] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.949] GetFileType (hFile=0x154) returned 0x1 [0154.949] GetFileType (hFile=0x154) returned 0x1 [0154.950] CloseHandle (hObject=0x154) returned 1 [0154.950] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cefdfd1, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cefdfd1, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb4c38b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0154.950] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.anonymous")) returned 1 [0154.951] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0154.951] GetFileType (hFile=0x154) returned 0x1 [0154.951] GetFileType (hFile=0x154) returned 0x1 [0154.951] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7ee [0155.003] CloseHandle (hObject=0x154) returned 1 [0155.016] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.018] GetFileType (hFile=0x154) returned 0x1 [0155.018] GetFileType (hFile=0x154) returned 0x1 [0155.019] CloseHandle (hObject=0x154) returned 1 [0155.019] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ceb1d13, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ceb1d13, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb55be30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7f0)) returned 1 [0155.019] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.anonymous")) returned 1 [0155.020] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.021] GetFileType (hFile=0x154) returned 0x1 [0155.021] GetFileType (hFile=0x154) returned 0x1 [0155.021] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2044 [0155.035] CloseHandle (hObject=0x154) returned 1 [0155.050] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.052] GetFileType (hFile=0x154) returned 0x1 [0155.052] GetFileType (hFile=0x154) returned 0x1 [0155.052] WriteFile (in: hFile=0x154, lpBuffer=0x1b82368*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b82368*, lpNumberOfBytesWritten=0x2ae46c*=0x2050, lpOverlapped=0x0) returned 1 [0155.053] CloseHandle (hObject=0x154) returned 1 [0155.053] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cefdfd1, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cefdfd1, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb5a80f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2050)) returned 1 [0155.054] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.anonymous")) returned 1 [0155.055] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.055] GetFileType (hFile=0x154) returned 0x1 [0155.055] GetFileType (hFile=0x154) returned 0x1 [0155.055] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3d [0155.056] CloseHandle (hObject=0x154) returned 1 [0155.072] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.073] GetFileType (hFile=0x154) returned 0x1 [0155.073] GetFileType (hFile=0x154) returned 0x1 [0155.074] CloseHandle (hObject=0x154) returned 1 [0155.075] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ceb1d13, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ceb1d13, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb5f43b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0155.075] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.anonymous")) returned 1 [0155.075] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.076] GetFileType (hFile=0x154) returned 0x1 [0155.076] GetFileType (hFile=0x154) returned 0x1 [0155.076] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x392 [0155.097] CloseHandle (hObject=0x154) returned 1 [0155.110] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.112] GetFileType (hFile=0x154) returned 0x1 [0155.112] GetFileType (hFile=0x154) returned 0x1 [0155.113] CloseHandle (hObject=0x154) returned 1 [0155.113] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce65a55, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce65a55, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb640670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0155.113] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.anonymous")) returned 1 [0155.114] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.114] GetFileType (hFile=0x154) returned 0x1 [0155.114] GetFileType (hFile=0x154) returned 0x1 [0155.114] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5a [0155.115] CloseHandle (hObject=0x154) returned 1 [0155.128] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.132] GetFileType (hFile=0x154) returned 0x1 [0155.132] GetFileType (hFile=0x154) returned 0x1 [0155.134] CloseHandle (hObject=0x154) returned 1 [0155.134] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce65a55, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce65a55, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb68c930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0155.134] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.anonymous")) returned 1 [0155.135] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.136] GetFileType (hFile=0x154) returned 0x1 [0155.136] GetFileType (hFile=0x154) returned 0x1 [0155.136] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5a [0155.137] CloseHandle (hObject=0x154) returned 1 [0155.150] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.151] GetFileType (hFile=0x154) returned 0x1 [0155.151] GetFileType (hFile=0x154) returned 0x1 [0155.152] WriteFile (in: hFile=0x154, lpBuffer=0x1ac2ff4*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ac2ff4*, lpNumberOfBytesWritten=0x2ae440*=0x60, lpOverlapped=0x0) returned 1 [0155.153] CloseHandle (hObject=0x154) returned 1 [0155.153] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce65a55, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce65a55, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb6b2a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0155.153] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.anonymous")) returned 1 [0155.154] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.154] GetFileType (hFile=0x154) returned 0x1 [0155.154] GetFileType (hFile=0x154) returned 0x1 [0155.154] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x148 [0155.155] CloseHandle (hObject=0x154) returned 1 [0155.169] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.171] GetFileType (hFile=0x154) returned 0x1 [0155.171] GetFileType (hFile=0x154) returned 0x1 [0155.171] WriteFile (in: hFile=0x154, lpBuffer=0x1b12b50*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b12b50*, lpNumberOfBytesWritten=0x2ae440*=0x150, lpOverlapped=0x0) returned 1 [0155.172] CloseHandle (hObject=0x154) returned 1 [0155.172] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce3f8f6, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce3f8f6, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb6d8bf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0155.172] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.anonymous")) returned 1 [0155.173] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.174] GetFileType (hFile=0x154) returned 0x1 [0155.174] GetFileType (hFile=0x154) returned 0x1 [0155.174] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x581 [0155.192] CloseHandle (hObject=0x154) returned 1 [0155.205] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.206] GetFileType (hFile=0x154) returned 0x1 [0155.207] GetFileType (hFile=0x154) returned 0x1 [0155.208] CloseHandle (hObject=0x154) returned 1 [0155.208] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ceb1d13, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ceb1d13, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb724eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0155.208] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.anonymous")) returned 1 [0155.208] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.209] GetFileType (hFile=0x154) returned 0x1 [0155.209] GetFileType (hFile=0x154) returned 0x1 [0155.209] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x58c [0155.221] CloseHandle (hObject=0x154) returned 1 [0155.235] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.236] GetFileType (hFile=0x154) returned 0x1 [0155.236] GetFileType (hFile=0x154) returned 0x1 [0155.237] WriteFile (in: hFile=0x154, lpBuffer=0x19b5978*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19b5978*, lpNumberOfBytesWritten=0x2ae440*=0x590, lpOverlapped=0x0) returned 1 [0155.238] CloseHandle (hObject=0x154) returned 1 [0155.238] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce8bbb4, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce8bbb4, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb771170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0155.238] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.anonymous")) returned 1 [0155.239] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.239] GetFileType (hFile=0x154) returned 0x1 [0155.240] GetFileType (hFile=0x154) returned 0x1 [0155.240] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa2 [0155.241] CloseHandle (hObject=0x154) returned 1 [0155.253] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.254] GetFileType (hFile=0x154) returned 0x1 [0155.254] GetFileType (hFile=0x154) returned 0x1 [0155.254] WriteFile (in: hFile=0x154, lpBuffer=0x1a0511c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a0511c*, lpNumberOfBytesWritten=0x2ae440*=0xb0, lpOverlapped=0x0) returned 1 [0155.255] CloseHandle (hObject=0x154) returned 1 [0155.256] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ced7e72, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ced7e72, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb7972d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0155.256] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.anonymous")) returned 1 [0155.256] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.257] GetFileType (hFile=0x154) returned 0x1 [0155.257] GetFileType (hFile=0x154) returned 0x1 [0155.257] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x24a [0155.258] CloseHandle (hObject=0x154) returned 1 [0155.270] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.271] GetFileType (hFile=0x154) returned 0x1 [0155.271] GetFileType (hFile=0x154) returned 0x1 [0155.271] WriteFile (in: hFile=0x154, lpBuffer=0x1a551e0*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a551e0*, lpNumberOfBytesWritten=0x2ae440*=0x250, lpOverlapped=0x0) returned 1 [0155.273] CloseHandle (hObject=0x154) returned 1 [0155.273] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cefdfd1, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cefdfd1, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb7e3590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0155.273] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.anonymous")) returned 1 [0155.274] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.275] GetFileType (hFile=0x154) returned 0x1 [0155.275] GetFileType (hFile=0x154) returned 0x1 [0155.275] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7c [0155.276] CloseHandle (hObject=0x154) returned 1 [0155.290] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.292] GetFileType (hFile=0x154) returned 0x1 [0155.292] GetFileType (hFile=0x154) returned 0x1 [0155.293] CloseHandle (hObject=0x154) returned 1 [0155.293] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce3f8f6, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce3f8f6, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb8096f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0155.293] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.anonymous")) returned 1 [0155.294] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.295] GetFileType (hFile=0x154) returned 0x1 [0155.295] GetFileType (hFile=0x154) returned 0x1 [0155.295] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x31 [0155.296] CloseHandle (hObject=0x154) returned 1 [0155.309] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.310] GetFileType (hFile=0x154) returned 0x1 [0155.310] GetFileType (hFile=0x154) returned 0x1 [0155.310] WriteFile (in: hFile=0x154, lpBuffer=0x1af3ce0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1af3ce0*, lpNumberOfBytesWritten=0x2ae440*=0x40, lpOverlapped=0x0) returned 1 [0155.312] CloseHandle (hObject=0x154) returned 1 [0155.312] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce65a55, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce65a55, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb82f850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0155.312] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.anonymous")) returned 1 [0155.313] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.313] GetFileType (hFile=0x154) returned 0x1 [0155.313] GetFileType (hFile=0x154) returned 0x1 [0155.313] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x31 [0155.314] CloseHandle (hObject=0x154) returned 1 [0155.326] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.328] GetFileType (hFile=0x154) returned 0x1 [0155.328] GetFileType (hFile=0x154) returned 0x1 [0155.328] WriteFile (in: hFile=0x154, lpBuffer=0x1b43230*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b43230*, lpNumberOfBytesWritten=0x2ae440*=0x40, lpOverlapped=0x0) returned 1 [0155.329] CloseHandle (hObject=0x154) returned 1 [0155.329] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf24130, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cf24130, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb8559b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0155.329] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.anonymous")) returned 1 [0155.330] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.331] GetFileType (hFile=0x154) returned 0x1 [0155.331] GetFileType (hFile=0x154) returned 0x1 [0155.331] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0155.332] CloseHandle (hObject=0x154) returned 1 [0155.346] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.347] GetFileType (hFile=0x154) returned 0x1 [0155.347] GetFileType (hFile=0x154) returned 0x1 [0155.348] CloseHandle (hObject=0x154) returned 1 [0155.348] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ced7e72, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ced7e72, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb87bb10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0155.349] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.anonymous")) returned 1 [0155.349] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.350] GetFileType (hFile=0x154) returned 0x1 [0155.350] GetFileType (hFile=0x154) returned 0x1 [0155.350] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0155.351] CloseHandle (hObject=0x154) returned 1 [0155.363] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.365] GetFileType (hFile=0x154) returned 0x1 [0155.365] GetFileType (hFile=0x154) returned 0x1 [0155.365] WriteFile (in: hFile=0x154, lpBuffer=0x19e19f4*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19e19f4*, lpNumberOfBytesWritten=0x2ae440*=0x50, lpOverlapped=0x0) returned 1 [0155.366] CloseHandle (hObject=0x154) returned 1 [0155.367] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce8bbb4, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce8bbb4, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb8a1c70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0155.367] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.anonymous")) returned 1 [0155.367] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.368] GetFileType (hFile=0x154) returned 0x1 [0155.368] GetFileType (hFile=0x154) returned 0x1 [0155.368] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x21eb [0155.452] CloseHandle (hObject=0x154) returned 1 [0155.464] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.466] GetFileType (hFile=0x154) returned 0x1 [0155.466] GetFileType (hFile=0x154) returned 0x1 [0155.466] WriteFile (in: hFile=0x154, lpBuffer=0x1a3a5b0*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3a5b0*, lpNumberOfBytesWritten=0x2ae46c*=0x21f0, lpOverlapped=0x0) returned 1 [0155.467] CloseHandle (hObject=0x154) returned 1 [0155.467] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cefdfd1, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cefdfd1, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb9ac610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21f0)) returned 1 [0155.467] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.anonymous")) returned 1 [0155.468] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.468] GetFileType (hFile=0x154) returned 0x1 [0155.468] GetFileType (hFile=0x154) returned 0x1 [0155.468] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0155.469] CloseHandle (hObject=0x154) returned 1 [0155.482] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.483] GetFileType (hFile=0x154) returned 0x1 [0155.483] GetFileType (hFile=0x154) returned 0x1 [0155.484] CloseHandle (hObject=0x154) returned 1 [0155.484] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ceb1d13, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ceb1d13, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb9d2770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0155.484] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.anonymous")) returned 1 [0155.485] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.486] GetFileType (hFile=0x154) returned 0x1 [0155.486] GetFileType (hFile=0x154) returned 0x1 [0155.486] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0155.487] CloseHandle (hObject=0x154) returned 1 [0155.500] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.501] GetFileType (hFile=0x154) returned 0x1 [0155.501] GetFileType (hFile=0x154) returned 0x1 [0155.501] WriteFile (in: hFile=0x154, lpBuffer=0x1ada490*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ada490*, lpNumberOfBytesWritten=0x2ae440*=0x50, lpOverlapped=0x0) returned 1 [0155.502] CloseHandle (hObject=0x154) returned 1 [0155.502] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce19797, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce19797, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfb9f88d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0155.503] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.anonymous")) returned 1 [0155.503] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.504] GetFileType (hFile=0x154) returned 0x1 [0155.504] GetFileType (hFile=0x154) returned 0x1 [0155.504] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x370 [0155.518] CloseHandle (hObject=0x154) returned 1 [0155.530] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.531] GetFileType (hFile=0x154) returned 0x1 [0155.531] GetFileType (hFile=0x154) returned 0x1 [0155.532] CloseHandle (hObject=0x154) returned 1 [0155.532] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce8bbb4, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8ce8bbb4, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfba44b90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0155.532] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.anonymous")) returned 1 [0155.553] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.555] GetFileType (hFile=0x154) returned 0x1 [0155.555] GetFileType (hFile=0x154) returned 0x1 [0155.555] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x99e [0155.561] CloseHandle (hObject=0x154) returned 1 [0155.574] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.575] GetFileType (hFile=0x154) returned 0x1 [0155.575] GetFileType (hFile=0x154) returned 0x1 [0155.576] CloseHandle (hObject=0x154) returned 1 [0155.576] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caf9acc, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8caf9acc, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbab6fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0155.576] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx.anonymous")) returned 1 [0155.577] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.578] GetFileType (hFile=0x154) returned 0x1 [0155.578] GetFileType (hFile=0x154) returned 0x1 [0155.578] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3133 [0155.592] CloseHandle (hObject=0x154) returned 1 [0155.606] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.608] GetFileType (hFile=0x154) returned 0x1 [0155.608] GetFileType (hFile=0x154) returned 0x1 [0155.608] WriteFile (in: hFile=0x154, lpBuffer=0x19e0430*, nNumberOfBytesToWrite=0x3140, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19e0430*, lpNumberOfBytesWritten=0x2ae46c*=0x3140, lpOverlapped=0x0) returned 1 [0155.609] CloseHandle (hObject=0x154) returned 1 [0155.609] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cad396d, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cad396d, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbb03270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3140)) returned 1 [0155.609] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx.anonymous")) returned 1 [0155.610] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.610] GetFileType (hFile=0x154) returned 0x1 [0155.610] GetFileType (hFile=0x154) returned 0x1 [0155.610] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x25f1 [0155.626] CloseHandle (hObject=0x154) returned 1 [0155.638] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.640] GetFileType (hFile=0x154) returned 0x1 [0155.640] GetFileType (hFile=0x154) returned 0x1 [0155.640] WriteFile (in: hFile=0x154, lpBuffer=0x1a3c8b0*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a3c8b0*, lpNumberOfBytesWritten=0x2ae46c*=0x2600, lpOverlapped=0x0) returned 1 [0155.641] CloseHandle (hObject=0x154) returned 1 [0155.641] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caf9acc, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8caf9acc, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbb4f530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1 [0155.641] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\providers\\manageproviders.aspx.anonymous")) returned 1 [0155.655] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.656] GetFileType (hFile=0x154) returned 0x1 [0155.656] GetFileType (hFile=0x154) returned 0x1 [0155.656] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x276e [0155.658] CloseHandle (hObject=0x154) returned 1 [0155.670] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.671] GetFileType (hFile=0x154) returned 0x1 [0155.671] GetFileType (hFile=0x154) returned 0x1 [0155.671] WriteFile (in: hFile=0x154, lpBuffer=0x1a9ee74*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a9ee74*, lpNumberOfBytesWritten=0x2ae46c*=0x2770, lpOverlapped=0x0) returned 1 [0155.673] CloseHandle (hObject=0x154) returned 1 [0155.673] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d85d632, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d85d632, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbb9b7f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2770)) returned 1 [0155.673] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security.aspx.anonymous")) returned 1 [0155.674] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security0.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.674] GetFileType (hFile=0x154) returned 0x1 [0155.674] GetFileType (hFile=0x154) returned 0x1 [0155.674] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5a7 [0155.691] CloseHandle (hObject=0x154) returned 1 [0155.707] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security0.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.709] GetFileType (hFile=0x154) returned 0x1 [0155.709] GetFileType (hFile=0x154) returned 0x1 [0155.709] WriteFile (in: hFile=0x154, lpBuffer=0x1af1c6c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1af1c6c*, lpNumberOfBytesWritten=0x2ae440*=0x5b0, lpOverlapped=0x0) returned 1 [0155.710] CloseHandle (hObject=0x154) returned 1 [0155.710] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security0.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8374d3, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d8374d3, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbc0dc10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0155.710] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security0.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\security0.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\security0.aspx.anonymous")) returned 1 [0155.711] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.711] GetFileType (hFile=0x154) returned 0x1 [0155.711] GetFileType (hFile=0x154) returned 0x1 [0155.711] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa04 [0155.720] CloseHandle (hObject=0x154) returned 1 [0155.733] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.734] GetFileType (hFile=0x154) returned 0x1 [0155.734] GetFileType (hFile=0x154) returned 0x1 [0155.736] CloseHandle (hObject=0x154) returned 1 [0155.736] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8374d3, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d8374d3, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbc33d70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa10)) returned 1 [0155.736] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\setupauthentication.aspx.anonymous")) returned 1 [0155.804] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.806] GetFileType (hFile=0x154) returned 0x1 [0155.806] GetFileType (hFile=0x154) returned 0x1 [0155.806] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2af8 [0155.818] CloseHandle (hObject=0x154) returned 1 [0155.835] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.836] GetFileType (hFile=0x154) returned 0x1 [0155.836] GetFileType (hFile=0x154) returned 0x1 [0155.837] WriteFile (in: hFile=0x154, lpBuffer=0x19a5714*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19a5714*, lpNumberOfBytesWritten=0x2ae3f8*=0x2b00, lpOverlapped=0x0) returned 1 [0155.838] CloseHandle (hObject=0x154) returned 1 [0155.838] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9da3e8, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d9da3e8, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbd3e710, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2b00)) returned 1 [0155.838] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx.anonymous")) returned 1 [0155.839] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.839] GetFileType (hFile=0x154) returned 0x1 [0155.839] GetFileType (hFile=0x154) returned 0x1 [0155.839] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5463 [0155.841] CloseHandle (hObject=0x154) returned 1 [0155.853] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.855] GetFileType (hFile=0x154) returned 0x1 [0155.855] GetFileType (hFile=0x154) returned 0x1 [0155.855] WriteFile (in: hFile=0x154, lpBuffer=0x1a0fd8c*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a0fd8c*, lpNumberOfBytesWritten=0x2ae3f8*=0x5470, lpOverlapped=0x0) returned 1 [0155.857] CloseHandle (hObject=0x154) returned 1 [0155.857] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9da3e8, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8d9da3e8, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbd64870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5470)) returned 1 [0155.857] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx.anonymous")) returned 1 [0155.872] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.873] GetFileType (hFile=0x154) returned 0x1 [0155.873] GetFileType (hFile=0x154) returned 0x1 [0155.873] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c26 [0155.899] CloseHandle (hObject=0x154) returned 1 [0155.910] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.912] GetFileType (hFile=0x154) returned 0x1 [0155.912] GetFileType (hFile=0x154) returned 0x1 [0155.912] WriteFile (in: hFile=0x154, lpBuffer=0x1a701b8*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a701b8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c30, lpOverlapped=0x0) returned 1 [0155.913] CloseHandle (hObject=0x154) returned 1 [0155.914] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e659714, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e659714, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbdfcdf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c30)) returned 1 [0155.914] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx.anonymous")) returned 1 [0155.914] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.915] GetFileType (hFile=0x154) returned 0x1 [0155.915] GetFileType (hFile=0x154) returned 0x1 [0155.915] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2536 [0155.927] CloseHandle (hObject=0x154) returned 1 [0155.939] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.941] GetFileType (hFile=0x154) returned 0x1 [0155.941] GetFileType (hFile=0x154) returned 0x1 [0155.941] WriteFile (in: hFile=0x154, lpBuffer=0x1acabbc*, nNumberOfBytesToWrite=0x2540, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1acabbc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2540, lpOverlapped=0x0) returned 1 [0155.942] CloseHandle (hObject=0x154) returned 1 [0155.942] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e659714, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e659714, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbe22f50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2540)) returned 1 [0155.942] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx.anonymous")) returned 1 [0155.973] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0155.976] GetFileType (hFile=0x154) returned 0x1 [0155.976] GetFileType (hFile=0x154) returned 0x1 [0155.976] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14b4 [0155.994] CloseHandle (hObject=0x154) returned 1 [0156.011] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.013] GetFileType (hFile=0x154) returned 0x1 [0156.013] GetFileType (hFile=0x154) returned 0x1 [0156.013] WriteFile (in: hFile=0x154, lpBuffer=0x1b26160*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b26160*, lpNumberOfBytesWritten=0x2ae3f8*=0x14c0, lpOverlapped=0x0) returned 1 [0156.014] CloseHandle (hObject=0x154) returned 1 [0156.015] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb1fc2b, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb1fc2b, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbee1630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14c0)) returned 1 [0156.015] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\adduser.aspx.anonymous")) returned 1 [0156.015] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.017] GetFileType (hFile=0x154) returned 0x1 [0156.017] GetFileType (hFile=0x154) returned 0x1 [0156.017] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ee6 [0156.024] CloseHandle (hObject=0x154) returned 1 [0156.043] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.045] GetFileType (hFile=0x154) returned 0x1 [0156.045] GetFileType (hFile=0x154) returned 0x1 [0156.045] WriteFile (in: hFile=0x154, lpBuffer=0x1b83408*, nNumberOfBytesToWrite=0x2ef0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b83408*, lpNumberOfBytesWritten=0x2ae3f8*=0x2ef0, lpOverlapped=0x0) returned 1 [0156.047] CloseHandle (hObject=0x154) returned 1 [0156.047] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb45d8a, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb45d8a, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbf2d8f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ef0)) returned 1 [0156.047] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\edituser.aspx.anonymous")) returned 1 [0156.048] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.048] GetFileType (hFile=0x154) returned 0x1 [0156.048] GetFileType (hFile=0x154) returned 0x1 [0156.048] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1f2b [0156.093] CloseHandle (hObject=0x154) returned 1 [0156.113] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.116] GetFileType (hFile=0x154) returned 0x1 [0156.116] GetFileType (hFile=0x154) returned 0x1 [0156.116] WriteFile (in: hFile=0x154, lpBuffer=0x19dc784*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19dc784*, lpNumberOfBytesWritten=0x2ae3f8*=0x1f30, lpOverlapped=0x0) returned 1 [0156.117] CloseHandle (hObject=0x154) returned 1 [0156.117] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb1fc2b, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb1fc2b, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfbfebfd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f30)) returned 1 [0156.118] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\findusers.aspx.anonymous")) returned 1 [0156.118] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.119] GetFileType (hFile=0x154) returned 0x1 [0156.119] GetFileType (hFile=0x154) returned 0x1 [0156.119] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3b53 [0156.133] CloseHandle (hObject=0x154) returned 1 [0156.151] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.153] GetFileType (hFile=0x154) returned 0x1 [0156.153] GetFileType (hFile=0x154) returned 0x1 [0156.153] WriteFile (in: hFile=0x154, lpBuffer=0x1a3e44c*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a3e44c*, lpNumberOfBytesWritten=0x2ae3f8*=0x3b60, lpOverlapped=0x0) returned 1 [0156.155] CloseHandle (hObject=0x154) returned 1 [0156.155] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb1fc2b, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8cb1fc2b, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfc038290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b60)) returned 1 [0156.155] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\users\\manageusers.aspx.anonymous")) returned 1 [0156.189] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.191] GetFileType (hFile=0x154) returned 0x1 [0156.191] GetFileType (hFile=0x154) returned 0x1 [0156.191] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ab2 [0156.204] CloseHandle (hObject=0x154) returned 1 [0156.223] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.225] GetFileType (hFile=0x154) returned 0x1 [0156.225] GetFileType (hFile=0x154) returned 0x1 [0156.225] WriteFile (in: hFile=0x154, lpBuffer=0x1aa4028*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1aa4028*, lpNumberOfBytesWritten=0x2ae3f8*=0x2ac0, lpOverlapped=0x0) returned 1 [0156.226] CloseHandle (hObject=0x154) returned 1 [0156.227] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dec3127, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8dec3127, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfc0f6970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0156.227] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx.anonymous")) returned 1 [0156.254] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\defaultwsdlhelpgenerator.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.263] GetFileType (hFile=0x154) returned 0x1 [0156.263] GetFileType (hFile=0x154) returned 0x1 [0156.263] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x11321 [0156.285] CloseHandle (hObject=0x154) returned 1 [0156.307] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\defaultwsdlhelpgenerator.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.309] GetFileType (hFile=0x154) returned 0x1 [0156.310] GetFileType (hFile=0x154) returned 0x1 [0156.310] WriteFile (in: hFile=0x154, lpBuffer=0x1b31268*, nNumberOfBytesToWrite=0x11330, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b31268*, lpNumberOfBytesWritten=0x2ae4e0*=0x11330, lpOverlapped=0x0) returned 1 [0156.312] CloseHandle (hObject=0x154) returned 1 [0156.312] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\defaultwsdlhelpgenerator.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dff3c1f, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8dff3c1f, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfc1b5050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11330)) returned 1 [0156.313] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\defaultwsdlhelpgenerator.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\DefaultWsdlHelpGenerator.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\defaultwsdlhelpgenerator.aspx.anonymous")) returned 1 [0156.359] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\FrameworkList.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.359] GetFileType (hFile=0x154) returned 0x1 [0156.359] GetFileType (hFile=0x154) returned 0x1 [0156.359] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2b87 [0156.367] CloseHandle (hObject=0x154) returned 1 [0156.387] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\FrameworkList.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\redistlist\\frameworklist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0156.388] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\subsetlist\\client.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.396] GetFileType (hFile=0x154) returned 0x1 [0156.396] GetFileType (hFile=0x154) returned 0x1 [0156.396] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1219 [0156.406] CloseHandle (hObject=0x154) returned 1 [0156.423] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\subsetlist\\client.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0156.444] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.447] GetFileType (hFile=0x154) returned 0x1 [0156.447] GetFileType (hFile=0x154) returned 0x1 [0156.447] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5d5c [0156.455] CloseHandle (hObject=0x154) returned 1 [0156.472] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.474] GetFileType (hFile=0x154) returned 0x1 [0156.475] GetFileType (hFile=0x154) returned 0x1 [0156.475] WriteFile (in: hFile=0x154, lpBuffer=0x1a7e4b4*, nNumberOfBytesToWrite=0x5d60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a7e4b4*, lpNumberOfBytesWritten=0x2ae3f8*=0x5d60, lpOverlapped=0x0) returned 1 [0156.476] CloseHandle (hObject=0x154) returned 1 [0156.476] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebe1592, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x7b0ab1e5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xfc357f70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5d60)) returned 1 [0156.477] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql.anonymous")) returned 1 [0156.477] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.478] GetFileType (hFile=0x154) returned 0x1 [0156.478] GetFileType (hFile=0x154) returned 0x1 [0156.478] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x10c8 [0156.500] CloseHandle (hObject=0x154) returned 1 [0156.516] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.518] GetFileType (hFile=0x154) returned 0x1 [0156.518] GetFileType (hFile=0x154) returned 0x1 [0156.518] WriteFile (in: hFile=0x154, lpBuffer=0x1ad6a1c*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ad6a1c*, lpNumberOfBytesWritten=0x2ae3f8*=0x10d0, lpOverlapped=0x0) returned 1 [0156.519] CloseHandle (hObject=0x154) returned 1 [0156.519] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec076f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x7b0ab1e5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xfc3a4230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10d0)) returned 1 [0156.520] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql.anonymous")) returned 1 [0156.521] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.522] GetFileType (hFile=0x154) returned 0x1 [0156.522] GetFileType (hFile=0x154) returned 0x1 [0156.522] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x5d2a4 [0156.524] ReadFile (in: hFile=0x154, lpBuffer=0x28d13c80, nNumberOfBytesToRead=0x5d2a4, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x28d13c80*, lpNumberOfBytesRead=0x2ae404*=0x5d2a4, lpOverlapped=0x0) returned 1 [0156.552] CloseHandle (hObject=0x154) returned 1 [0156.601] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.607] GetFileType (hFile=0x154) returned 0x1 [0156.607] GetFileType (hFile=0x154) returned 0x1 [0156.607] WriteFile (in: hFile=0x154, lpBuffer=0x28ee5a20*, nNumberOfBytesToWrite=0x5d2b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x28ee5a20*, lpNumberOfBytesWritten=0x2ae3f8*=0x5d2b0, lpOverlapped=0x0) returned 1 [0156.617] CloseHandle (hObject=0x154) returned 1 [0156.617] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec076f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x7b0ab1e5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xfc4aebd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5d2b0)) returned 1 [0156.617] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql.anonymous")) returned 1 [0156.618] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.618] GetFileType (hFile=0x154) returned 0x1 [0156.618] GetFileType (hFile=0x154) returned 0x1 [0156.618] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0xc66e [0156.640] CloseHandle (hObject=0x154) returned 1 [0156.663] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.665] GetFileType (hFile=0x154) returned 0x1 [0156.665] GetFileType (hFile=0x154) returned 0x1 [0156.665] WriteFile (in: hFile=0x154, lpBuffer=0x1994910*, nNumberOfBytesToWrite=0xc670, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1994910*, lpNumberOfBytesWritten=0x2ae3f8*=0xc670, lpOverlapped=0x0) returned 1 [0156.667] CloseHandle (hObject=0x154) returned 1 [0156.667] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec076f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x7b0ab1e5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xfc520ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xc670)) returned 1 [0156.668] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql.anonymous")) returned 1 [0156.710] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.711] GetFileType (hFile=0x154) returned 0x1 [0156.711] GetFileType (hFile=0x154) returned 0x1 [0156.711] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x960 [0156.722] CloseHandle (hObject=0x154) returned 1 [0156.758] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x52 [0156.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0156.758] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0156.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad228) returned 1 [0156.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0156.759] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation", lpFilePart=0x0) returned 0x47 [0156.759] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\", lpFilePart=0x0) returned 0x48 [0156.759] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0156.760] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0156.760] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0156.760] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0156.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0156.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0156.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0156.760] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation", lpFilePart=0x0) returned 0x47 [0156.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\", lpFilePart=0x0) returned 0x48 [0156.760] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbe918 [0156.760] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0156.760] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0156.761] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0156.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0156.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0156.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0156.761] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319", lpFilePart=0x0) returned 0x2d [0156.761] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0156.761] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe918 [0156.762] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.764] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.764] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.764] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.764] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.764] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.764] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.765] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.766] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.767] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.768] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.769] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.770] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.771] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.773] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.774] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.775] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.776] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.776] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.776] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.776] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.776] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.776] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.781] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.781] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.781] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.781] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.781] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.781] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.782] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.783] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.784] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.785] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.794] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.795] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.800] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.801] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.811] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.812] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.813] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.821] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae320 | out: lpFindFileData=0x2ae320) returned 1 [0156.853] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0156.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0156.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0156.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0156.854] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319", lpFilePart=0x0) returned 0x2d [0156.854] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0156.854] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbe918 [0156.855] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0156.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0156.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0156.855] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", lpFilePart=0x0) returned 0x3f [0156.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0156.855] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.855] GetFileType (hFile=0x154) returned 0x1 [0156.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0156.855] GetFileType (hFile=0x154) returned 0x1 [0156.856] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x601b [0156.862] CloseHandle (hObject=0x154) returned 1 [0156.876] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", lpFilePart=0x0) returned 0x3f [0156.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0156.876] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.878] GetFileType (hFile=0x154) returned 0x1 [0156.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0156.878] GetFileType (hFile=0x154) returned 0x1 [0156.878] WriteFile (in: hFile=0x154, lpBuffer=0x1ac8e08*, nNumberOfBytesToWrite=0x6020, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ac8e08*, lpNumberOfBytesWritten=0x2ae554*=0x6020, lpOverlapped=0x0) returned 1 [0156.896] CloseHandle (hObject=0x154) returned 1 [0156.896] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", lpFilePart=0x0) returned 0x3f [0156.896] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.anonymous", lpFilePart=0x0) returned 0x49 [0156.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0156.896] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8419b00, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f989080, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc75c490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x6020)) returned 1 [0156.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0156.896] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql.anonymous")) returned 1 [0156.897] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", lpFilePart=0x0) returned 0x43 [0156.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0156.897] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.898] GetFileType (hFile=0x154) returned 0x1 [0156.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0156.898] GetFileType (hFile=0x154) returned 0x1 [0156.898] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdbb8 [0156.906] CloseHandle (hObject=0x154) returned 1 [0156.931] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", lpFilePart=0x0) returned 0x43 [0156.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0156.931] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.933] GetFileType (hFile=0x154) returned 0x1 [0156.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0156.933] GetFileType (hFile=0x154) returned 0x1 [0156.933] WriteFile (in: hFile=0x154, lpBuffer=0x1b45390*, nNumberOfBytesToWrite=0xdbc0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b45390*, lpNumberOfBytesWritten=0x2ae554*=0xdbc0, lpOverlapped=0x0) returned 1 [0156.935] CloseHandle (hObject=0x154) returned 1 [0156.935] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", lpFilePart=0x0) returned 0x43 [0156.935] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.anonymous", lpFilePart=0x0) returned 0x4d [0156.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0156.935] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1a0900, ftCreationTime.dwHighDateTime=0x1d092a0, ftLastAccessTime.dwLowDateTime=0x905bf8a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc7a8750, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdbc0)) returned 1 [0156.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0156.935] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql.anonymous")) returned 1 [0156.936] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", lpFilePart=0x0) returned 0x48 [0156.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0156.936] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.936] GetFileType (hFile=0x154) returned 0x1 [0156.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0156.936] GetFileType (hFile=0x154) returned 0x1 [0156.936] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd577 [0156.943] CloseHandle (hObject=0x154) returned 1 [0156.960] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", lpFilePart=0x0) returned 0x48 [0156.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0156.960] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.961] GetFileType (hFile=0x154) returned 0x1 [0156.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0156.962] GetFileType (hFile=0x154) returned 0x1 [0156.962] WriteFile (in: hFile=0x154, lpBuffer=0x19d67c4*, nNumberOfBytesToWrite=0xd580, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19d67c4*, lpNumberOfBytesWritten=0x2ae554*=0xd580, lpOverlapped=0x0) returned 1 [0156.964] CloseHandle (hObject=0x154) returned 1 [0156.964] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", lpFilePart=0x0) returned 0x48 [0156.964] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.anonymous", lpFilePart=0x0) returned 0x52 [0156.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0156.964] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e477300, ftCreationTime.dwHighDateTime=0x1d06a66, ftLastAccessTime.dwLowDateTime=0x905bf8a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc7f4a10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd580)) returned 1 [0156.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0156.964] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql.anonymous")) returned 1 [0156.965] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", lpFilePart=0x0) returned 0x48 [0156.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0156.965] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.965] GetFileType (hFile=0x154) returned 0x1 [0156.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0156.965] GetFileType (hFile=0x154) returned 0x1 [0156.965] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x8886 [0156.967] CloseHandle (hObject=0x154) returned 1 [0156.979] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", lpFilePart=0x0) returned 0x48 [0156.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0156.979] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.981] GetFileType (hFile=0x154) returned 0x1 [0156.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0156.981] GetFileType (hFile=0x154) returned 0x1 [0156.981] WriteFile (in: hFile=0x154, lpBuffer=0x1a5bc04*, nNumberOfBytesToWrite=0x8890, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a5bc04*, lpNumberOfBytesWritten=0x2ae554*=0x8890, lpOverlapped=0x0) returned 1 [0156.983] CloseHandle (hObject=0x154) returned 1 [0156.983] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", lpFilePart=0x0) returned 0x48 [0156.983] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.anonymous", lpFilePart=0x0) returned 0x52 [0156.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0156.983] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5df4100, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f9fb4a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc81ab70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x8890)) returned 1 [0156.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0156.983] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql.anonymous")) returned 1 [0156.984] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", lpFilePart=0x0) returned 0x3e [0156.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0156.984] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0156.984] GetFileType (hFile=0x154) returned 0x1 [0156.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0156.984] GetFileType (hFile=0x154) returned 0x1 [0156.984] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x85d8 [0156.986] CloseHandle (hObject=0x154) returned 1 [0156.999] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", lpFilePart=0x0) returned 0x3e [0156.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0156.999] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.000] GetFileType (hFile=0x154) returned 0x1 [0157.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.001] GetFileType (hFile=0x154) returned 0x1 [0157.001] WriteFile (in: hFile=0x154, lpBuffer=0x1adb474*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1adb474*, lpNumberOfBytesWritten=0x2ae554*=0x85e0, lpOverlapped=0x0) returned 1 [0157.002] CloseHandle (hObject=0x154) returned 1 [0157.002] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", lpFilePart=0x0) returned 0x3e [0157.002] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.anonymous", lpFilePart=0x0) returned 0x48 [0157.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.002] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8419b00, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4fcceec0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc840cd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x85e0)) returned 1 [0157.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.002] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql.anonymous")) returned 1 [0157.003] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", lpFilePart=0x0) returned 0x41 [0157.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.003] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.004] GetFileType (hFile=0x154) returned 0x1 [0157.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.004] GetFileType (hFile=0x154) returned 0x1 [0157.004] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xd49b [0157.009] CloseHandle (hObject=0x154) returned 1 [0157.023] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", lpFilePart=0x0) returned 0x41 [0157.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.024] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.026] GetFileType (hFile=0x154) returned 0x1 [0157.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.026] GetFileType (hFile=0x154) returned 0x1 [0157.026] WriteFile (in: hFile=0x154, lpBuffer=0x1b58a58*, nNumberOfBytesToWrite=0xd4a0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b58a58*, lpNumberOfBytesWritten=0x2ae554*=0xd4a0, lpOverlapped=0x0) returned 1 [0157.028] CloseHandle (hObject=0x154) returned 1 [0157.028] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", lpFilePart=0x0) returned 0x41 [0157.028] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.anonymous", lpFilePart=0x0) returned 0x4b [0157.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e477300, ftCreationTime.dwHighDateTime=0x1d06a66, ftLastAccessTime.dwLowDateTime=0x907627c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc88cf90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd4a0)) returned 1 [0157.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.028] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql.anonymous")) returned 1 [0157.029] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", lpFilePart=0x0) returned 0x49 [0157.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.029] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.030] GetFileType (hFile=0x154) returned 0x1 [0157.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.030] GetFileType (hFile=0x154) returned 0x1 [0157.030] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdba9 [0157.045] CloseHandle (hObject=0x154) returned 1 [0157.062] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", lpFilePart=0x0) returned 0x49 [0157.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.062] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.063] GetFileType (hFile=0x154) returned 0x1 [0157.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.064] GetFileType (hFile=0x154) returned 0x1 [0157.064] WriteFile (in: hFile=0x154, lpBuffer=0x19dc938*, nNumberOfBytesToWrite=0xdbb0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19dc938*, lpNumberOfBytesWritten=0x2ae554*=0xdbb0, lpOverlapped=0x0) returned 1 [0157.066] CloseHandle (hObject=0x154) returned 1 [0157.066] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", lpFilePart=0x0) returned 0x49 [0157.066] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.anonymous", lpFilePart=0x0) returned 0x53 [0157.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.066] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e477300, ftCreationTime.dwHighDateTime=0x1d06a66, ftLastAccessTime.dwLowDateTime=0x90788920, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc8d9250, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xdbb0)) returned 1 [0157.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.066] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql.anonymous")) returned 1 [0157.067] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql", lpFilePart=0x0) returned 0x4c [0157.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.068] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.068] GetFileType (hFile=0x154) returned 0x1 [0157.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.068] GetFileType (hFile=0x154) returned 0x1 [0157.068] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1939 [0157.088] CloseHandle (hObject=0x154) returned 1 [0157.100] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql", lpFilePart=0x0) returned 0x4c [0157.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.100] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.102] GetFileType (hFile=0x154) returned 0x1 [0157.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.102] GetFileType (hFile=0x154) returned 0x1 [0157.102] WriteFile (in: hFile=0x154, lpBuffer=0x1a3f774*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a3f774*, lpNumberOfBytesWritten=0x2ae554*=0x1940, lpOverlapped=0x0) returned 1 [0157.103] CloseHandle (hObject=0x154) returned 1 [0157.103] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql", lpFilePart=0x0) returned 0x4c [0157.103] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql.anonymous", lpFilePart=0x0) returned 0x56 [0157.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.103] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5df4100, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4fdb3700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc94b670, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0157.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.103] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql.anonymous")) returned 1 [0157.104] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt", lpFilePart=0x0) returned 0x43 [0157.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.104] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.105] GetFileType (hFile=0x154) returned 0x1 [0157.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.105] GetFileType (hFile=0x154) returned 0x1 [0157.105] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x4e9e [0157.123] CloseHandle (hObject=0x154) returned 1 [0157.136] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt", lpFilePart=0x0) returned 0x43 [0157.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.136] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.138] GetFileType (hFile=0x154) returned 0x1 [0157.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.138] GetFileType (hFile=0x154) returned 0x1 [0157.138] WriteFile (in: hFile=0x154, lpBuffer=0x1aa8474*, nNumberOfBytesToWrite=0x4ea0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1aa8474*, lpNumberOfBytesWritten=0x2ae554*=0x4ea0, lpOverlapped=0x0) returned 1 [0157.139] CloseHandle (hObject=0x154) returned 1 [0157.140] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt", lpFilePart=0x0) returned 0x43 [0157.140] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt.anonymous", lpFilePart=0x0) returned 0x4d [0157.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.140] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd609e00, ftCreationTime.dwHighDateTime=0x1d09ed3, ftLastAccessTime.dwLowDateTime=0x8cfe46e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc997930, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4ea0)) returned 1 [0157.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.140] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt.anonymous")) returned 1 [0157.141] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql", lpFilePart=0x0) returned 0x41 [0157.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.141] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.142] GetFileType (hFile=0x154) returned 0x1 [0157.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.142] GetFileType (hFile=0x154) returned 0x1 [0157.142] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xf32 [0157.143] CloseHandle (hObject=0x154) returned 1 [0157.155] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql", lpFilePart=0x0) returned 0x41 [0157.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.156] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.157] GetFileType (hFile=0x154) returned 0x1 [0157.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.157] GetFileType (hFile=0x154) returned 0x1 [0157.157] WriteFile (in: hFile=0x154, lpBuffer=0x1b0121c*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b0121c*, lpNumberOfBytesWritten=0x2ae528*=0xf40, lpOverlapped=0x0) returned 1 [0157.158] CloseHandle (hObject=0x154) returned 1 [0157.158] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql", lpFilePart=0x0) returned 0x41 [0157.158] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql.anonymous", lpFilePart=0x0) returned 0x4b [0157.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.158] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8419b00, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55e8d620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfc9bda90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0157.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.159] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql.anonymous")) returned 1 [0157.159] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql", lpFilePart=0x0) returned 0x45 [0157.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.159] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.160] GetFileType (hFile=0x154) returned 0x1 [0157.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.160] GetFileType (hFile=0x154) returned 0x1 [0157.160] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1afd [0157.178] CloseHandle (hObject=0x154) returned 1 [0157.190] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql", lpFilePart=0x0) returned 0x45 [0157.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.190] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.191] GetFileType (hFile=0x154) returned 0x1 [0157.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.192] GetFileType (hFile=0x154) returned 0x1 [0157.192] WriteFile (in: hFile=0x154, lpBuffer=0x1b57a30*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b57a30*, lpNumberOfBytesWritten=0x2ae554*=0x1b00, lpOverlapped=0x0) returned 1 [0157.193] CloseHandle (hObject=0x154) returned 1 [0157.193] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql", lpFilePart=0x0) returned 0x45 [0157.193] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql.anonymous", lpFilePart=0x0) returned 0x4f [0157.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.193] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8419b00, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55e8d620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfca2feb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b00)) returned 1 [0157.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.193] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql.anonymous")) returned 1 [0157.195] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql", lpFilePart=0x0) returned 0x4a [0157.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.195] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.195] GetFileType (hFile=0x154) returned 0x1 [0157.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.195] GetFileType (hFile=0x154) returned 0x1 [0157.195] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x27d3 [0157.197] CloseHandle (hObject=0x154) returned 1 [0157.214] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql", lpFilePart=0x0) returned 0x4a [0157.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.215] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.216] GetFileType (hFile=0x154) returned 0x1 [0157.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.216] GetFileType (hFile=0x154) returned 0x1 [0157.216] WriteFile (in: hFile=0x154, lpBuffer=0x19a7b8c*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19a7b8c*, lpNumberOfBytesWritten=0x2ae554*=0x27e0, lpOverlapped=0x0) returned 1 [0157.217] CloseHandle (hObject=0x154) returned 1 [0157.218] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql", lpFilePart=0x0) returned 0x4a [0157.218] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql.anonymous", lpFilePart=0x0) returned 0x54 [0157.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.218] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa972c800, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55e8d620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfca56010, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27e0)) returned 1 [0157.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.218] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql.anonymous")) returned 1 [0157.219] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql", lpFilePart=0x0) returned 0x4a [0157.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.219] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.219] GetFileType (hFile=0x154) returned 0x1 [0157.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.219] GetFileType (hFile=0x154) returned 0x1 [0157.219] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1d41 [0157.232] CloseHandle (hObject=0x154) returned 1 [0157.245] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql", lpFilePart=0x0) returned 0x4a [0157.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.245] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.247] GetFileType (hFile=0x154) returned 0x1 [0157.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.247] GetFileType (hFile=0x154) returned 0x1 [0157.247] WriteFile (in: hFile=0x154, lpBuffer=0x1a00a08*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a00a08*, lpNumberOfBytesWritten=0x2ae554*=0x1d50, lpOverlapped=0x0) returned 1 [0157.248] CloseHandle (hObject=0x154) returned 1 [0157.248] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql", lpFilePart=0x0) returned 0x4a [0157.248] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql.anonymous", lpFilePart=0x0) returned 0x54 [0157.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.248] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5df4100, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55eb3780, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcaa22d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d50)) returned 1 [0157.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.248] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql.anonymous")) returned 1 [0157.249] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql", lpFilePart=0x0) returned 0x40 [0157.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.249] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.250] GetFileType (hFile=0x154) returned 0x1 [0157.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.250] GetFileType (hFile=0x154) returned 0x1 [0157.250] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x16ed [0157.269] CloseHandle (hObject=0x154) returned 1 [0157.281] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql", lpFilePart=0x0) returned 0x40 [0157.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.281] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.283] GetFileType (hFile=0x154) returned 0x1 [0157.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.283] GetFileType (hFile=0x154) returned 0x1 [0157.283] WriteFile (in: hFile=0x154, lpBuffer=0x1a56ca8*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a56ca8*, lpNumberOfBytesWritten=0x2ae554*=0x16f0, lpOverlapped=0x0) returned 1 [0157.284] CloseHandle (hObject=0x154) returned 1 [0157.284] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql", lpFilePart=0x0) returned 0x40 [0157.284] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql.anonymous", lpFilePart=0x0) returned 0x4a [0157.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.284] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8419b00, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55eb3780, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcaee590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x16f0)) returned 1 [0157.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.284] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql.anonymous")) returned 1 [0157.286] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql", lpFilePart=0x0) returned 0x43 [0157.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.286] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.286] GetFileType (hFile=0x154) returned 0x1 [0157.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.286] GetFileType (hFile=0x154) returned 0x1 [0157.286] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x25db [0157.288] CloseHandle (hObject=0x154) returned 1 [0157.301] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql", lpFilePart=0x0) returned 0x43 [0157.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.301] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.303] GetFileType (hFile=0x154) returned 0x1 [0157.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.303] GetFileType (hFile=0x154) returned 0x1 [0157.303] WriteFile (in: hFile=0x154, lpBuffer=0x1ab1324*, nNumberOfBytesToWrite=0x25e0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1ab1324*, lpNumberOfBytesWritten=0x2ae554*=0x25e0, lpOverlapped=0x0) returned 1 [0157.304] CloseHandle (hObject=0x154) returned 1 [0157.304] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql", lpFilePart=0x0) returned 0x43 [0157.304] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql.anonymous", lpFilePart=0x0) returned 0x4d [0157.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.304] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa972c800, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55ed98e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcb3a850, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25e0)) returned 1 [0157.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.304] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql.anonymous")) returned 1 [0157.305] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql", lpFilePart=0x0) returned 0x4b [0157.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.305] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.306] GetFileType (hFile=0x154) returned 0x1 [0157.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.306] GetFileType (hFile=0x154) returned 0x1 [0157.306] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2e15 [0157.323] CloseHandle (hObject=0x154) returned 1 [0157.337] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql", lpFilePart=0x0) returned 0x4b [0157.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.337] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.339] GetFileType (hFile=0x154) returned 0x1 [0157.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.339] GetFileType (hFile=0x154) returned 0x1 [0157.339] WriteFile (in: hFile=0x154, lpBuffer=0x1b0f204*, nNumberOfBytesToWrite=0x2e20, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b0f204*, lpNumberOfBytesWritten=0x2ae554*=0x2e20, lpOverlapped=0x0) returned 1 [0157.340] CloseHandle (hObject=0x154) returned 1 [0157.340] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql", lpFilePart=0x0) returned 0x4b [0157.340] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql.anonymous", lpFilePart=0x0) returned 0x55 [0157.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.340] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa972c800, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55ed98e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcb86b10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2e20)) returned 1 [0157.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.340] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql.anonymous")) returned 1 [0157.341] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql", lpFilePart=0x0) returned 0x4e [0157.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0157.341] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.342] GetFileType (hFile=0x154) returned 0x1 [0157.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0157.342] GetFileType (hFile=0x154) returned 0x1 [0157.342] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xbbe [0157.343] CloseHandle (hObject=0x154) returned 1 [0157.355] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql", lpFilePart=0x0) returned 0x4e [0157.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0157.355] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.357] GetFileType (hFile=0x154) returned 0x1 [0157.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0157.357] GetFileType (hFile=0x154) returned 0x1 [0157.357] WriteFile (in: hFile=0x154, lpBuffer=0x1b64ad4*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ae528, lpOverlapped=0x0 | out: lpBuffer=0x1b64ad4*, lpNumberOfBytesWritten=0x2ae528*=0xbc0, lpOverlapped=0x0) returned 1 [0157.358] CloseHandle (hObject=0x154) returned 1 [0157.358] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql", lpFilePart=0x0) returned 0x4e [0157.358] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql.anonymous", lpFilePart=0x0) returned 0x58 [0157.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0157.358] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5df4100, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55ed98e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcbacc70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xbc0)) returned 1 [0157.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.358] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql.anonymous")) returned 1 [0157.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0157.359] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033", lpFilePart=0x0) returned 0x32 [0157.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpFilePart=0x0) returned 0x33 [0157.359] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0157.371] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0157.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0157.372] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033", lpFilePart=0x0) returned 0x32 [0157.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpFilePart=0x0) returned 0x33 [0157.372] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0157.373] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0157.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0157.374] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles", lpFilePart=0x0) returned 0x42 [0157.374] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpFilePart=0x0) returned 0x43 [0157.374] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0157.385] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0157.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0157.386] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles", lpFilePart=0x0) returned 0x42 [0157.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpFilePart=0x0) returned 0x43 [0157.387] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbed58 [0157.388] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0157.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0157.389] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx", lpFilePart=0x0) returned 0x4f [0157.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.389] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\default.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.391] GetFileType (hFile=0x154) returned 0x1 [0157.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.391] GetFileType (hFile=0x154) returned 0x1 [0157.391] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x10fd [0157.411] CloseHandle (hObject=0x154) returned 1 [0157.425] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx", lpFilePart=0x0) returned 0x4f [0157.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.425] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\default.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.427] GetFileType (hFile=0x154) returned 0x1 [0157.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.427] GetFileType (hFile=0x154) returned 0x1 [0157.427] WriteFile (in: hFile=0x154, lpBuffer=0x19c2720*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19c2720*, lpNumberOfBytesWritten=0x2ae4e0*=0x1100, lpOverlapped=0x0) returned 1 [0157.428] CloseHandle (hObject=0x154) returned 1 [0157.428] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx", lpFilePart=0x0) returned 0x4f [0157.428] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx.anonymous", lpFilePart=0x0) returned 0x59 [0157.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.428] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\default.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae1400, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4eace860, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcc6b350, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1100)) returned 1 [0157.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.428] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\default.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\default.aspx.anonymous")) returned 1 [0157.429] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx", lpFilePart=0x0) returned 0x4d [0157.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.429] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\error.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.430] GetFileType (hFile=0x154) returned 0x1 [0157.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.430] GetFileType (hFile=0x154) returned 0x1 [0157.430] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a91 [0157.445] CloseHandle (hObject=0x154) returned 1 [0157.458] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx", lpFilePart=0x0) returned 0x4d [0157.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.458] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\error.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.460] GetFileType (hFile=0x154) returned 0x1 [0157.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.460] GetFileType (hFile=0x154) returned 0x1 [0157.460] WriteFile (in: hFile=0x154, lpBuffer=0x1a1912c*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a1912c*, lpNumberOfBytesWritten=0x2ae4e0*=0x1aa0, lpOverlapped=0x0) returned 1 [0157.461] CloseHandle (hObject=0x154) returned 1 [0157.461] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx", lpFilePart=0x0) returned 0x4d [0157.461] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx.anonymous", lpFilePart=0x0) returned 0x57 [0157.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.461] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\error.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4ebd9200, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfccb7610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1aa0)) returned 1 [0157.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.461] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\error.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\error.aspx.anonymous")) returned 1 [0157.462] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx", lpFilePart=0x0) returned 0x4d [0157.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.462] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home0.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.463] GetFileType (hFile=0x154) returned 0x1 [0157.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.463] GetFileType (hFile=0x154) returned 0x1 [0157.463] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x551 [0157.468] CloseHandle (hObject=0x154) returned 1 [0157.480] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx", lpFilePart=0x0) returned 0x4d [0157.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.480] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home0.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.482] GetFileType (hFile=0x154) returned 0x1 [0157.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.482] GetFileType (hFile=0x154) returned 0x1 [0157.482] WriteFile (in: hFile=0x154, lpBuffer=0x1a6afc8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1a6afc8*, lpNumberOfBytesWritten=0x2ae4b4*=0x560, lpOverlapped=0x0) returned 1 [0157.483] CloseHandle (hObject=0x154) returned 1 [0157.483] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx", lpFilePart=0x0) returned 0x4d [0157.483] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx.anonymous", lpFilePart=0x0) returned 0x57 [0157.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.483] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home0.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f643240, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfccdd770, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x560)) returned 1 [0157.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.483] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home0.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home0.aspx.anonymous")) returned 1 [0157.484] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx", lpFilePart=0x0) returned 0x4d [0157.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.484] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home1.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.484] GetFileType (hFile=0x154) returned 0x1 [0157.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.484] GetFileType (hFile=0x154) returned 0x1 [0157.485] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2e4 [0157.491] CloseHandle (hObject=0x154) returned 1 [0157.503] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx", lpFilePart=0x0) returned 0x4d [0157.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.503] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home1.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.505] GetFileType (hFile=0x154) returned 0x1 [0157.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.505] GetFileType (hFile=0x154) returned 0x1 [0157.505] WriteFile (in: hFile=0x154, lpBuffer=0x1abb3f8*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1abb3f8*, lpNumberOfBytesWritten=0x2ae4b4*=0x2f0, lpOverlapped=0x0) returned 1 [0157.506] CloseHandle (hObject=0x154) returned 1 [0157.506] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx", lpFilePart=0x0) returned 0x4d [0157.506] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx.anonymous", lpFilePart=0x0) returned 0x57 [0157.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.506] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home1.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f6693a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcd29a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f0)) returned 1 [0157.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.506] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home1.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home1.aspx.anonymous")) returned 1 [0157.507] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx", lpFilePart=0x0) returned 0x4d [0157.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.507] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home2.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.508] GetFileType (hFile=0x154) returned 0x1 [0157.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.508] GetFileType (hFile=0x154) returned 0x1 [0157.508] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x412 [0157.532] CloseHandle (hObject=0x154) returned 1 [0157.543] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx", lpFilePart=0x0) returned 0x4d [0157.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.543] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home2.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.545] GetFileType (hFile=0x154) returned 0x1 [0157.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.545] GetFileType (hFile=0x154) returned 0x1 [0157.545] WriteFile (in: hFile=0x154, lpBuffer=0x1b0bf4c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x1b0bf4c*, lpNumberOfBytesWritten=0x2ae4b4*=0x420, lpOverlapped=0x0) returned 1 [0157.546] CloseHandle (hObject=0x154) returned 1 [0157.546] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx", lpFilePart=0x0) returned 0x4d [0157.546] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx.anonymous", lpFilePart=0x0) returned 0x57 [0157.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.546] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home2.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f80c2c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcd75cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x420)) returned 1 [0157.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.546] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home2.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\home2.aspx.anonymous")) returned 1 [0157.547] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx", lpFilePart=0x0) returned 0x54 [0157.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.547] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.548] GetFileType (hFile=0x154) returned 0x1 [0157.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.548] GetFileType (hFile=0x154) returned 0x1 [0157.548] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a52 [0157.559] CloseHandle (hObject=0x154) returned 1 [0157.572] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx", lpFilePart=0x0) returned 0x54 [0157.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.572] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.573] GetFileType (hFile=0x154) returned 0x1 [0157.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.573] GetFileType (hFile=0x154) returned 0x1 [0157.573] WriteFile (in: hFile=0x154, lpBuffer=0x1b62508*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b62508*, lpNumberOfBytesWritten=0x2ae4e0*=0x1a60, lpOverlapped=0x0) returned 1 [0157.575] CloseHandle (hObject=0x154) returned 1 [0157.575] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx", lpFilePart=0x0) returned 0x54 [0157.575] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx.anonymous", lpFilePart=0x0) returned 0x5e [0157.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.575] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55f97fc0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcdc1fb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a60)) returned 1 [0157.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.575] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp.aspx.anonymous")) returned 1 [0157.576] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", lpFilePart=0x0) returned 0x60 [0157.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.576] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_application.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.576] GetFileType (hFile=0x154) returned 0x1 [0157.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.576] GetFileType (hFile=0x154) returned 0x1 [0157.576] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x3503 [0157.593] CloseHandle (hObject=0x154) returned 1 [0157.607] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", lpFilePart=0x0) returned 0x60 [0157.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.608] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_application.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.609] GetFileType (hFile=0x154) returned 0x1 [0157.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.609] GetFileType (hFile=0x154) returned 0x1 [0157.609] WriteFile (in: hFile=0x154, lpBuffer=0x19a52bc*, nNumberOfBytesToWrite=0x3510, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x19a52bc*, lpNumberOfBytesWritten=0x2ae4e0*=0x3510, lpOverlapped=0x0) returned 1 [0157.610] CloseHandle (hObject=0x154) returned 1 [0157.611] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", lpFilePart=0x0) returned 0x60 [0157.611] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx.anonymous", lpFilePart=0x0) returned 0x6a [0157.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.611] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_application.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae1400, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55f97fc0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfce0e270, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3510)) returned 1 [0157.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.611] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_application.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_application.aspx.anonymous")) returned 1 [0157.614] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", lpFilePart=0x0) returned 0x5e [0157.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.614] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.615] GetFileType (hFile=0x154) returned 0x1 [0157.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.615] GetFileType (hFile=0x154) returned 0x1 [0157.615] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xfec [0157.621] CloseHandle (hObject=0x154) returned 1 [0157.634] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", lpFilePart=0x0) returned 0x5e [0157.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.635] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.636] GetFileType (hFile=0x154) returned 0x1 [0157.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.636] GetFileType (hFile=0x154) returned 0x1 [0157.636] WriteFile (in: hFile=0x154, lpBuffer=0x19fcdcc*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19fcdcc*, lpNumberOfBytesWritten=0x2ae4b4*=0xff0, lpOverlapped=0x0) returned 1 [0157.637] CloseHandle (hObject=0x154) returned 1 [0157.637] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", lpFilePart=0x0) returned 0x5e [0157.637] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx.anonymous", lpFilePart=0x0) returned 0x68 [0157.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.638] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55fbe120, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfce5a530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xff0)) returned 1 [0157.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.638] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_internals.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_internals.aspx.anonymous")) returned 1 [0157.638] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", lpFilePart=0x0) returned 0x5d [0157.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.638] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.639] GetFileType (hFile=0x154) returned 0x1 [0157.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.639] GetFileType (hFile=0x154) returned 0x1 [0157.639] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1a2d [0157.647] CloseHandle (hObject=0x154) returned 1 [0157.660] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", lpFilePart=0x0) returned 0x5d [0157.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.660] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.662] GetFileType (hFile=0x154) returned 0x1 [0157.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.662] GetFileType (hFile=0x154) returned 0x1 [0157.662] WriteFile (in: hFile=0x154, lpBuffer=0x1a532bc*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1a532bc*, lpNumberOfBytesWritten=0x2ae4e0*=0x1a30, lpOverlapped=0x0) returned 1 [0157.663] CloseHandle (hObject=0x154) returned 1 [0157.663] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", lpFilePart=0x0) returned 0x5d [0157.663] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx.anonymous", lpFilePart=0x0) returned 0x67 [0157.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.663] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55fbe120, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcea67f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a30)) returned 1 [0157.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.663] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_provider.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_provider.aspx.anonymous")) returned 1 [0157.664] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx", lpFilePart=0x0) returned 0x5d [0157.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae438) returned 1 [0157.664] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_security.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.665] GetFileType (hFile=0x154) returned 0x1 [0157.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae434) returned 1 [0157.665] GetFileType (hFile=0x154) returned 0x1 [0157.665] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x2943 [0157.669] CloseHandle (hObject=0x154) returned 1 [0157.680] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx", lpFilePart=0x0) returned 0x5d [0157.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae424) returned 1 [0157.681] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_security.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.682] GetFileType (hFile=0x154) returned 0x1 [0157.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae420) returned 1 [0157.682] GetFileType (hFile=0x154) returned 0x1 [0157.682] WriteFile (in: hFile=0x154, lpBuffer=0x1aaeed8*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1aaeed8*, lpNumberOfBytesWritten=0x2ae4e0*=0x2950, lpOverlapped=0x0) returned 1 [0157.683] CloseHandle (hObject=0x154) returned 1 [0157.684] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx", lpFilePart=0x0) returned 0x5d [0157.684] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx.anonymous", lpFilePart=0x0) returned 0x67 [0157.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4c4) returned 1 [0157.684] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_security.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55fe4280, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcecc950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2950)) returned 1 [0157.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.684] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_security.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\webadminhelp_security.aspx.anonymous")) returned 1 [0157.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.685] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig", lpFilePart=0x0) returned 0x4c [0157.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpFilePart=0x0) returned 0x4d [0157.685] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0157.694] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0157.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.695] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig", lpFilePart=0x0) returned 0x4c [0157.695] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpFilePart=0x0) returned 0x4d [0157.695] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0157.697] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0157.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.698] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx", lpFilePart=0x0) returned 0x5f [0157.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.698] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.700] GetFileType (hFile=0x154) returned 0x1 [0157.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.700] GetFileType (hFile=0x154) returned 0x1 [0157.700] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2148 [0157.702] CloseHandle (hObject=0x154) returned 1 [0157.720] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx", lpFilePart=0x0) returned 0x5f [0157.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.720] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.722] GetFileType (hFile=0x154) returned 0x1 [0157.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.722] GetFileType (hFile=0x154) returned 0x1 [0157.722] WriteFile (in: hFile=0x154, lpBuffer=0x1b0d108*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b0d108*, lpNumberOfBytesWritten=0x2ae46c*=0x2150, lpOverlapped=0x0) returned 1 [0157.724] CloseHandle (hObject=0x154) returned 1 [0157.724] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx", lpFilePart=0x0) returned 0x5f [0157.724] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx.anonymous", lpFilePart=0x0) returned 0x69 [0157.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.724] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e60bc60, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcf3ed70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2150)) returned 1 [0157.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.724] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\appconfighome.aspx.anonymous")) returned 1 [0157.725] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx", lpFilePart=0x0) returned 0x62 [0157.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.725] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.736] GetFileType (hFile=0x154) returned 0x1 [0157.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.736] GetFileType (hFile=0x154) returned 0x1 [0157.736] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xe55 [0157.742] CloseHandle (hObject=0x154) returned 1 [0157.755] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx", lpFilePart=0x0) returned 0x62 [0157.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.755] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.756] GetFileType (hFile=0x154) returned 0x1 [0157.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.756] GetFileType (hFile=0x154) returned 0x1 [0157.756] WriteFile (in: hFile=0x154, lpBuffer=0x1b62d8c*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b62d8c*, lpNumberOfBytesWritten=0x2ae440*=0xe60, lpOverlapped=0x0) returned 1 [0157.757] CloseHandle (hObject=0x154) returned 1 [0157.757] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx", lpFilePart=0x0) returned 0x62 [0157.757] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx.anonymous", lpFilePart=0x0) returned 0x6c [0157.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.758] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e9ea020, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcf8b030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0157.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.758] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\createappsetting.aspx.anonymous")) returned 1 [0157.758] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx", lpFilePart=0x0) returned 0x5f [0157.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.758] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.759] GetFileType (hFile=0x154) returned 0x1 [0157.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.759] GetFileType (hFile=0x154) returned 0x1 [0157.759] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x33b3 [0157.766] CloseHandle (hObject=0x154) returned 1 [0157.796] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx", lpFilePart=0x0) returned 0x5f [0157.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.796] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.797] GetFileType (hFile=0x154) returned 0x1 [0157.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.797] GetFileType (hFile=0x154) returned 0x1 [0157.797] WriteFile (in: hFile=0x154, lpBuffer=0x19c193c*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19c193c*, lpNumberOfBytesWritten=0x2ae46c*=0x33c0, lpOverlapped=0x0) returned 1 [0157.799] CloseHandle (hObject=0x154) returned 1 [0157.799] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx", lpFilePart=0x0) returned 0x5f [0157.799] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx.anonymous", lpFilePart=0x0) returned 0x69 [0157.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.799] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4eaa8700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfcfd72f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x33c0)) returned 1 [0157.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.799] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\debugandtrace.aspx.anonymous")) returned 1 [0157.800] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx", lpFilePart=0x0) returned 0x61 [0157.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.800] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.800] GetFileType (hFile=0x154) returned 0x1 [0157.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.800] GetFileType (hFile=0x154) returned 0x1 [0157.800] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x490a [0157.812] CloseHandle (hObject=0x154) returned 1 [0157.826] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx", lpFilePart=0x0) returned 0x61 [0157.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.826] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.827] GetFileType (hFile=0x154) returned 0x1 [0157.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.827] GetFileType (hFile=0x154) returned 0x1 [0157.827] WriteFile (in: hFile=0x154, lpBuffer=0x1a28f00*, nNumberOfBytesToWrite=0x4910, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a28f00*, lpNumberOfBytesWritten=0x2ae46c*=0x4910, lpOverlapped=0x0) returned 1 [0157.829] CloseHandle (hObject=0x154) returned 1 [0157.829] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx", lpFilePart=0x0) returned 0x61 [0157.829] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx.anonymous", lpFilePart=0x0) returned 0x6b [0157.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.829] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4eace860, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd0235b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4910)) returned 1 [0157.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.829] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\defineerrorpage.aspx.anonymous")) returned 1 [0157.830] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx", lpFilePart=0x0) returned 0x60 [0157.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.830] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.831] GetFileType (hFile=0x154) returned 0x1 [0157.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.831] GetFileType (hFile=0x154) returned 0x1 [0157.831] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x900 [0157.840] CloseHandle (hObject=0x154) returned 1 [0157.853] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx", lpFilePart=0x0) returned 0x60 [0157.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.853] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.855] GetFileType (hFile=0x154) returned 0x1 [0157.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.855] GetFileType (hFile=0x154) returned 0x1 [0157.855] WriteFile (in: hFile=0x154, lpBuffer=0x1a7f34c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a7f34c*, lpNumberOfBytesWritten=0x2ae440*=0x910, lpOverlapped=0x0) returned 1 [0157.856] CloseHandle (hObject=0x154) returned 1 [0157.856] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx", lpFilePart=0x0) returned 0x60 [0157.856] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx.anonymous", lpFilePart=0x0) returned 0x6a [0157.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.856] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4ebb30a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd06f870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0157.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.856] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\editappsetting.aspx.anonymous")) returned 1 [0157.857] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx", lpFilePart=0x0) returned 0x63 [0157.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.857] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.857] GetFileType (hFile=0x154) returned 0x1 [0157.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.857] GetFileType (hFile=0x154) returned 0x1 [0157.858] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3b5c [0157.867] CloseHandle (hObject=0x154) returned 1 [0157.899] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx", lpFilePart=0x0) returned 0x63 [0157.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.899] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.901] GetFileType (hFile=0x154) returned 0x1 [0157.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.901] GetFileType (hFile=0x154) returned 0x1 [0157.901] WriteFile (in: hFile=0x154, lpBuffer=0x1adfe38*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1adfe38*, lpNumberOfBytesWritten=0x2ae46c*=0x3b60, lpOverlapped=0x0) returned 1 [0157.902] CloseHandle (hObject=0x154) returned 1 [0157.902] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx", lpFilePart=0x0) returned 0x63 [0157.902] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx.anonymous", lpFilePart=0x0) returned 0x6d [0157.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.902] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x5123b4c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd0e1c90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3b60)) returned 1 [0157.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.902] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\manageappsettings.aspx.anonymous")) returned 1 [0157.903] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx", lpFilePart=0x0) returned 0x5e [0157.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.903] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.903] GetFileType (hFile=0x154) returned 0x1 [0157.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.903] GetFileType (hFile=0x154) returned 0x1 [0157.903] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4792 [0157.908] CloseHandle (hObject=0x154) returned 1 [0157.922] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx", lpFilePart=0x0) returned 0x5e [0157.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.922] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.924] GetFileType (hFile=0x154) returned 0x1 [0157.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.924] GetFileType (hFile=0x154) returned 0x1 [0157.924] WriteFile (in: hFile=0x154, lpBuffer=0x1b4732c*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b4732c*, lpNumberOfBytesWritten=0x2ae46c*=0x47a0, lpOverlapped=0x0) returned 1 [0157.925] CloseHandle (hObject=0x154) returned 1 [0157.926] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx", lpFilePart=0x0) returned 0x5e [0157.926] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx.anonymous", lpFilePart=0x0) returned 0x68 [0157.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.926] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x52a090c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd12df50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x47a0)) returned 1 [0157.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.926] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\smtpsettings.aspx.anonymous")) returned 1 [0157.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0157.926] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources", lpFilePart=0x0) returned 0x5f [0157.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpFilePart=0x0) returned 0x60 [0157.927] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0157.934] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0157.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0157.936] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources", lpFilePart=0x0) returned 0x5f [0157.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpFilePart=0x0) returned 0x60 [0157.936] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbed58 [0157.937] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0157.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.938] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code", lpFilePart=0x0) returned 0x4b [0157.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpFilePart=0x0) returned 0x4c [0157.938] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0157.948] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.949] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code", lpFilePart=0x0) returned 0x4b [0157.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpFilePart=0x0) returned 0x4c [0157.949] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0157.951] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.952] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data", lpFilePart=0x0) returned 0x4b [0157.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\", lpFilePart=0x0) returned 0x4c [0157.952] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0157.953] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.953] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data", lpFilePart=0x0) returned 0x4b [0157.953] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\", lpFilePart=0x0) returned 0x4c [0157.953] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbed58 [0157.953] FindClose (in: hFindFile=0xbed58 | out: hFindFile=0xbed58) returned 1 [0157.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.953] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", lpFilePart=0x0) returned 0x60 [0157.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.953] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.954] GetFileType (hFile=0x154) returned 0x1 [0157.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0157.954] GetFileType (hFile=0x154) returned 0x1 [0157.954] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x13d [0157.955] CloseHandle (hObject=0x154) returned 1 [0157.969] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", lpFilePart=0x0) returned 0x60 [0157.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0157.969] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0157.971] GetFileType (hFile=0x154) returned 0x1 [0157.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0157.971] GetFileType (hFile=0x154) returned 0x1 [0157.971] WriteFile (in: hFile=0x154, lpBuffer=0x19aac3c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19aac3c*, lpNumberOfBytesWritten=0x2ae440*=0x140, lpOverlapped=0x0) returned 1 [0157.972] CloseHandle (hObject=0x154) returned 1 [0157.972] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", lpFilePart=0x0) returned 0x60 [0157.972] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml.anonymous", lpFilePart=0x0) returned 0x6a [0157.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0157.972] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f61d0e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd1a0370, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x140)) returned 1 [0157.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0157.972] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\groupedproviders.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\groupedproviders.xml.anonymous")) returned 1 [0157.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.973] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources", lpFilePart=0x0) returned 0x56 [0157.973] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", lpFilePart=0x0) returned 0x57 [0157.973] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0157.974] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0157.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.974] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources", lpFilePart=0x0) returned 0x56 [0157.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", lpFilePart=0x0) returned 0x57 [0157.974] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0157.974] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0157.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.974] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources", lpFilePart=0x0) returned 0x55 [0157.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpFilePart=0x0) returned 0x56 [0157.974] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0157.980] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0157.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.981] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources", lpFilePart=0x0) returned 0x55 [0157.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpFilePart=0x0) returned 0x56 [0157.981] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0157.982] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0157.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.983] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images", lpFilePart=0x0) returned 0x49 [0157.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\", lpFilePart=0x0) returned 0x4a [0157.983] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0157.995] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0157.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0157.996] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images", lpFilePart=0x0) returned 0x49 [0157.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\", lpFilePart=0x0) returned 0x4a [0157.996] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbeb98 [0157.997] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0157.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0157.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0157.998] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif", lpFilePart=0x0) returned 0x57 [0157.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0157.998] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.000] GetFileType (hFile=0x154) returned 0x1 [0158.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.000] GetFileType (hFile=0x154) returned 0x1 [0158.000] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3b8 [0158.009] CloseHandle (hObject=0x154) returned 1 [0158.022] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif", lpFilePart=0x0) returned 0x57 [0158.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.022] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.023] GetFileType (hFile=0x154) returned 0x1 [0158.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.023] GetFileType (hFile=0x154) returned 0x1 [0158.023] WriteFile (in: hFile=0x154, lpBuffer=0x1a0a0e4*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a0a0e4*, lpNumberOfBytesWritten=0x2ae440*=0x3c0, lpOverlapped=0x0) returned 1 [0158.025] CloseHandle (hObject=0x154) returned 1 [0158.025] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif", lpFilePart=0x0) returned 0x57 [0158.025] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.anonymous", lpFilePart=0x0) returned 0x61 [0158.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.025] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e5e5b00, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd212790, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3c0)) returned 1 [0158.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.025] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.anonymous")) returned 1 [0158.026] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg", lpFilePart=0x0) returned 0x5c [0158.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.026] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.026] GetFileType (hFile=0x154) returned 0x1 [0158.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.027] GetFileType (hFile=0x154) returned 0x1 [0158.027] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x57e4 [0158.031] CloseHandle (hObject=0x154) returned 1 [0158.044] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg", lpFilePart=0x0) returned 0x5c [0158.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.044] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.046] GetFileType (hFile=0x154) returned 0x1 [0158.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.046] GetFileType (hFile=0x154) returned 0x1 [0158.046] WriteFile (in: hFile=0x154, lpBuffer=0x1a73a50*, nNumberOfBytesToWrite=0x57f0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a73a50*, lpNumberOfBytesWritten=0x2ae46c*=0x57f0, lpOverlapped=0x0) returned 1 [0158.047] CloseHandle (hObject=0x154) returned 1 [0158.047] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg", lpFilePart=0x0) returned 0x5c [0158.047] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.anonymous", lpFilePart=0x0) returned 0x66 [0158.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.047] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e631dc0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd2388f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x57f0)) returned 1 [0158.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.048] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.anonymous")) returned 1 [0158.048] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif", lpFilePart=0x0) returned 0x57 [0158.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.048] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.049] GetFileType (hFile=0x154) returned 0x1 [0158.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.049] GetFileType (hFile=0x154) returned 0x1 [0158.049] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x79 [0158.050] CloseHandle (hObject=0x154) returned 1 [0158.062] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif", lpFilePart=0x0) returned 0x57 [0158.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.062] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.063] GetFileType (hFile=0x154) returned 0x1 [0158.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.064] GetFileType (hFile=0x154) returned 0x1 [0158.064] WriteFile (in: hFile=0x154, lpBuffer=0x1ac7960*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ac7960*, lpNumberOfBytesWritten=0x2ae440*=0x80, lpOverlapped=0x0) returned 1 [0158.065] CloseHandle (hObject=0x154) returned 1 [0158.065] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif", lpFilePart=0x0) returned 0x57 [0158.065] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.anonymous", lpFilePart=0x0) returned 0x61 [0158.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.066] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e6f04a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd284bb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0158.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.066] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.anonymous")) returned 1 [0158.066] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif", lpFilePart=0x0) returned 0x5c [0158.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.067] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.067] GetFileType (hFile=0x154) returned 0x1 [0158.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.067] GetFileType (hFile=0x154) returned 0x1 [0158.067] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7ee [0158.088] CloseHandle (hObject=0x154) returned 1 [0158.100] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif", lpFilePart=0x0) returned 0x5c [0158.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.100] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.102] GetFileType (hFile=0x154) returned 0x1 [0158.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.102] GetFileType (hFile=0x154) returned 0x1 [0158.102] WriteFile (in: hFile=0x154, lpBuffer=0x1b19c30*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b19c30*, lpNumberOfBytesWritten=0x2ae440*=0x7f0, lpOverlapped=0x0) returned 1 [0158.103] CloseHandle (hObject=0x154) returned 1 [0158.103] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif", lpFilePart=0x0) returned 0x5c [0158.103] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.anonymous", lpFilePart=0x0) returned 0x66 [0158.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.103] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e716600, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd2d0e70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x7f0)) returned 1 [0158.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.103] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.anonymous")) returned 1 [0158.104] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg", lpFilePart=0x0) returned 0x5b [0158.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.104] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.104] GetFileType (hFile=0x154) returned 0x1 [0158.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.104] GetFileType (hFile=0x154) returned 0x1 [0158.104] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x2044 [0158.122] CloseHandle (hObject=0x154) returned 1 [0158.135] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg", lpFilePart=0x0) returned 0x5b [0158.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.135] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.136] GetFileType (hFile=0x154) returned 0x1 [0158.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.136] GetFileType (hFile=0x154) returned 0x1 [0158.136] WriteFile (in: hFile=0x154, lpBuffer=0x1b71f98*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b71f98*, lpNumberOfBytesWritten=0x2ae46c*=0x2050, lpOverlapped=0x0) returned 1 [0158.137] CloseHandle (hObject=0x154) returned 1 [0158.138] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg", lpFilePart=0x0) returned 0x5b [0158.138] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.anonymous", lpFilePart=0x0) returned 0x65 [0158.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.138] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4ea825a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd31d130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2050)) returned 1 [0158.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.138] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.anonymous")) returned 1 [0158.139] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif", lpFilePart=0x0) returned 0x5f [0158.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.139] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.139] GetFileType (hFile=0x154) returned 0x1 [0158.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.139] GetFileType (hFile=0x154) returned 0x1 [0158.139] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3d [0158.140] CloseHandle (hObject=0x154) returned 1 [0158.155] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif", lpFilePart=0x0) returned 0x5f [0158.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.155] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.156] GetFileType (hFile=0x154) returned 0x1 [0158.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.156] GetFileType (hFile=0x154) returned 0x1 [0158.156] WriteFile (in: hFile=0x154, lpBuffer=0x19c40ac*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19c40ac*, lpNumberOfBytesWritten=0x2ae440*=0x40, lpOverlapped=0x0) returned 1 [0158.157] CloseHandle (hObject=0x154) returned 1 [0158.157] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif", lpFilePart=0x0) returned 0x5f [0158.158] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.anonymous", lpFilePart=0x0) returned 0x69 [0158.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.158] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4eaf49c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd343290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0158.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.158] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.anonymous")) returned 1 [0158.158] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif", lpFilePart=0x0) returned 0x54 [0158.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.159] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.159] GetFileType (hFile=0x154) returned 0x1 [0158.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.159] GetFileType (hFile=0x154) returned 0x1 [0158.160] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x392 [0158.168] CloseHandle (hObject=0x154) returned 1 [0158.180] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif", lpFilePart=0x0) returned 0x54 [0158.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.180] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.182] GetFileType (hFile=0x154) returned 0x1 [0158.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.182] GetFileType (hFile=0x154) returned 0x1 [0158.182] WriteFile (in: hFile=0x154, lpBuffer=0x1a14ae8*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a14ae8*, lpNumberOfBytesWritten=0x2ae440*=0x3a0, lpOverlapped=0x0) returned 1 [0158.183] CloseHandle (hObject=0x154) returned 1 [0158.183] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif", lpFilePart=0x0) returned 0x54 [0158.183] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.anonymous", lpFilePart=0x0) returned 0x5e [0158.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.183] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f5388a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd38f550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0158.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.184] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.anonymous")) returned 1 [0158.184] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif", lpFilePart=0x0) returned 0x5d [0158.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.184] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.185] GetFileType (hFile=0x154) returned 0x1 [0158.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.185] GetFileType (hFile=0x154) returned 0x1 [0158.185] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5a [0158.186] CloseHandle (hObject=0x154) returned 1 [0158.198] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif", lpFilePart=0x0) returned 0x5d [0158.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.198] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.199] GetFileType (hFile=0x154) returned 0x1 [0158.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.199] GetFileType (hFile=0x154) returned 0x1 [0158.199] WriteFile (in: hFile=0x154, lpBuffer=0x1a64050*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a64050*, lpNumberOfBytesWritten=0x2ae440*=0x60, lpOverlapped=0x0) returned 1 [0158.200] CloseHandle (hObject=0x154) returned 1 [0158.200] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif", lpFilePart=0x0) returned 0x5d [0158.200] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.anonymous", lpFilePart=0x0) returned 0x67 [0158.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f61d0e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd3b56b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0158.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.201] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.anonymous")) returned 1 [0158.201] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif", lpFilePart=0x0) returned 0x5e [0158.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.201] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.202] GetFileType (hFile=0x154) returned 0x1 [0158.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.202] GetFileType (hFile=0x154) returned 0x1 [0158.202] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5a [0158.203] CloseHandle (hObject=0x154) returned 1 [0158.215] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif", lpFilePart=0x0) returned 0x5e [0158.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.215] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.216] GetFileType (hFile=0x154) returned 0x1 [0158.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.216] GetFileType (hFile=0x154) returned 0x1 [0158.217] WriteFile (in: hFile=0x154, lpBuffer=0x1ab35f8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ab35f8*, lpNumberOfBytesWritten=0x2ae440*=0x60, lpOverlapped=0x0) returned 1 [0158.218] CloseHandle (hObject=0x154) returned 1 [0158.218] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif", lpFilePart=0x0) returned 0x5e [0158.218] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.anonymous", lpFilePart=0x0) returned 0x68 [0158.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.218] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f61d0e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd3db810, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0158.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.218] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.anonymous")) returned 1 [0158.219] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif", lpFilePart=0x0) returned 0x61 [0158.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.219] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.220] GetFileType (hFile=0x154) returned 0x1 [0158.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.220] GetFileType (hFile=0x154) returned 0x1 [0158.220] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x148 [0158.221] CloseHandle (hObject=0x154) returned 1 [0158.232] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif", lpFilePart=0x0) returned 0x61 [0158.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.233] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.234] GetFileType (hFile=0x154) returned 0x1 [0158.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.234] GetFileType (hFile=0x154) returned 0x1 [0158.234] WriteFile (in: hFile=0x154, lpBuffer=0x1b03154*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b03154*, lpNumberOfBytesWritten=0x2ae440*=0x150, lpOverlapped=0x0) returned 1 [0158.235] CloseHandle (hObject=0x154) returned 1 [0158.235] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif", lpFilePart=0x0) returned 0x61 [0158.235] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.anonymous", lpFilePart=0x0) returned 0x6b [0158.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.235] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f643240, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd401970, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x150)) returned 1 [0158.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.235] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.anonymous")) returned 1 [0158.236] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg", lpFilePart=0x0) returned 0x52 [0158.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.236] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.237] GetFileType (hFile=0x154) returned 0x1 [0158.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.237] GetFileType (hFile=0x154) returned 0x1 [0158.237] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x581 [0158.243] CloseHandle (hObject=0x154) returned 1 [0158.255] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg", lpFilePart=0x0) returned 0x52 [0158.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.255] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.256] GetFileType (hFile=0x154) returned 0x1 [0158.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.256] GetFileType (hFile=0x154) returned 0x1 [0158.256] WriteFile (in: hFile=0x154, lpBuffer=0x1b545d0*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b545d0*, lpNumberOfBytesWritten=0x2ae440*=0x590, lpOverlapped=0x0) returned 1 [0158.257] CloseHandle (hObject=0x154) returned 1 [0158.257] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg", lpFilePart=0x0) returned 0x52 [0158.257] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.anonymous", lpFilePart=0x0) returned 0x5c [0158.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.258] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f643240, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd44dc30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0158.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.258] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.anonymous")) returned 1 [0158.258] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif", lpFilePart=0x0) returned 0x5c [0158.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.258] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.259] GetFileType (hFile=0x154) returned 0x1 [0158.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.259] GetFileType (hFile=0x154) returned 0x1 [0158.259] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x58c [0158.269] CloseHandle (hObject=0x154) returned 1 [0158.283] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif", lpFilePart=0x0) returned 0x5c [0158.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.283] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.285] GetFileType (hFile=0x154) returned 0x1 [0158.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.285] GetFileType (hFile=0x154) returned 0x1 [0158.285] WriteFile (in: hFile=0x154, lpBuffer=0x19a655c*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19a655c*, lpNumberOfBytesWritten=0x2ae440*=0x590, lpOverlapped=0x0) returned 1 [0158.286] CloseHandle (hObject=0x154) returned 1 [0158.286] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif", lpFilePart=0x0) returned 0x5c [0158.286] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.anonymous", lpFilePart=0x0) returned 0x66 [0158.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.286] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f643240, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd499ef0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0158.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.286] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.anonymous")) returned 1 [0158.287] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif", lpFilePart=0x0) returned 0x54 [0158.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.287] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.287] GetFileType (hFile=0x154) returned 0x1 [0158.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.287] GetFileType (hFile=0x154) returned 0x1 [0158.287] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa2 [0158.288] CloseHandle (hObject=0x154) returned 1 [0158.300] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif", lpFilePart=0x0) returned 0x54 [0158.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.300] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.302] GetFileType (hFile=0x154) returned 0x1 [0158.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.302] GetFileType (hFile=0x154) returned 0x1 [0158.302] WriteFile (in: hFile=0x154, lpBuffer=0x19f5d00*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19f5d00*, lpNumberOfBytesWritten=0x2ae440*=0xb0, lpOverlapped=0x0) returned 1 [0158.303] CloseHandle (hObject=0x154) returned 1 [0158.303] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif", lpFilePart=0x0) returned 0x54 [0158.303] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.anonymous", lpFilePart=0x0) returned 0x5e [0158.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.303] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f8a4840, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd4c0050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0158.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.303] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.anonymous")) returned 1 [0158.304] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif", lpFilePart=0x0) returned 0x54 [0158.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.304] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.304] GetFileType (hFile=0x154) returned 0x1 [0158.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.304] GetFileType (hFile=0x154) returned 0x1 [0158.304] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x24a [0158.305] CloseHandle (hObject=0x154) returned 1 [0158.318] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif", lpFilePart=0x0) returned 0x54 [0158.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.319] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.320] GetFileType (hFile=0x154) returned 0x1 [0158.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.320] GetFileType (hFile=0x154) returned 0x1 [0158.320] WriteFile (in: hFile=0x154, lpBuffer=0x1a45dc4*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a45dc4*, lpNumberOfBytesWritten=0x2ae440*=0x250, lpOverlapped=0x0) returned 1 [0158.321] CloseHandle (hObject=0x154) returned 1 [0158.321] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif", lpFilePart=0x0) returned 0x54 [0158.322] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.anonymous", lpFilePart=0x0) returned 0x5e [0158.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.322] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4f989080, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd4e61b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0158.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.322] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.anonymous")) returned 1 [0158.323] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif", lpFilePart=0x0) returned 0x5a [0158.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.324] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.324] GetFileType (hFile=0x154) returned 0x1 [0158.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.324] GetFileType (hFile=0x154) returned 0x1 [0158.325] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7c [0158.326] CloseHandle (hObject=0x154) returned 1 [0158.338] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif", lpFilePart=0x0) returned 0x5a [0158.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.338] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.340] GetFileType (hFile=0x154) returned 0x1 [0158.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.340] GetFileType (hFile=0x154) returned 0x1 [0158.340] WriteFile (in: hFile=0x154, lpBuffer=0x1a95378*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a95378*, lpNumberOfBytesWritten=0x2ae440*=0x80, lpOverlapped=0x0) returned 1 [0158.341] CloseHandle (hObject=0x154) returned 1 [0158.342] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif", lpFilePart=0x0) returned 0x5a [0158.342] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.anonymous", lpFilePart=0x0) returned 0x64 [0158.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.342] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x528fe720, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd50c310, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0158.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.342] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.anonymous")) returned 1 [0158.343] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg", lpFilePart=0x0) returned 0x60 [0158.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.343] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.344] GetFileType (hFile=0x154) returned 0x1 [0158.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.344] GetFileType (hFile=0x154) returned 0x1 [0158.344] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x31 [0158.345] CloseHandle (hObject=0x154) returned 1 [0158.357] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg", lpFilePart=0x0) returned 0x60 [0158.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.357] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.359] GetFileType (hFile=0x154) returned 0x1 [0158.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.359] GetFileType (hFile=0x154) returned 0x1 [0158.359] WriteFile (in: hFile=0x154, lpBuffer=0x1ae48c4*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ae48c4*, lpNumberOfBytesWritten=0x2ae440*=0x40, lpOverlapped=0x0) returned 1 [0158.360] CloseHandle (hObject=0x154) returned 1 [0158.360] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg", lpFilePart=0x0) returned 0x60 [0158.360] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.anonymous", lpFilePart=0x0) returned 0x6a [0158.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.360] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x528fe720, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd532470, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0158.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.360] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.anonymous")) returned 1 [0158.361] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif", lpFilePart=0x0) returned 0x5d [0158.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.361] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.362] GetFileType (hFile=0x154) returned 0x1 [0158.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.362] GetFileType (hFile=0x154) returned 0x1 [0158.362] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x31 [0158.363] CloseHandle (hObject=0x154) returned 1 [0158.375] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif", lpFilePart=0x0) returned 0x5d [0158.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.375] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.377] GetFileType (hFile=0x154) returned 0x1 [0158.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.377] GetFileType (hFile=0x154) returned 0x1 [0158.377] WriteFile (in: hFile=0x154, lpBuffer=0x1b33e14*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b33e14*, lpNumberOfBytesWritten=0x2ae440*=0x40, lpOverlapped=0x0) returned 1 [0158.378] CloseHandle (hObject=0x154) returned 1 [0158.378] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif", lpFilePart=0x0) returned 0x5d [0158.378] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.anonymous", lpFilePart=0x0) returned 0x67 [0158.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.378] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x52924880, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd57e730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0158.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.378] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.anonymous")) returned 1 [0158.379] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif", lpFilePart=0x0) returned 0x64 [0158.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.379] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.379] GetFileType (hFile=0x154) returned 0x1 [0158.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.380] GetFileType (hFile=0x154) returned 0x1 [0158.380] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0158.381] CloseHandle (hObject=0x154) returned 1 [0158.393] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif", lpFilePart=0x0) returned 0x64 [0158.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.393] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.395] GetFileType (hFile=0x154) returned 0x1 [0158.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.395] GetFileType (hFile=0x154) returned 0x1 [0158.395] WriteFile (in: hFile=0x154, lpBuffer=0x1b833bc*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b833bc*, lpNumberOfBytesWritten=0x2ae440*=0x50, lpOverlapped=0x0) returned 1 [0158.396] CloseHandle (hObject=0x154) returned 1 [0158.396] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif", lpFilePart=0x0) returned 0x64 [0158.396] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.anonymous", lpFilePart=0x0) returned 0x6e [0158.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.396] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x52924880, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd5a4890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0158.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.396] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.anonymous")) returned 1 [0158.397] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif", lpFilePart=0x0) returned 0x65 [0158.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.397] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.397] GetFileType (hFile=0x154) returned 0x1 [0158.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.397] GetFileType (hFile=0x154) returned 0x1 [0158.397] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0158.399] CloseHandle (hObject=0x154) returned 1 [0158.414] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif", lpFilePart=0x0) returned 0x65 [0158.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.414] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.415] GetFileType (hFile=0x154) returned 0x1 [0158.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.415] GetFileType (hFile=0x154) returned 0x1 [0158.415] WriteFile (in: hFile=0x154, lpBuffer=0x19d14ac*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x19d14ac*, lpNumberOfBytesWritten=0x2ae440*=0x50, lpOverlapped=0x0) returned 1 [0158.416] CloseHandle (hObject=0x154) returned 1 [0158.416] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif", lpFilePart=0x0) returned 0x65 [0158.416] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.anonymous", lpFilePart=0x0) returned 0x6f [0158.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.416] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x5294a9e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd5ca9f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0158.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.417] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.anonymous")) returned 1 [0158.417] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg", lpFilePart=0x0) returned 0x5b [0158.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.417] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.435] GetFileType (hFile=0x154) returned 0x1 [0158.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.435] GetFileType (hFile=0x154) returned 0x1 [0158.436] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x21eb [0158.443] CloseHandle (hObject=0x154) returned 1 [0158.461] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg", lpFilePart=0x0) returned 0x5b [0158.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.461] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.463] GetFileType (hFile=0x154) returned 0x1 [0158.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.463] GetFileType (hFile=0x154) returned 0x1 [0158.463] WriteFile (in: hFile=0x154, lpBuffer=0x1a2a1c4*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a2a1c4*, lpNumberOfBytesWritten=0x2ae46c*=0x21f0, lpOverlapped=0x0) returned 1 [0158.464] CloseHandle (hObject=0x154) returned 1 [0158.468] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg", lpFilePart=0x0) returned 0x5b [0158.468] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.anonymous", lpFilePart=0x0) returned 0x65 [0158.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.468] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55e1b200, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd63ce10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21f0)) returned 1 [0158.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.468] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.anonymous")) returned 1 [0158.469] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif", lpFilePart=0x0) returned 0x66 [0158.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.469] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.469] GetFileType (hFile=0x154) returned 0x1 [0158.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.469] GetFileType (hFile=0x154) returned 0x1 [0158.470] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0158.471] CloseHandle (hObject=0x154) returned 1 [0158.489] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif", lpFilePart=0x0) returned 0x66 [0158.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.489] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.491] GetFileType (hFile=0x154) returned 0x1 [0158.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.491] GetFileType (hFile=0x154) returned 0x1 [0158.491] WriteFile (in: hFile=0x154, lpBuffer=0x1a7aab0*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a7aab0*, lpNumberOfBytesWritten=0x2ae440*=0x50, lpOverlapped=0x0) returned 1 [0158.492] CloseHandle (hObject=0x154) returned 1 [0158.493] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif", lpFilePart=0x0) returned 0x66 [0158.493] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.anonymous", lpFilePart=0x0) returned 0x70 [0158.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.493] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55ed98e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd6890d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0158.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.493] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.anonymous")) returned 1 [0158.494] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif", lpFilePart=0x0) returned 0x67 [0158.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.494] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.494] GetFileType (hFile=0x154) returned 0x1 [0158.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.494] GetFileType (hFile=0x154) returned 0x1 [0158.494] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x41 [0158.496] CloseHandle (hObject=0x154) returned 1 [0158.513] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif", lpFilePart=0x0) returned 0x67 [0158.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.513] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.515] GetFileType (hFile=0x154) returned 0x1 [0158.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.515] GetFileType (hFile=0x154) returned 0x1 [0158.515] WriteFile (in: hFile=0x154, lpBuffer=0x1aca0a4*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1aca0a4*, lpNumberOfBytesWritten=0x2ae440*=0x50, lpOverlapped=0x0) returned 1 [0158.517] CloseHandle (hObject=0x154) returned 1 [0158.517] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif", lpFilePart=0x0) returned 0x67 [0158.517] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.anonymous", lpFilePart=0x0) returned 0x71 [0158.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.517] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x55ed98e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd6af230, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1 [0158.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.517] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.anonymous")) returned 1 [0158.519] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif", lpFilePart=0x0) returned 0x5a [0158.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.519] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.520] GetFileType (hFile=0x154) returned 0x1 [0158.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.520] GetFileType (hFile=0x154) returned 0x1 [0158.520] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x370 [0158.539] CloseHandle (hObject=0x154) returned 1 [0158.554] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif", lpFilePart=0x0) returned 0x5a [0158.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.554] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.555] GetFileType (hFile=0x154) returned 0x1 [0158.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.555] GetFileType (hFile=0x154) returned 0x1 [0158.555] WriteFile (in: hFile=0x154, lpBuffer=0x1b1a920*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b1a920*, lpNumberOfBytesWritten=0x2ae440*=0x380, lpOverlapped=0x0) returned 1 [0158.556] CloseHandle (hObject=0x154) returned 1 [0158.556] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif", lpFilePart=0x0) returned 0x5a [0158.556] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.anonymous", lpFilePart=0x0) returned 0x64 [0158.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.557] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x561d3460, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd721650, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0158.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.557] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.anonymous")) returned 1 [0158.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0158.557] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers", lpFilePart=0x0) returned 0x4c [0158.557] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\", lpFilePart=0x0) returned 0x4d [0158.558] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0158.577] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0158.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0158.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0158.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0158.578] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers", lpFilePart=0x0) returned 0x4c [0158.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\", lpFilePart=0x0) returned 0x4d [0158.578] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0158.579] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0158.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0158.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0158.580] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx", lpFilePart=0x0) returned 0x6a [0158.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.581] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.582] GetFileType (hFile=0x154) returned 0x1 [0158.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.582] GetFileType (hFile=0x154) returned 0x1 [0158.582] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x99e [0158.603] CloseHandle (hObject=0x154) returned 1 [0158.616] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx", lpFilePart=0x0) returned 0x6a [0158.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.616] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.617] GetFileType (hFile=0x154) returned 0x1 [0158.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.618] GetFileType (hFile=0x154) returned 0x1 [0158.618] WriteFile (in: hFile=0x154, lpBuffer=0x1b704a0*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b704a0*, lpNumberOfBytesWritten=0x2ae440*=0x9a0, lpOverlapped=0x0) returned 1 [0158.620] CloseHandle (hObject=0x154) returned 1 [0158.620] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx", lpFilePart=0x0) returned 0x6a [0158.620] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx.anonymous", lpFilePart=0x0) returned 0x74 [0158.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.620] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e9057e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd7b9bd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x9a0)) returned 1 [0158.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.620] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\chooseprovidermanagement.aspx.anonymous")) returned 1 [0158.621] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx", lpFilePart=0x0) returned 0x6d [0158.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.621] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.621] GetFileType (hFile=0x154) returned 0x1 [0158.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.621] GetFileType (hFile=0x154) returned 0x1 [0158.621] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3133 [0158.633] CloseHandle (hObject=0x154) returned 1 [0158.648] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx", lpFilePart=0x0) returned 0x6d [0158.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.648] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.650] GetFileType (hFile=0x154) returned 0x1 [0158.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.650] GetFileType (hFile=0x154) returned 0x1 [0158.650] WriteFile (in: hFile=0x154, lpBuffer=0x19d132c*, nNumberOfBytesToWrite=0x3140, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19d132c*, lpNumberOfBytesWritten=0x2ae46c*=0x3140, lpOverlapped=0x0) returned 1 [0158.651] CloseHandle (hObject=0x154) returned 1 [0158.652] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx", lpFilePart=0x0) returned 0x6d [0158.652] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx.anonymous", lpFilePart=0x0) returned 0x77 [0158.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.652] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x51261620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd805e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3140)) returned 1 [0158.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.652] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageconsolidatedproviders.aspx.anonymous")) returned 1 [0158.653] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx", lpFilePart=0x0) returned 0x61 [0158.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.653] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.653] GetFileType (hFile=0x154) returned 0x1 [0158.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.654] GetFileType (hFile=0x154) returned 0x1 [0158.654] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x25f1 [0158.664] CloseHandle (hObject=0x154) returned 1 [0158.677] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx", lpFilePart=0x0) returned 0x61 [0158.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.677] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.679] GetFileType (hFile=0x154) returned 0x1 [0158.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0158.679] GetFileType (hFile=0x154) returned 0x1 [0158.679] WriteFile (in: hFile=0x154, lpBuffer=0x1a2d7ac*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a2d7ac*, lpNumberOfBytesWritten=0x2ae46c*=0x2600, lpOverlapped=0x0) returned 1 [0158.680] CloseHandle (hObject=0x154) returned 1 [0158.680] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx", lpFilePart=0x0) returned 0x61 [0158.680] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx.anonymous", lpFilePart=0x0) returned 0x6b [0158.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0158.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x513de3e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd852150, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1 [0158.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.680] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageproviders.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\providers\\manageproviders.aspx.anonymous")) returned 1 [0158.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0158.681] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources", lpFilePart=0x0) returned 0x5f [0158.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\", lpFilePart=0x0) returned 0x60 [0158.681] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0158.683] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0158.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0158.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0158.684] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources", lpFilePart=0x0) returned 0x5f [0158.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\", lpFilePart=0x0) returned 0x60 [0158.684] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0158.685] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0158.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0158.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0158.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0158.686] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security", lpFilePart=0x0) returned 0x4b [0158.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\", lpFilePart=0x0) returned 0x4c [0158.686] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0158.698] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0158.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0158.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0158.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0158.699] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security", lpFilePart=0x0) returned 0x4b [0158.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\", lpFilePart=0x0) returned 0x4c [0158.700] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbef18 [0158.701] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0158.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0158.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0158.702] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx", lpFilePart=0x0) returned 0x59 [0158.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0158.702] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.703] GetFileType (hFile=0x154) returned 0x1 [0158.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0158.703] GetFileType (hFile=0x154) returned 0x1 [0158.703] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x27da [0158.709] CloseHandle (hObject=0x154) returned 1 [0158.722] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx", lpFilePart=0x0) returned 0x59 [0158.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0158.722] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.724] GetFileType (hFile=0x154) returned 0x1 [0158.724] GetFileType (hFile=0x154) returned 0x1 [0158.724] WriteFile (in: hFile=0x154, lpBuffer=0x1a8ffa0*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a8ffa0*, lpNumberOfBytesWritten=0x2ae46c*=0x27e0, lpOverlapped=0x0) returned 1 [0158.725] CloseHandle (hObject=0x154) returned 1 [0158.725] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx", lpFilePart=0x0) returned 0x59 [0158.725] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx.anonymous", lpFilePart=0x0) returned 0x63 [0158.725] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x528fe720, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd8c4570, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27e0)) returned 1 [0158.725] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security.aspx.anonymous")) returned 1 [0158.726] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx", lpFilePart=0x0) returned 0x5a [0158.726] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security0.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.727] GetFileType (hFile=0x154) returned 0x1 [0158.727] GetFileType (hFile=0x154) returned 0x1 [0158.727] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5a7 [0158.733] CloseHandle (hObject=0x154) returned 1 [0158.746] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx", lpFilePart=0x0) returned 0x5a [0158.746] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security0.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.748] GetFileType (hFile=0x154) returned 0x1 [0158.748] GetFileType (hFile=0x154) returned 0x1 [0158.748] WriteFile (in: hFile=0x154, lpBuffer=0x1ae2e08*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ae2e08*, lpNumberOfBytesWritten=0x2ae440*=0x5b0, lpOverlapped=0x0) returned 1 [0158.749] CloseHandle (hObject=0x154) returned 1 [0158.749] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx", lpFilePart=0x0) returned 0x5a [0158.749] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx.anonymous", lpFilePart=0x0) returned 0x64 [0158.749] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security0.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x52924880, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd8ea6d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0158.749] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security0.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\security0.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\security0.aspx.anonymous")) returned 1 [0158.750] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx", lpFilePart=0x0) returned 0x64 [0158.750] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.750] GetFileType (hFile=0x154) returned 0x1 [0158.750] GetFileType (hFile=0x154) returned 0x1 [0158.750] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xa04 [0158.752] CloseHandle (hObject=0x154) returned 1 [0158.763] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx", lpFilePart=0x0) returned 0x64 [0158.763] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.765] GetFileType (hFile=0x154) returned 0x1 [0158.765] GetFileType (hFile=0x154) returned 0x1 [0158.765] WriteFile (in: hFile=0x154, lpBuffer=0x1b35de4*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b35de4*, lpNumberOfBytesWritten=0x2ae440*=0xa10, lpOverlapped=0x0) returned 1 [0158.766] CloseHandle (hObject=0x154) returned 1 [0158.766] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx", lpFilePart=0x0) returned 0x64 [0158.766] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx.anonymous", lpFilePart=0x0) returned 0x6e [0158.766] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x529bce00, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd910830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xa10)) returned 1 [0158.766] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\setupauthentication.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\setUpAuthentication.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\setupauthentication.aspx.anonymous")) returned 1 [0158.767] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources", lpFilePart=0x0) returned 0x5e [0158.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\", lpFilePart=0x0) returned 0x5f [0158.767] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0158.777] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0158.778] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources", lpFilePart=0x0) returned 0x5e [0158.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\", lpFilePart=0x0) returned 0x5f [0158.778] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0158.779] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0158.780] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions", lpFilePart=0x0) returned 0x57 [0158.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\", lpFilePart=0x0) returned 0x58 [0158.780] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0158.788] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0158.789] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions", lpFilePart=0x0) returned 0x57 [0158.789] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\", lpFilePart=0x0) returned 0x58 [0158.790] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0158.791] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0158.792] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx", lpFilePart=0x0) returned 0x6d [0158.792] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.802] GetFileType (hFile=0x154) returned 0x1 [0158.802] GetFileType (hFile=0x154) returned 0x1 [0158.802] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2b9a [0158.807] CloseHandle (hObject=0x154) returned 1 [0158.822] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx", lpFilePart=0x0) returned 0x6d [0158.822] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.824] GetFileType (hFile=0x154) returned 0x1 [0158.824] GetFileType (hFile=0x154) returned 0x1 [0158.824] WriteFile (in: hFile=0x154, lpBuffer=0x1996c88*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1996c88*, lpNumberOfBytesWritten=0x2ae3f8*=0x2ba0, lpOverlapped=0x0) returned 1 [0158.825] CloseHandle (hObject=0x154) returned 1 [0158.825] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx", lpFilePart=0x0) returned 0x6d [0158.825] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx.anonymous", lpFilePart=0x0) returned 0x77 [0158.825] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4ea10180, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd9a8db0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2ba0)) returned 1 [0158.825] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\createPermission.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\createpermission.aspx.anonymous")) returned 1 [0158.826] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx", lpFilePart=0x0) returned 0x6e [0158.826] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.826] GetFileType (hFile=0x154) returned 0x1 [0158.826] GetFileType (hFile=0x154) returned 0x1 [0158.827] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x54a4 [0158.830] CloseHandle (hObject=0x154) returned 1 [0158.842] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx", lpFilePart=0x0) returned 0x6e [0158.842] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.844] GetFileType (hFile=0x154) returned 0x1 [0158.844] GetFileType (hFile=0x154) returned 0x1 [0158.844] WriteFile (in: hFile=0x154, lpBuffer=0x1a014dc*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a014dc*, lpNumberOfBytesWritten=0x2ae3f8*=0x54b0, lpOverlapped=0x0) returned 1 [0158.845] CloseHandle (hObject=0x154) returned 1 [0158.846] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx", lpFilePart=0x0) returned 0x6e [0158.846] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx.anonymous", lpFilePart=0x0) returned 0x78 [0158.846] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x51261620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfd9f5070, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x54b0)) returned 1 [0158.846] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\managePermissions.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\permissions\\managepermissions.aspx.anonymous")) returned 1 [0158.846] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources", lpFilePart=0x0) returned 0x6a [0158.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\", lpFilePart=0x0) returned 0x6b [0158.847] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf2d8 [0158.847] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0158.847] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources", lpFilePart=0x0) returned 0x6a [0158.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\", lpFilePart=0x0) returned 0x6b [0158.847] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf2d8 [0158.847] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0158.847] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles", lpFilePart=0x0) returned 0x51 [0158.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\", lpFilePart=0x0) returned 0x52 [0158.847] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0158.849] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0158.850] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles", lpFilePart=0x0) returned 0x51 [0158.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\", lpFilePart=0x0) returned 0x52 [0158.850] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0158.851] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0158.852] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx", lpFilePart=0x0) returned 0x65 [0158.852] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.853] GetFileType (hFile=0x154) returned 0x1 [0158.853] GetFileType (hFile=0x154) returned 0x1 [0158.853] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1c63 [0158.855] CloseHandle (hObject=0x154) returned 1 [0158.867] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx", lpFilePart=0x0) returned 0x65 [0158.867] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.868] GetFileType (hFile=0x154) returned 0x1 [0158.868] GetFileType (hFile=0x154) returned 0x1 [0158.868] WriteFile (in: hFile=0x154, lpBuffer=0x1a61a88*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a61a88*, lpNumberOfBytesWritten=0x2ae3f8*=0x1c70, lpOverlapped=0x0) returned 1 [0158.869] CloseHandle (hObject=0x154) returned 1 [0158.870] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx", lpFilePart=0x0) returned 0x65 [0158.870] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx.anonymous", lpFilePart=0x0) returned 0x6f [0158.870] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x51130b20, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfda1b1d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1c70)) returned 1 [0158.870] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageAllRoles.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\manageallroles.aspx.anonymous")) returned 1 [0158.870] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx", lpFilePart=0x0) returned 0x67 [0158.870] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.871] GetFileType (hFile=0x154) returned 0x1 [0158.871] GetFileType (hFile=0x154) returned 0x1 [0158.871] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2739 [0158.873] CloseHandle (hObject=0x154) returned 1 [0158.901] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx", lpFilePart=0x0) returned 0x67 [0158.901] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.903] GetFileType (hFile=0x154) returned 0x1 [0158.903] GetFileType (hFile=0x154) returned 0x1 [0158.903] WriteFile (in: hFile=0x154, lpBuffer=0x1abcecc*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1abcecc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2740, lpOverlapped=0x0) returned 1 [0158.904] CloseHandle (hObject=0x154) returned 1 [0158.905] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx", lpFilePart=0x0) returned 0x67 [0158.905] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx.anonymous", lpFilePart=0x0) returned 0x71 [0158.905] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x51724220, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfda67490, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2740)) returned 1 [0158.905] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\manageSingleRole.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\roles\\managesinglerole.aspx.anonymous")) returned 1 [0158.906] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources", lpFilePart=0x0) returned 0x64 [0158.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\", lpFilePart=0x0) returned 0x65 [0158.906] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0158.906] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0158.906] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources", lpFilePart=0x0) returned 0x64 [0158.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\", lpFilePart=0x0) returned 0x65 [0158.906] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0158.906] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0158.906] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users", lpFilePart=0x0) returned 0x51 [0158.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\", lpFilePart=0x0) returned 0x52 [0158.906] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0158.914] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0158.915] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users", lpFilePart=0x0) returned 0x51 [0158.915] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\", lpFilePart=0x0) returned 0x52 [0158.915] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0158.916] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0158.917] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx", lpFilePart=0x0) returned 0x5e [0158.917] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.919] GetFileType (hFile=0x154) returned 0x1 [0158.919] GetFileType (hFile=0x154) returned 0x1 [0158.919] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x150e [0158.925] CloseHandle (hObject=0x154) returned 1 [0158.937] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx", lpFilePart=0x0) returned 0x5e [0158.937] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.939] GetFileType (hFile=0x154) returned 0x1 [0158.939] GetFileType (hFile=0x154) returned 0x1 [0158.939] WriteFile (in: hFile=0x154, lpBuffer=0x1b18804*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b18804*, lpNumberOfBytesWritten=0x2ae3f8*=0x1510, lpOverlapped=0x0) returned 1 [0158.940] CloseHandle (hObject=0x154) returned 1 [0158.940] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx", lpFilePart=0x0) returned 0x5e [0158.940] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx.anonymous", lpFilePart=0x0) returned 0x68 [0158.940] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37ce700, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4e5bf9a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdad98b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1510)) returned 1 [0158.940] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\adduser.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\addUser.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\adduser.aspx.anonymous")) returned 1 [0158.941] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx", lpFilePart=0x0) returned 0x5f [0158.941] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.947] GetFileType (hFile=0x154) returned 0x1 [0158.947] GetFileType (hFile=0x154) returned 0x1 [0158.947] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2f41 [0158.959] CloseHandle (hObject=0x154) returned 1 [0158.971] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx", lpFilePart=0x0) returned 0x5f [0158.971] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.973] GetFileType (hFile=0x154) returned 0x1 [0158.973] GetFileType (hFile=0x154) returned 0x1 [0158.973] WriteFile (in: hFile=0x154, lpBuffer=0x1b75cdc*, nNumberOfBytesToWrite=0x2f50, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b75cdc*, lpNumberOfBytesWritten=0x2ae3f8*=0x2f50, lpOverlapped=0x0) returned 1 [0158.974] CloseHandle (hObject=0x154) returned 1 [0158.974] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx", lpFilePart=0x0) returned 0x5f [0158.974] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx.anonymous", lpFilePart=0x0) returned 0x69 [0158.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae1400, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4ebb30a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdb25b70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2f50)) returned 1 [0158.975] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\edituser.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\editUser.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\edituser.aspx.anonymous")) returned 1 [0158.975] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx", lpFilePart=0x0) returned 0x60 [0158.975] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.975] GetFileType (hFile=0x154) returned 0x1 [0158.976] GetFileType (hFile=0x154) returned 0x1 [0158.976] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x20ba [0158.980] CloseHandle (hObject=0x154) returned 1 [0158.995] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx", lpFilePart=0x0) returned 0x60 [0158.995] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.996] GetFileType (hFile=0x154) returned 0x1 [0158.996] GetFileType (hFile=0x154) returned 0x1 [0158.996] WriteFile (in: hFile=0x154, lpBuffer=0x19cf968*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19cf968*, lpNumberOfBytesWritten=0x2ae3f8*=0x20c0, lpOverlapped=0x0) returned 1 [0158.998] CloseHandle (hObject=0x154) returned 1 [0158.998] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx", lpFilePart=0x0) returned 0x60 [0158.998] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx.anonymous", lpFilePart=0x0) returned 0x6a [0158.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae1400, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x4edc83e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdb4bcd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20c0)) returned 1 [0158.998] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\findusers.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\findUsers.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\findusers.aspx.anonymous")) returned 1 [0158.999] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx", lpFilePart=0x0) returned 0x62 [0158.999] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0158.999] GetFileType (hFile=0x154) returned 0x1 [0158.999] GetFileType (hFile=0x154) returned 0x1 [0159.000] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3da8 [0159.009] CloseHandle (hObject=0x154) returned 1 [0159.023] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx", lpFilePart=0x0) returned 0x62 [0159.023] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.024] GetFileType (hFile=0x154) returned 0x1 [0159.024] GetFileType (hFile=0x154) returned 0x1 [0159.024] WriteFile (in: hFile=0x154, lpBuffer=0x1a3234c*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a3234c*, lpNumberOfBytesWritten=0x2ae3f8*=0x3db0, lpOverlapped=0x0) returned 1 [0159.026] CloseHandle (hObject=0x154) returned 1 [0159.026] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx", lpFilePart=0x0) returned 0x62 [0159.026] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx.anonymous", lpFilePart=0x0) returned 0x6c [0159.026] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae1400, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x51796640, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdb97f90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3db0)) returned 1 [0159.026] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\manageusers.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\manageUsers.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\users\\manageusers.aspx.anonymous")) returned 1 [0159.027] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources", lpFilePart=0x0) returned 0x64 [0159.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\", lpFilePart=0x0) returned 0x65 [0159.027] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0159.040] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0159.041] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources", lpFilePart=0x0) returned 0x64 [0159.041] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\", lpFilePart=0x0) returned 0x65 [0159.041] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbea18 [0159.042] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0159.043] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard", lpFilePart=0x0) returned 0x52 [0159.043] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\", lpFilePart=0x0) returned 0x53 [0159.043] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0159.054] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0159.055] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard", lpFilePart=0x0) returned 0x52 [0159.055] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\", lpFilePart=0x0) returned 0x53 [0159.055] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0159.056] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0159.057] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx", lpFilePart=0x0) returned 0x5e [0159.057] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.069] GetFileType (hFile=0x154) returned 0x1 [0159.069] GetFileType (hFile=0x154) returned 0x1 [0159.069] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2ae9 [0159.076] CloseHandle (hObject=0x154) returned 1 [0159.089] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx", lpFilePart=0x0) returned 0x5e [0159.089] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.091] GetFileType (hFile=0x154) returned 0x1 [0159.091] GetFileType (hFile=0x154) returned 0x1 [0159.091] WriteFile (in: hFile=0x154, lpBuffer=0x1a98268*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a98268*, lpNumberOfBytesWritten=0x2ae3f8*=0x2af0, lpOverlapped=0x0) returned 1 [0159.092] CloseHandle (hObject=0x154) returned 1 [0159.092] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx", lpFilePart=0x0) returned 0x5e [0159.092] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx.anonymous", lpFilePart=0x0) returned 0x68 [0159.092] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae1400, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x560566a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdc30510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2af0)) returned 1 [0159.092] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\wizard.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\security\\wizard\\wizard.aspx.anonymous")) returned 1 [0159.093] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources", lpFilePart=0x0) returned 0x65 [0159.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\", lpFilePart=0x0) returned 0x66 [0159.093] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0159.111] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0159.112] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources", nBufferLength=0x105, lpBuffer=0x2adf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources", lpFilePart=0x0) returned 0x65 [0159.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\", nBufferLength=0x105, lpBuffer=0x2adef4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\", lpFilePart=0x0) returned 0x66 [0159.112] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbeb58 [0159.113] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0159.114] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config", lpFilePart=0x0) returned 0x34 [0159.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpFilePart=0x0) returned 0x35 [0159.114] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0159.115] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0159.115] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config", lpFilePart=0x0) returned 0x34 [0159.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpFilePart=0x0) returned 0x35 [0159.115] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbeb58 [0159.116] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0159.116] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", lpFilePart=0x0) returned 0x52 [0159.116] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\defaultwsdlhelpgenerator.aspx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.116] GetFileType (hFile=0x154) returned 0x1 [0159.116] GetFileType (hFile=0x154) returned 0x1 [0159.116] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x1131a [0159.125] CloseHandle (hObject=0x154) returned 1 [0159.139] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", lpFilePart=0x0) returned 0x52 [0159.139] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\defaultwsdlhelpgenerator.aspx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.141] GetFileType (hFile=0x154) returned 0x1 [0159.141] GetFileType (hFile=0x154) returned 0x1 [0159.141] WriteFile (in: hFile=0x154, lpBuffer=0x1b280ec*, nNumberOfBytesToWrite=0x11320, lpNumberOfBytesWritten=0x2ae4e0, lpOverlapped=0x0 | out: lpBuffer=0x1b280ec*, lpNumberOfBytesWritten=0x2ae4e0*=0x11320, lpOverlapped=0x0) returned 1 [0159.143] CloseHandle (hObject=0x154) returned 1 [0159.144] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", lpFilePart=0x0) returned 0x52 [0159.144] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx.anonymous", lpFilePart=0x0) returned 0x5c [0159.144] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\defaultwsdlhelpgenerator.aspx"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9230dc00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x4eace860, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdcc8a90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11320)) returned 1 [0159.144] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\defaultwsdlhelpgenerator.aspx"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\defaultwsdlhelpgenerator.aspx.anonymous")) returned 1 [0159.145] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", lpFilePart=0x0) returned 0x52 [0159.145] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx40_iis_schema_update.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.145] GetFileType (hFile=0x154) returned 0x1 [0159.145] GetFileType (hFile=0x154) returned 0x1 [0159.145] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0xd75 [0159.147] CloseHandle (hObject=0x154) returned 1 [0159.162] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", lpFilePart=0x0) returned 0x52 [0159.162] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx40_iis_schema_update.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.163] GetFileType (hFile=0x154) returned 0x1 [0159.163] GetFileType (hFile=0x154) returned 0x1 [0159.164] WriteFile (in: hFile=0x154, lpBuffer=0x198be08*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x198be08*, lpNumberOfBytesWritten=0x2ae4b4*=0xd80, lpOverlapped=0x0) returned 1 [0159.165] CloseHandle (hObject=0x154) returned 1 [0159.165] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", lpFilePart=0x0) returned 0x52 [0159.165] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml.anonymous", lpFilePart=0x0) returned 0x5c [0159.165] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx40_iis_schema_update.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b24ac00, ftCreationTime.dwHighDateTime=0x1cd0cb8, ftLastAccessTime.dwLowDateTime=0x5256c620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdceebf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xd80)) returned 1 [0159.165] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx40_iis_schema_update.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx40_iis_schema_update.xml.anonymous")) returned 1 [0159.166] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", nBufferLength=0x105, lpBuffer=0x2adf44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", lpFilePart=0x0) returned 0x52 [0159.166] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx45_iis_schema_update.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.167] GetFileType (hFile=0x154) returned 0x1 [0159.167] GetFileType (hFile=0x154) returned 0x1 [0159.167] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae540 | out: lpFileSizeHigh=0x2ae540*=0x0) returned 0x813 [0159.178] CloseHandle (hObject=0x154) returned 1 [0159.189] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", nBufferLength=0x105, lpBuffer=0x2adf30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", lpFilePart=0x0) returned 0x52 [0159.189] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx45_iis_schema_update.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.191] GetFileType (hFile=0x154) returned 0x1 [0159.191] GetFileType (hFile=0x154) returned 0x1 [0159.191] WriteFile (in: hFile=0x154, lpBuffer=0x19de33c*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2ae4b4, lpOverlapped=0x0 | out: lpBuffer=0x19de33c*, lpNumberOfBytesWritten=0x2ae4b4*=0x820, lpOverlapped=0x0) returned 1 [0159.192] CloseHandle (hObject=0x154) returned 1 [0159.192] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", lpFilePart=0x0) returned 0x52 [0159.192] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml.anonymous", lpFilePart=0x0) returned 0x5c [0159.192] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx45_iis_schema_update.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae540 | out: lpFileInformation=0x2ae540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a142000, ftCreationTime.dwHighDateTime=0x1cd439f, ftLastAccessTime.dwLowDateTime=0x5256c620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdd3aeb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x820)) returned 1 [0159.192] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx45_iis_schema_update.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\netfx45_iis_schema_update.xml.anonymous")) returned 1 [0159.193] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers", lpFilePart=0x0) returned 0x3d [0159.193] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpFilePart=0x0) returned 0x3e [0159.193] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0159.195] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.195] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers", lpFilePart=0x0) returned 0x3d [0159.196] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpFilePart=0x0) returned 0x3e [0159.196] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0159.197] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.198] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US", lpFilePart=0x0) returned 0x33 [0159.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpFilePart=0x0) returned 0x34 [0159.198] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.198] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.198] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US", lpFilePart=0x0) returned 0x33 [0159.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpFilePart=0x0) returned 0x34 [0159.198] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.198] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.198] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF", lpFilePart=0x0) returned 0x31 [0159.198] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\", lpFilePart=0x0) returned 0x32 [0159.199] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.210] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.211] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF", lpFilePart=0x0) returned 0x31 [0159.211] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\", lpFilePart=0x0) returned 0x32 [0159.211] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.212] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.214] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild", lpFilePart=0x0) returned 0x35 [0159.214] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\", lpFilePart=0x0) returned 0x36 [0159.214] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.215] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.215] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild", lpFilePart=0x0) returned 0x35 [0159.215] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\", lpFilePart=0x0) returned 0x36 [0159.215] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.215] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.215] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI", lpFilePart=0x0) returned 0x31 [0159.215] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\", lpFilePart=0x0) returned 0x32 [0159.215] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.216] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.216] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI", lpFilePart=0x0) returned 0x31 [0159.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\", lpFilePart=0x0) returned 0x32 [0159.216] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.216] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.216] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409", lpFilePart=0x0) returned 0x36 [0159.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\", lpFilePart=0x0) returned 0x37 [0159.216] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0159.217] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.217] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409", lpFilePart=0x0) returned 0x36 [0159.217] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\", lpFilePart=0x0) returned 0x37 [0159.217] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0159.217] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.217] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache", lpFilePart=0x0) returned 0x38 [0159.217] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\", lpFilePart=0x0) returned 0x39 [0159.217] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.217] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.217] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache", lpFilePart=0x0) returned 0x38 [0159.217] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\", lpFilePart=0x0) returned 0x39 [0159.217] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0159.217] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.218] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081", lpFilePart=0x0) returned 0x43 [0159.218] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\", lpFilePart=0x0) returned 0x44 [0159.218] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0159.220] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.221] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081", lpFilePart=0x0) returned 0x43 [0159.221] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\", lpFilePart=0x0) returned 0x44 [0159.221] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0159.222] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.223] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html", lpFilePart=0x0) returned 0x54 [0159.223] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.224] GetFileType (hFile=0x154) returned 0x1 [0159.224] GetFileType (hFile=0x154) returned 0x1 [0159.224] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3ef6 [0159.233] CloseHandle (hObject=0x154) returned 1 [0159.244] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html", lpFilePart=0x0) returned 0x54 [0159.245] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.246] GetFileType (hFile=0x154) returned 0x1 [0159.246] GetFileType (hFile=0x154) returned 0x1 [0159.246] WriteFile (in: hFile=0x154, lpBuffer=0x1a5913c*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a5913c*, lpNumberOfBytesWritten=0x2ae46c*=0x3f00, lpOverlapped=0x0) returned 1 [0159.247] CloseHandle (hObject=0x154) returned 1 [0159.247] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html", lpFilePart=0x0) returned 0x54 [0159.247] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html.anonymous", lpFilePart=0x0) returned 0x5e [0159.247] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x4fb9b300, ftCreationTime.dwHighDateTime=0x1d09f04, ftLastAccessTime.dwLowDateTime=0x920ad180, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfddad2d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f00)) returned 1 [0159.248] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html.anonymous")) returned 1 [0159.248] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp", lpFilePart=0x0) returned 0x4e [0159.248] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.249] GetFileType (hFile=0x154) returned 0x1 [0159.249] GetFileType (hFile=0x154) returned 0x1 [0159.249] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x25bc [0159.257] CloseHandle (hObject=0x154) returned 1 [0159.268] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp", lpFilePart=0x0) returned 0x4e [0159.268] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.270] GetFileType (hFile=0x154) returned 0x1 [0159.270] GetFileType (hFile=0x154) returned 0x1 [0159.270] WriteFile (in: hFile=0x154, lpBuffer=0x1ab5fdc*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ab5fdc*, lpNumberOfBytesWritten=0x2ae46c*=0x25c0, lpOverlapped=0x0) returned 1 [0159.271] CloseHandle (hObject=0x154) returned 1 [0159.271] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp", lpFilePart=0x0) returned 0x4e [0159.271] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp.anonymous", lpFilePart=0x0) returned 0x58 [0159.271] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x94067e00, ftCreationTime.dwHighDateTime=0x1d06a91, ftLastAccessTime.dwLowDateTime=0x920ad180, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfddf9590, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25c0)) returned 1 [0159.271] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp.anonymous")) returned 1 [0159.272] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml", lpFilePart=0x0) returned 0x55 [0159.272] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.273] GetFileType (hFile=0x154) returned 0x1 [0159.273] GetFileType (hFile=0x154) returned 0x1 [0159.273] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x12936c [0159.276] ReadFile (in: hFile=0x154, lpBuffer=0x28f9b3d0, nNumberOfBytesToRead=0x12936c, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x28f9b3d0*, lpNumberOfBytesRead=0x2ae478*=0x12936c, lpOverlapped=0x0) returned 1 [0159.342] CloseHandle (hObject=0x154) returned 1 [0159.430] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml", lpFilePart=0x0) returned 0x55 [0159.430] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.432] GetFileType (hFile=0x154) returned 0x1 [0159.432] GetFileType (hFile=0x154) returned 0x1 [0159.432] WriteFile (in: hFile=0x154, lpBuffer=0x29569538*, nNumberOfBytesToWrite=0x129370, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x29569538*, lpNumberOfBytesWritten=0x2ae46c*=0x129370, lpOverlapped=0x0) returned 1 [0159.453] CloseHandle (hObject=0x154) returned 1 [0159.454] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml", lpFilePart=0x0) returned 0x55 [0159.454] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml.anonymous", lpFilePart=0x0) returned 0x5f [0159.454] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xaf9ebf00, ftCreationTime.dwHighDateTime=0x1d0ad36, ftLastAccessTime.dwLowDateTime=0x9216b860, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfdfc2610, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x129370)) returned 1 [0159.454] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\parameterinfo.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\ParameterInfo.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\parameterinfo.xml.anonymous")) returned 1 [0159.455] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp", lpFilePart=0x0) returned 0x54 [0159.455] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.456] GetFileType (hFile=0x154) returned 0x1 [0159.456] GetFileType (hFile=0x154) returned 0x1 [0159.456] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1d4f8 [0159.456] ReadFile (in: hFile=0x154, lpBuffer=0x296928c8, nNumberOfBytesToRead=0x1d4f8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x296928c8*, lpNumberOfBytesRead=0x2ae478*=0x1d4f8, lpOverlapped=0x0) returned 1 [0159.470] CloseHandle (hObject=0x154) returned 1 [0159.490] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp", lpFilePart=0x0) returned 0x54 [0159.490] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.492] GetFileType (hFile=0x154) returned 0x1 [0159.492] GetFileType (hFile=0x154) returned 0x1 [0159.492] WriteFile (in: hFile=0x154, lpBuffer=0x29726438*, nNumberOfBytesToWrite=0x1d500, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x29726438*, lpNumberOfBytesWritten=0x2ae46c*=0x1d500, lpOverlapped=0x0) returned 1 [0159.495] CloseHandle (hObject=0x154) returned 1 [0159.495] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp", lpFilePart=0x0) returned 0x54 [0159.495] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp.anonymous", lpFilePart=0x0) returned 0x5e [0159.495] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb7322d00, ftCreationTime.dwHighDateTime=0x1d06a93, ftLastAccessTime.dwLowDateTime=0x921b7b20, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe00e8d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1d500)) returned 1 [0159.495] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp.anonymous")) returned 1 [0159.496] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml", lpFilePart=0x0) returned 0x4f [0159.496] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.496] GetFileType (hFile=0x154) returned 0x1 [0159.496] GetFileType (hFile=0x154) returned 0x1 [0159.496] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x3704 [0159.498] CloseHandle (hObject=0x154) returned 1 [0159.512] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml", lpFilePart=0x0) returned 0x4f [0159.512] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\strings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.514] GetFileType (hFile=0x154) returned 0x1 [0159.514] GetFileType (hFile=0x154) returned 0x1 [0159.514] WriteFile (in: hFile=0x154, lpBuffer=0x19b4748*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19b4748*, lpNumberOfBytesWritten=0x2ae46c*=0x3710, lpOverlapped=0x0) returned 1 [0159.515] CloseHandle (hObject=0x154) returned 1 [0159.515] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml", lpFilePart=0x0) returned 0x4f [0159.515] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml.anonymous", lpFilePart=0x0) returned 0x59 [0159.515] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\strings.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb7322d00, ftCreationTime.dwHighDateTime=0x1d06a93, ftLastAccessTime.dwLowDateTime=0x921b7b20, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe034a30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3710)) returned 1 [0159.515] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\strings.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Strings.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\strings.xml.anonymous")) returned 1 [0159.516] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml", lpFilePart=0x0) returned 0x4e [0159.516] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.517] GetFileType (hFile=0x154) returned 0x1 [0159.517] GetFileType (hFile=0x154) returned 0x1 [0159.517] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x111d0 [0159.526] CloseHandle (hObject=0x154) returned 1 [0159.540] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml", lpFilePart=0x0) returned 0x4e [0159.540] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.542] GetFileType (hFile=0x154) returned 0x1 [0159.542] GetFileType (hFile=0x154) returned 0x1 [0159.542] WriteFile (in: hFile=0x154, lpBuffer=0x1a387f4*, nNumberOfBytesToWrite=0x111e0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a387f4*, lpNumberOfBytesWritten=0x2ae46c*=0x111e0, lpOverlapped=0x0) returned 1 [0159.545] CloseHandle (hObject=0x154) returned 1 [0159.545] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml", lpFilePart=0x0) returned 0x4e [0159.546] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml.anonymous", lpFilePart=0x0) returned 0x58 [0159.546] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xb7322d00, ftCreationTime.dwHighDateTime=0x1d06a93, ftLastAccessTime.dwLowDateTime=0x921ddc80, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe080cf0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x111e0)) returned 1 [0159.546] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\uiinfo.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\UiInfo.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\uiinfo.xml.anonymous")) returned 1 [0159.547] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp", lpFilePart=0x0) returned 0x51 [0159.547] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.548] GetFileType (hFile=0x154) returned 0x1 [0159.548] GetFileType (hFile=0x154) returned 0x1 [0159.548] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x19688 [0159.548] ReadFile (in: hFile=0x154, lpBuffer=0x29765d18, nNumberOfBytesToRead=0x19688, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x29765d18*, lpNumberOfBytesRead=0x2ae478*=0x19688, lpOverlapped=0x0) returned 1 [0159.554] CloseHandle (hObject=0x154) returned 1 [0159.577] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp", lpFilePart=0x0) returned 0x51 [0159.577] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.582] GetFileType (hFile=0x154) returned 0x1 [0159.582] GetFileType (hFile=0x154) returned 0x1 [0159.582] WriteFile (in: hFile=0x154, lpBuffer=0x297e4e20*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x297e4e20*, lpNumberOfBytesWritten=0x2ae46c*=0x19690, lpOverlapped=0x0) returned 1 [0159.589] CloseHandle (hObject=0x154) returned 1 [0159.589] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp", lpFilePart=0x0) returned 0x51 [0159.589] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp.anonymous", lpFilePart=0x0) returned 0x5b [0159.589] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x94067e00, ftCreationTime.dwHighDateTime=0x1d06a91, ftLastAccessTime.dwLowDateTime=0x921ddc80, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe0f3110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x19690)) returned 1 [0159.589] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp.anonymous")) returned 1 [0159.590] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025", lpFilePart=0x0) returned 0x48 [0159.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\", lpFilePart=0x0) returned 0x49 [0159.590] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0159.592] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0159.592] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025", lpFilePart=0x0) returned 0x48 [0159.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\", lpFilePart=0x0) returned 0x49 [0159.592] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0159.592] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0159.592] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.592] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.593] GetFileType (hFile=0x154) returned 0x1 [0159.593] GetFileType (hFile=0x154) returned 0x1 [0159.593] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1e64f [0159.594] ReadFile (in: hFile=0x154, lpBuffer=0x297fe4d0, nNumberOfBytesToRead=0x1e64f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x297fe4d0*, lpNumberOfBytesRead=0x2ae404*=0x1e64f, lpOverlapped=0x0) returned 1 [0159.613] CloseHandle (hObject=0x154) returned 1 [0159.633] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.633] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.635] GetFileType (hFile=0x154) returned 0x1 [0159.635] GetFileType (hFile=0x154) returned 0x1 [0159.636] WriteFile (in: hFile=0x154, lpBuffer=0x298964a0*, nNumberOfBytesToWrite=0x1e650, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x298964a0*, lpNumberOfBytesWritten=0x2ae3f8*=0x1e650, lpOverlapped=0x0) returned 1 [0159.639] CloseHandle (hObject=0x154) returned 1 [0159.639] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.639] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0159.640] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e8e2de0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe165530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1e650)) returned 1 [0159.640] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\eula.rtf.anonymous")) returned 1 [0159.646] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.646] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.646] GetFileType (hFile=0x154) returned 0x1 [0159.646] GetFileType (hFile=0x154) returned 0x1 [0159.646] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13166 [0159.669] CloseHandle (hObject=0x154) returned 1 [0159.683] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.683] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.685] GetFileType (hFile=0x154) returned 0x1 [0159.685] GetFileType (hFile=0x154) returned 0x1 [0159.685] WriteFile (in: hFile=0x154, lpBuffer=0x1b6c898*, nNumberOfBytesToWrite=0x13170, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b6c898*, lpNumberOfBytesWritten=0x2ae3f8*=0x13170, lpOverlapped=0x0) returned 1 [0159.687] CloseHandle (hObject=0x154) returned 1 [0159.687] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.687] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0159.687] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe1d7950, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13170)) returned 1 [0159.687] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1025\\localizeddata.xml.anonymous")) returned 1 [0159.688] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028", lpFilePart=0x0) returned 0x48 [0159.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\", lpFilePart=0x0) returned 0x49 [0159.688] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0159.689] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0159.689] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028", lpFilePart=0x0) returned 0x48 [0159.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\", lpFilePart=0x0) returned 0x49 [0159.689] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf118 [0159.689] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0159.689] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.689] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.689] GetFileType (hFile=0x154) returned 0x1 [0159.689] GetFileType (hFile=0x154) returned 0x1 [0159.689] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x27227 [0159.690] ReadFile (in: hFile=0x154, lpBuffer=0x298dadf0, nNumberOfBytesToRead=0x27227, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x298dadf0*, lpNumberOfBytesRead=0x2ae404*=0x27227, lpOverlapped=0x0) returned 1 [0159.718] CloseHandle (hObject=0x154) returned 1 [0159.747] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.747] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.749] GetFileType (hFile=0x154) returned 0x1 [0159.749] GetFileType (hFile=0x154) returned 0x1 [0159.749] WriteFile (in: hFile=0x154, lpBuffer=0x2999e918*, nNumberOfBytesToWrite=0x27230, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2999e918*, lpNumberOfBytesWritten=0x2ae3f8*=0x27230, lpOverlapped=0x0) returned 1 [0159.753] CloseHandle (hObject=0x154) returned 1 [0159.753] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.753] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0159.753] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e908f40, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe296030, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x27230)) returned 1 [0159.753] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\eula.rtf.anonymous")) returned 1 [0159.755] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.755] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.755] GetFileType (hFile=0x154) returned 0x1 [0159.755] GetFileType (hFile=0x154) returned 0x1 [0159.755] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x107aa [0159.777] CloseHandle (hObject=0x154) returned 1 [0159.791] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.791] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.793] GetFileType (hFile=0x154) returned 0x1 [0159.793] GetFileType (hFile=0x154) returned 0x1 [0159.793] WriteFile (in: hFile=0x154, lpBuffer=0x1a4a684*, nNumberOfBytesToWrite=0x107b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a4a684*, lpNumberOfBytesWritten=0x2ae3f8*=0x107b0, lpOverlapped=0x0) returned 1 [0159.795] CloseHandle (hObject=0x154) returned 1 [0159.795] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.795] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0159.795] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe2e22f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x107b0)) returned 1 [0159.795] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1028\\localizeddata.xml.anonymous")) returned 1 [0159.796] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029", lpFilePart=0x0) returned 0x48 [0159.796] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\", lpFilePart=0x0) returned 0x49 [0159.796] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0159.796] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0159.797] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029", lpFilePart=0x0) returned 0x48 [0159.797] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\", lpFilePart=0x0) returned 0x49 [0159.797] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0159.797] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0159.797] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.797] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.798] GetFileType (hFile=0x154) returned 0x1 [0159.798] GetFileType (hFile=0x154) returned 0x1 [0159.798] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x204fc [0159.798] ReadFile (in: hFile=0x154, lpBuffer=0x299e6ac8, nNumberOfBytesToRead=0x204fc, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x299e6ac8*, lpNumberOfBytesRead=0x2ae404*=0x204fc, lpOverlapped=0x0) returned 1 [0159.823] CloseHandle (hObject=0x154) returned 1 [0159.843] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.844] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.847] GetFileType (hFile=0x154) returned 0x1 [0159.847] GetFileType (hFile=0x154) returned 0x1 [0159.847] WriteFile (in: hFile=0x154, lpBuffer=0x29a88400*, nNumberOfBytesToWrite=0x20500, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29a88400*, lpNumberOfBytesWritten=0x2ae3f8*=0x20500, lpOverlapped=0x0) returned 1 [0159.852] CloseHandle (hObject=0x154) returned 1 [0159.852] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.852] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0159.853] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e908f40, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe37a870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20500)) returned 1 [0159.853] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\eula.rtf.anonymous")) returned 1 [0159.855] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.855] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.855] GetFileType (hFile=0x154) returned 0x1 [0159.855] GetFileType (hFile=0x154) returned 0x1 [0159.855] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14740 [0159.897] CloseHandle (hObject=0x154) returned 1 [0159.911] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.911] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.913] GetFileType (hFile=0x154) returned 0x1 [0159.913] GetFileType (hFile=0x154) returned 0x1 [0159.913] WriteFile (in: hFile=0x154, lpBuffer=0x1b34c4c*, nNumberOfBytesToWrite=0x14750, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b34c4c*, lpNumberOfBytesWritten=0x2ae3f8*=0x14750, lpOverlapped=0x0) returned 1 [0159.915] CloseHandle (hObject=0x154) returned 1 [0159.915] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.915] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0159.915] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe412df0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14750)) returned 1 [0159.915] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1029\\localizeddata.xml.anonymous")) returned 1 [0159.916] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030", lpFilePart=0x0) returned 0x48 [0159.916] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\", lpFilePart=0x0) returned 0x49 [0159.916] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0159.917] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.917] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030", lpFilePart=0x0) returned 0x48 [0159.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\", lpFilePart=0x0) returned 0x49 [0159.917] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0159.917] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0159.917] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.917] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.917] GetFileType (hFile=0x154) returned 0x1 [0159.917] GetFileType (hFile=0x154) returned 0x1 [0159.917] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x20235 [0159.918] ReadFile (in: hFile=0x154, lpBuffer=0x29ad17c0, nNumberOfBytesToRead=0x20235, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29ad17c0*, lpNumberOfBytesRead=0x2ae404*=0x20235, lpOverlapped=0x0) returned 1 [0159.923] CloseHandle (hObject=0x154) returned 1 [0159.947] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.947] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.949] GetFileType (hFile=0x154) returned 0x1 [0159.949] GetFileType (hFile=0x154) returned 0x1 [0159.949] WriteFile (in: hFile=0x154, lpBuffer=0x29b72338*, nNumberOfBytesToWrite=0x20240, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29b72338*, lpNumberOfBytesWritten=0x2ae3f8*=0x20240, lpOverlapped=0x0) returned 1 [0159.959] CloseHandle (hObject=0x154) returned 1 [0159.959] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.959] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0159.959] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e908f40, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe485210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x20240)) returned 1 [0159.960] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\eula.rtf.anonymous")) returned 1 [0159.962] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.962] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.963] GetFileType (hFile=0x154) returned 0x1 [0159.963] GetFileType (hFile=0x154) returned 0x1 [0159.963] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13e36 [0159.975] CloseHandle (hObject=0x154) returned 1 [0159.989] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.989] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.991] GetFileType (hFile=0x154) returned 0x1 [0159.991] GetFileType (hFile=0x154) returned 0x1 [0159.991] WriteFile (in: hFile=0x154, lpBuffer=0x1a217f4*, nNumberOfBytesToWrite=0x13e40, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a217f4*, lpNumberOfBytesWritten=0x2ae3f8*=0x13e40, lpOverlapped=0x0) returned 1 [0159.993] CloseHandle (hObject=0x154) returned 1 [0159.993] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0159.993] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0159.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe4d14d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13e40)) returned 1 [0159.994] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1030\\localizeddata.xml.anonymous")) returned 1 [0159.994] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031", lpFilePart=0x0) returned 0x48 [0159.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\", lpFilePart=0x0) returned 0x49 [0159.994] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0159.995] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0159.995] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031", lpFilePart=0x0) returned 0x48 [0159.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\", lpFilePart=0x0) returned 0x49 [0159.995] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0159.995] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0159.995] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf", lpFilePart=0x0) returned 0x51 [0159.995] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0159.996] GetFileType (hFile=0x154) returned 0x1 [0159.996] GetFileType (hFile=0x154) returned 0x1 [0159.996] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1b252 [0159.996] ReadFile (in: hFile=0x154, lpBuffer=0x29bba218, nNumberOfBytesToRead=0x1b252, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29bba218*, lpNumberOfBytesRead=0x2ae404*=0x1b252, lpOverlapped=0x0) returned 1 [0160.038] CloseHandle (hObject=0x154) returned 1 [0160.057] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.057] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.059] GetFileType (hFile=0x154) returned 0x1 [0160.059] GetFileType (hFile=0x154) returned 0x1 [0160.059] WriteFile (in: hFile=0x154, lpBuffer=0x29c41e28*, nNumberOfBytesToWrite=0x1b260, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29c41e28*, lpNumberOfBytesWritten=0x2ae3f8*=0x1b260, lpOverlapped=0x0) returned 1 [0160.062] CloseHandle (hObject=0x154) returned 1 [0160.062] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.062] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0160.062] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e97b360, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe58fbb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1b260)) returned 1 [0160.063] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\eula.rtf.anonymous")) returned 1 [0160.066] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.066] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.067] GetFileType (hFile=0x154) returned 0x1 [0160.067] GetFileType (hFile=0x154) returned 0x1 [0160.067] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14f40 [0160.067] ReadFile (in: hFile=0x154, lpBuffer=0x25698858, nNumberOfBytesToRead=0x14f40, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x25698858*, lpNumberOfBytesRead=0x2ae404*=0x14f40, lpOverlapped=0x0) returned 1 [0160.109] CloseHandle (hObject=0x154) returned 1 [0160.126] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.126] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.129] GetFileType (hFile=0x154) returned 0x1 [0160.129] GetFileType (hFile=0x154) returned 0x1 [0160.129] WriteFile (in: hFile=0x154, lpBuffer=0x29cb0e08*, nNumberOfBytesToWrite=0x14f50, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29cb0e08*, lpNumberOfBytesWritten=0x2ae3f8*=0x14f50, lpOverlapped=0x0) returned 1 [0160.133] CloseHandle (hObject=0x154) returned 1 [0160.133] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.133] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0160.133] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe628130, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14f50)) returned 1 [0160.133] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1031\\localizeddata.xml.anonymous")) returned 1 [0160.134] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032", lpFilePart=0x0) returned 0x48 [0160.134] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\", lpFilePart=0x0) returned 0x49 [0160.134] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef98 [0160.135] FindClose (in: hFindFile=0xbef98 | out: hFindFile=0xbef98) returned 1 [0160.135] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032", lpFilePart=0x0) returned 0x48 [0160.135] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\", lpFilePart=0x0) returned 0x49 [0160.135] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef98 [0160.135] FindClose (in: hFindFile=0xbef98 | out: hFindFile=0xbef98) returned 1 [0160.135] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.135] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.135] GetFileType (hFile=0x154) returned 0x1 [0160.135] GetFileType (hFile=0x154) returned 0x1 [0160.135] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x22ad9 [0160.136] ReadFile (in: hFile=0x154, lpBuffer=0x29cc5d78, nNumberOfBytesToRead=0x22ad9, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29cc5d78*, lpNumberOfBytesRead=0x2ae404*=0x22ad9, lpOverlapped=0x0) returned 1 [0160.154] CloseHandle (hObject=0x154) returned 1 [0160.178] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.178] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.181] GetFileType (hFile=0x154) returned 0x1 [0160.181] GetFileType (hFile=0x154) returned 0x1 [0160.181] WriteFile (in: hFile=0x154, lpBuffer=0x29d73410*, nNumberOfBytesToWrite=0x22ae0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29d73410*, lpNumberOfBytesWritten=0x2ae3f8*=0x22ae0, lpOverlapped=0x0) returned 1 [0160.184] CloseHandle (hObject=0x154) returned 1 [0160.184] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.184] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0160.184] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e9c7620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe69a550, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x22ae0)) returned 1 [0160.185] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\eula.rtf.anonymous")) returned 1 [0160.187] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.187] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.188] GetFileType (hFile=0x154) returned 0x1 [0160.188] GetFileType (hFile=0x154) returned 0x1 [0160.188] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x156ee [0160.188] ReadFile (in: hFile=0x154, lpBuffer=0x29d95f10, nNumberOfBytesToRead=0x156ee, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29d95f10*, lpNumberOfBytesRead=0x2ae404*=0x156ee, lpOverlapped=0x0) returned 1 [0160.210] CloseHandle (hObject=0x154) returned 1 [0160.231] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.231] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.239] GetFileType (hFile=0x154) returned 0x1 [0160.239] GetFileType (hFile=0x154) returned 0x1 [0160.239] WriteFile (in: hFile=0x154, lpBuffer=0x29e01200*, nNumberOfBytesToWrite=0x156f0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29e01200*, lpNumberOfBytesWritten=0x2ae3f8*=0x156f0, lpOverlapped=0x0) returned 1 [0160.245] CloseHandle (hObject=0x154) returned 1 [0160.245] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.245] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0160.245] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe732ad0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x156f0)) returned 1 [0160.245] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1032\\localizeddata.xml.anonymous")) returned 1 [0160.246] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033", lpFilePart=0x0) returned 0x48 [0160.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\", lpFilePart=0x0) returned 0x49 [0160.246] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0160.247] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0160.247] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033", lpFilePart=0x0) returned 0x48 [0160.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\", lpFilePart=0x0) returned 0x49 [0160.247] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0160.247] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0160.247] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.247] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.247] GetFileType (hFile=0x154) returned 0x1 [0160.247] GetFileType (hFile=0x154) returned 0x1 [0160.247] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1f53a [0160.248] ReadFile (in: hFile=0x154, lpBuffer=0x29e16910, nNumberOfBytesToRead=0x1f53a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29e16910*, lpNumberOfBytesRead=0x2ae404*=0x1f53a, lpOverlapped=0x0) returned 1 [0160.274] CloseHandle (hObject=0x154) returned 1 [0160.296] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.296] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.298] GetFileType (hFile=0x154) returned 0x1 [0160.298] GetFileType (hFile=0x154) returned 0x1 [0160.298] WriteFile (in: hFile=0x154, lpBuffer=0x29eb3388*, nNumberOfBytesToWrite=0x1f540, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29eb3388*, lpNumberOfBytesWritten=0x2ae3f8*=0x1f540, lpOverlapped=0x0) returned 1 [0160.301] CloseHandle (hObject=0x154) returned 1 [0160.301] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.301] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0160.302] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e9c7620, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe7cb050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1f540)) returned 1 [0160.302] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\eula.rtf.anonymous")) returned 1 [0160.361] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.361] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.362] GetFileType (hFile=0x154) returned 0x1 [0160.362] GetFileType (hFile=0x154) returned 0x1 [0160.362] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13d18 [0160.370] CloseHandle (hObject=0x154) returned 1 [0160.396] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.396] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.398] GetFileType (hFile=0x154) returned 0x1 [0160.398] GetFileType (hFile=0x154) returned 0x1 [0160.398] WriteFile (in: hFile=0x154, lpBuffer=0x1a46764*, nNumberOfBytesToWrite=0x13d20, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a46764*, lpNumberOfBytesWritten=0x2ae3f8*=0x13d20, lpOverlapped=0x0) returned 1 [0160.400] CloseHandle (hObject=0x154) returned 1 [0160.400] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.400] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0160.400] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe8af890, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13d20)) returned 1 [0160.400] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1033\\localizeddata.xml.anonymous")) returned 1 [0160.401] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035", lpFilePart=0x0) returned 0x48 [0160.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\", lpFilePart=0x0) returned 0x49 [0160.401] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0160.402] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0160.402] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035", lpFilePart=0x0) returned 0x48 [0160.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\", lpFilePart=0x0) returned 0x49 [0160.402] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0160.402] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0160.402] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.402] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.402] GetFileType (hFile=0x154) returned 0x1 [0160.402] GetFileType (hFile=0x154) returned 0x1 [0160.402] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2181f [0160.403] ReadFile (in: hFile=0x154, lpBuffer=0x29efa328, nNumberOfBytesToRead=0x2181f, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29efa328*, lpNumberOfBytesRead=0x2ae404*=0x2181f, lpOverlapped=0x0) returned 1 [0160.433] CloseHandle (hObject=0x154) returned 1 [0160.470] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.470] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.472] GetFileType (hFile=0x154) returned 0x1 [0160.472] GetFileType (hFile=0x154) returned 0x1 [0160.472] WriteFile (in: hFile=0x154, lpBuffer=0x29fa1c08*, nNumberOfBytesToWrite=0x21820, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x29fa1c08*, lpNumberOfBytesWritten=0x2ae3f8*=0x21820, lpOverlapped=0x0) returned 1 [0160.475] CloseHandle (hObject=0x154) returned 1 [0160.475] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.475] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0160.475] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8e9ed780, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfe96df70, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21820)) returned 1 [0160.475] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\eula.rtf.anonymous")) returned 1 [0160.533] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.533] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.534] GetFileType (hFile=0x154) returned 0x1 [0160.534] GetFileType (hFile=0x154) returned 0x1 [0160.534] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14044 [0160.547] CloseHandle (hObject=0x154) returned 1 [0160.566] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.566] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.567] GetFileType (hFile=0x154) returned 0x1 [0160.568] GetFileType (hFile=0x154) returned 0x1 [0160.568] WriteFile (in: hFile=0x154, lpBuffer=0x1b32d9c*, nNumberOfBytesToWrite=0x14050, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b32d9c*, lpNumberOfBytesWritten=0x2ae3f8*=0x14050, lpOverlapped=0x0) returned 1 [0160.570] CloseHandle (hObject=0x154) returned 1 [0160.570] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.570] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0160.570] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfea527b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14050)) returned 1 [0160.570] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1035\\localizeddata.xml.anonymous")) returned 1 [0160.571] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036", lpFilePart=0x0) returned 0x48 [0160.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\", lpFilePart=0x0) returned 0x49 [0160.571] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0160.572] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0160.572] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036", lpFilePart=0x0) returned 0x48 [0160.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\", lpFilePart=0x0) returned 0x49 [0160.572] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe8d8 [0160.572] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0160.572] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.572] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.572] GetFileType (hFile=0x154) returned 0x1 [0160.572] GetFileType (hFile=0x154) returned 0x1 [0160.572] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x26318 [0160.573] ReadFile (in: hFile=0x154, lpBuffer=0x29feb4e8, nNumberOfBytesToRead=0x26318, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x29feb4e8*, lpNumberOfBytesRead=0x2ae404*=0x26318, lpOverlapped=0x0) returned 1 [0160.603] CloseHandle (hObject=0x154) returned 1 [0160.640] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.640] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.642] GetFileType (hFile=0x154) returned 0x1 [0160.642] GetFileType (hFile=0x154) returned 0x1 [0160.642] WriteFile (in: hFile=0x154, lpBuffer=0x2a0aa4c0*, nNumberOfBytesToWrite=0x26320, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a0aa4c0*, lpNumberOfBytesWritten=0x2ae3f8*=0x26320, lpOverlapped=0x0) returned 1 [0160.645] CloseHandle (hObject=0x154) returned 1 [0160.646] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.646] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0160.646] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8ea39a40, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfeb10e90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26320)) returned 1 [0160.646] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\eula.rtf.anonymous")) returned 1 [0160.662] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.662] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.662] GetFileType (hFile=0x154) returned 0x1 [0160.662] GetFileType (hFile=0x154) returned 0x1 [0160.662] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14f02 [0160.662] ReadFile (in: hFile=0x154, lpBuffer=0x2a0d0800, nNumberOfBytesToRead=0x14f02, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a0d0800*, lpNumberOfBytesRead=0x2ae404*=0x14f02, lpOverlapped=0x0) returned 1 [0160.673] CloseHandle (hObject=0x154) returned 1 [0160.691] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.691] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.693] GetFileType (hFile=0x154) returned 0x1 [0160.693] GetFileType (hFile=0x154) returned 0x1 [0160.693] WriteFile (in: hFile=0x154, lpBuffer=0x2a139380*, nNumberOfBytesToWrite=0x14f10, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a139380*, lpNumberOfBytesWritten=0x2ae3f8*=0x14f10, lpOverlapped=0x0) returned 1 [0160.695] CloseHandle (hObject=0x154) returned 1 [0160.695] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.695] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0160.695] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfeb832b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14f10)) returned 1 [0160.695] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1036\\localizeddata.xml.anonymous")) returned 1 [0160.696] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037", lpFilePart=0x0) returned 0x48 [0160.696] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\", lpFilePart=0x0) returned 0x49 [0160.696] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0160.697] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0160.697] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037", lpFilePart=0x0) returned 0x48 [0160.697] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\", lpFilePart=0x0) returned 0x49 [0160.697] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0160.697] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0160.697] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.697] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.698] GetFileType (hFile=0x154) returned 0x1 [0160.698] GetFileType (hFile=0x154) returned 0x1 [0160.698] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23bd8 [0160.698] ReadFile (in: hFile=0x154, lpBuffer=0x2a14e2b0, nNumberOfBytesToRead=0x23bd8, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a14e2b0*, lpNumberOfBytesRead=0x2ae404*=0x23bd8, lpOverlapped=0x0) returned 1 [0160.721] CloseHandle (hObject=0x154) returned 1 [0160.743] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.743] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.745] GetFileType (hFile=0x154) returned 0x1 [0160.745] GetFileType (hFile=0x154) returned 0x1 [0160.746] WriteFile (in: hFile=0x154, lpBuffer=0x2a200e48*, nNumberOfBytesToWrite=0x23be0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a200e48*, lpNumberOfBytesWritten=0x2ae3f8*=0x23be0, lpOverlapped=0x0) returned 1 [0160.749] CloseHandle (hObject=0x154) returned 1 [0160.749] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.749] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0160.749] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8ea5fba0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfec1b830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x23be0)) returned 1 [0160.749] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\eula.rtf.anonymous")) returned 1 [0160.773] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.773] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.774] GetFileType (hFile=0x154) returned 0x1 [0160.774] GetFileType (hFile=0x154) returned 0x1 [0160.774] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x12b7c [0160.786] CloseHandle (hObject=0x154) returned 1 [0160.801] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.801] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.803] GetFileType (hFile=0x154) returned 0x1 [0160.803] GetFileType (hFile=0x154) returned 0x1 [0160.803] WriteFile (in: hFile=0x154, lpBuffer=0x1ab81fc*, nNumberOfBytesToWrite=0x12b80, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ab81fc*, lpNumberOfBytesWritten=0x2ae3f8*=0x12b80, lpOverlapped=0x0) returned 1 [0160.806] CloseHandle (hObject=0x154) returned 1 [0160.806] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0160.806] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0160.806] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfec8dc50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x12b80)) returned 1 [0160.806] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1037\\localizeddata.xml.anonymous")) returned 1 [0160.807] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038", lpFilePart=0x0) returned 0x48 [0160.807] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\", lpFilePart=0x0) returned 0x49 [0160.807] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0160.807] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0160.808] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038", lpFilePart=0x0) returned 0x48 [0160.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\", lpFilePart=0x0) returned 0x49 [0160.808] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0160.808] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0160.808] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf", lpFilePart=0x0) returned 0x51 [0160.808] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0160.808] GetFileType (hFile=0x154) returned 0x1 [0160.808] GetFileType (hFile=0x154) returned 0x1 [0160.808] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x26ad4 [0160.809] ReadFile (in: hFile=0x154, lpBuffer=0x2a24a148, nNumberOfBytesToRead=0x26ad4, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a24a148*, lpNumberOfBytesRead=0x2ae404*=0x26ad4, lpOverlapped=0x0) returned 1 [0161.052] CloseHandle (hObject=0x154) returned 1 [0161.074] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.074] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.078] GetFileType (hFile=0x154) returned 0x1 [0161.078] GetFileType (hFile=0x154) returned 0x1 [0161.078] WriteFile (in: hFile=0x154, lpBuffer=0x2a30b7d8*, nNumberOfBytesToWrite=0x26ae0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a30b7d8*, lpNumberOfBytesWritten=0x2ae3f8*=0x26ae0, lpOverlapped=0x0) returned 1 [0161.081] CloseHandle (hObject=0x154) returned 1 [0161.081] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.081] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.081] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8ea5fba0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfef3b510, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x26ae0)) returned 1 [0161.081] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\eula.rtf.anonymous")) returned 1 [0161.093] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.093] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.094] GetFileType (hFile=0x154) returned 0x1 [0161.094] GetFileType (hFile=0x154) returned 0x1 [0161.094] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14a66 [0161.097] CloseHandle (hObject=0x154) returned 1 [0161.114] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.114] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.115] GetFileType (hFile=0x154) returned 0x1 [0161.116] GetFileType (hFile=0x154) returned 0x1 [0161.116] WriteFile (in: hFile=0x154, lpBuffer=0x19c4ea0*, nNumberOfBytesToWrite=0x14a70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x19c4ea0*, lpNumberOfBytesWritten=0x2ae3f8*=0x14a70, lpOverlapped=0x0) returned 1 [0161.118] CloseHandle (hObject=0x154) returned 1 [0161.118] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.118] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.118] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfef877d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14a70)) returned 1 [0161.118] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1038\\localizeddata.xml.anonymous")) returned 1 [0161.119] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040", lpFilePart=0x0) returned 0x48 [0161.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\", lpFilePart=0x0) returned 0x49 [0161.119] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0161.119] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0161.119] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040", lpFilePart=0x0) returned 0x48 [0161.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\", lpFilePart=0x0) returned 0x49 [0161.119] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbef18 [0161.119] FindClose (in: hFindFile=0xbef18 | out: hFindFile=0xbef18) returned 1 [0161.120] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.120] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.120] GetFileType (hFile=0x154) returned 0x1 [0161.120] GetFileType (hFile=0x154) returned 0x1 [0161.120] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23f4b [0161.121] ReadFile (in: hFile=0x154, lpBuffer=0x2a35b7b8, nNumberOfBytesToRead=0x23f4b, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a35b7b8*, lpNumberOfBytesRead=0x2ae404*=0x23f4b, lpOverlapped=0x0) returned 1 [0161.171] CloseHandle (hObject=0x154) returned 1 [0161.192] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.192] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.195] GetFileType (hFile=0x154) returned 0x1 [0161.195] GetFileType (hFile=0x154) returned 0x1 [0161.195] WriteFile (in: hFile=0x154, lpBuffer=0x2a40f480*, nNumberOfBytesToWrite=0x23f50, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a40f480*, lpNumberOfBytesWritten=0x2ae3f8*=0x23f50, lpOverlapped=0x0) returned 1 [0161.198] CloseHandle (hObject=0x154) returned 1 [0161.198] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.198] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.198] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8ea5fba0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff045eb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x23f50)) returned 1 [0161.198] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\eula.rtf.anonymous")) returned 1 [0161.200] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.200] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.200] GetFileType (hFile=0x154) returned 0x1 [0161.200] GetFileType (hFile=0x154) returned 0x1 [0161.201] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x146dc [0161.210] CloseHandle (hObject=0x154) returned 1 [0161.225] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.225] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.227] GetFileType (hFile=0x154) returned 0x1 [0161.227] GetFileType (hFile=0x154) returned 0x1 [0161.227] WriteFile (in: hFile=0x154, lpBuffer=0x1ab3738*, nNumberOfBytesToWrite=0x146e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1ab3738*, lpNumberOfBytesWritten=0x2ae3f8*=0x146e0, lpOverlapped=0x0) returned 1 [0161.230] CloseHandle (hObject=0x154) returned 1 [0161.230] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.230] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.230] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff092170, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x146e0)) returned 1 [0161.231] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1040\\localizeddata.xml.anonymous")) returned 1 [0161.232] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041", lpFilePart=0x0) returned 0x48 [0161.232] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\", lpFilePart=0x0) returned 0x49 [0161.232] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0161.233] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0161.233] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041", lpFilePart=0x0) returned 0x48 [0161.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\", lpFilePart=0x0) returned 0x49 [0161.233] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0161.233] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0161.233] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.233] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.233] GetFileType (hFile=0x154) returned 0x1 [0161.233] GetFileType (hFile=0x154) returned 0x1 [0161.233] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x25fe0 [0161.234] ReadFile (in: hFile=0x154, lpBuffer=0x2a45c1b0, nNumberOfBytesToRead=0x25fe0, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a45c1b0*, lpNumberOfBytesRead=0x2ae404*=0x25fe0, lpOverlapped=0x0) returned 1 [0161.250] CloseHandle (hObject=0x154) returned 1 [0161.275] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.275] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.278] GetFileType (hFile=0x154) returned 0x1 [0161.278] GetFileType (hFile=0x154) returned 0x1 [0161.279] WriteFile (in: hFile=0x154, lpBuffer=0x2a51a190*, nNumberOfBytesToWrite=0x25ff0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a51a190*, lpNumberOfBytesWritten=0x2ae3f8*=0x25ff0, lpOverlapped=0x0) returned 1 [0161.283] CloseHandle (hObject=0x154) returned 1 [0161.283] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.283] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.283] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8ea85d00, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff12a6f0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25ff0)) returned 1 [0161.283] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\eula.rtf.anonymous")) returned 1 [0161.286] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.286] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.287] GetFileType (hFile=0x154) returned 0x1 [0161.287] GetFileType (hFile=0x154) returned 0x1 [0161.287] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x11e0e [0161.371] CloseHandle (hObject=0x154) returned 1 [0161.385] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.385] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.387] GetFileType (hFile=0x154) returned 0x1 [0161.387] GetFileType (hFile=0x154) returned 0x1 [0161.387] WriteFile (in: hFile=0x154, lpBuffer=0x1b9a080*, nNumberOfBytesToWrite=0x11e10, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b9a080*, lpNumberOfBytesWritten=0x2ae3f8*=0x11e10, lpOverlapped=0x0) returned 1 [0161.390] CloseHandle (hObject=0x154) returned 1 [0161.390] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.390] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff235090, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x11e10)) returned 1 [0161.391] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1041\\localizeddata.xml.anonymous")) returned 1 [0161.391] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042", lpFilePart=0x0) returned 0x48 [0161.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\", lpFilePart=0x0) returned 0x49 [0161.391] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0161.392] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0161.392] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042", lpFilePart=0x0) returned 0x48 [0161.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\", lpFilePart=0x0) returned 0x49 [0161.392] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf2d8 [0161.392] FindClose (in: hFindFile=0xbf2d8 | out: hFindFile=0xbf2d8) returned 1 [0161.392] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.392] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.393] GetFileType (hFile=0x154) returned 0x1 [0161.393] GetFileType (hFile=0x154) returned 0x1 [0161.393] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x3f568 [0161.394] ReadFile (in: hFile=0x154, lpBuffer=0x2a563dc0, nNumberOfBytesToRead=0x3f568, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a563dc0*, lpNumberOfBytesRead=0x2ae404*=0x3f568, lpOverlapped=0x0) returned 1 [0161.447] CloseHandle (hObject=0x154) returned 1 [0161.502] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.502] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.505] GetFileType (hFile=0x154) returned 0x1 [0161.505] GetFileType (hFile=0x154) returned 0x1 [0161.505] WriteFile (in: hFile=0x154, lpBuffer=0x2a6b1018*, nNumberOfBytesToWrite=0x3f570, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a6b1018*, lpNumberOfBytesWritten=0x2ae3f8*=0x3f570, lpOverlapped=0x0) returned 1 [0161.509] CloseHandle (hObject=0x154) returned 1 [0161.509] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.509] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.509] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eaabe60, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff33fa30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x3f570)) returned 1 [0161.510] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\eula.rtf.anonymous")) returned 1 [0161.511] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.511] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.512] GetFileType (hFile=0x154) returned 0x1 [0161.512] GetFileType (hFile=0x154) returned 0x1 [0161.512] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x117a2 [0161.513] ReadFile (in: hFile=0x154, lpBuffer=0x1bfb8c0, nNumberOfBytesToRead=0x117a2, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1bfb8c0*, lpNumberOfBytesRead=0x2ae404*=0x117a2, lpOverlapped=0x0) returned 1 [0161.540] CloseHandle (hObject=0x154) returned 1 [0161.577] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.577] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.579] GetFileType (hFile=0x154) returned 0x1 [0161.579] GetFileType (hFile=0x154) returned 0x1 [0161.579] WriteFile (in: hFile=0x154, lpBuffer=0x1c7cdd0*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1c7cdd0*, lpNumberOfBytesWritten=0x2ae3f8*=0x117b0, lpOverlapped=0x0) returned 1 [0161.582] CloseHandle (hObject=0x154) returned 1 [0161.582] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.582] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.582] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff3fe110, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x117b0)) returned 1 [0161.582] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1042\\localizeddata.xml.anonymous")) returned 1 [0161.583] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043", lpFilePart=0x0) returned 0x48 [0161.583] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\", lpFilePart=0x0) returned 0x49 [0161.583] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0161.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.584] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.584] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0161.584] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043", lpFilePart=0x0) returned 0x48 [0161.584] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\", lpFilePart=0x0) returned 0x49 [0161.584] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0161.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.585] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.585] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0161.585] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.585] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.585] GetFileType (hFile=0x154) returned 0x1 [0161.586] GetFileType (hFile=0x154) returned 0x1 [0161.586] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x21a54 [0161.586] ReadFile (in: hFile=0x154, lpBuffer=0x2a713508, nNumberOfBytesToRead=0x21a54, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a713508*, lpNumberOfBytesRead=0x2ae404*=0x21a54, lpOverlapped=0x0) returned 1 [0161.605] CloseHandle (hObject=0x154) returned 1 [0161.629] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.629] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.631] GetFileType (hFile=0x154) returned 0x1 [0161.631] GetFileType (hFile=0x154) returned 0x1 [0161.631] WriteFile (in: hFile=0x154, lpBuffer=0x2a7bb918*, nNumberOfBytesToWrite=0x21a60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a7bb918*, lpNumberOfBytesWritten=0x2ae3f8*=0x21a60, lpOverlapped=0x0) returned 1 [0161.635] CloseHandle (hObject=0x154) returned 1 [0161.635] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.635] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.635] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb1e280, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff470530, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21a60)) returned 1 [0161.635] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\eula.rtf.anonymous")) returned 1 [0161.639] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.639] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.639] GetFileType (hFile=0x154) returned 0x1 [0161.639] GetFileType (hFile=0x154) returned 0x1 [0161.639] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14552 [0161.640] ReadFile (in: hFile=0x154, lpBuffer=0x1cddfb4, nNumberOfBytesToRead=0x14552, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1cddfb4*, lpNumberOfBytesRead=0x2ae404*=0x14552, lpOverlapped=0x0) returned 1 [0161.659] CloseHandle (hObject=0x154) returned 1 [0161.703] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0161.703] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.705] GetFileType (hFile=0x154) returned 0x1 [0161.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0161.705] GetFileType (hFile=0x154) returned 0x1 [0161.705] WriteFile (in: hFile=0x154, lpBuffer=0x1a0eee4*, nNumberOfBytesToWrite=0x14560, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a0eee4*, lpNumberOfBytesWritten=0x2ae3f8*=0x14560, lpOverlapped=0x0) returned 1 [0161.708] CloseHandle (hObject=0x154) returned 1 [0161.708] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.708] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0161.708] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff52ec10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14560)) returned 1 [0161.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0161.708] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1043\\localizeddata.xml.anonymous")) returned 1 [0161.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0161.708] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044", lpFilePart=0x0) returned 0x48 [0161.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\", lpFilePart=0x0) returned 0x49 [0161.709] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0161.710] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.710] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.710] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.710] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.710] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.710] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0161.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0161.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0161.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0161.710] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044", lpFilePart=0x0) returned 0x48 [0161.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\", lpFilePart=0x0) returned 0x49 [0161.710] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb58 [0161.710] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.711] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.711] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.711] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.711] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.711] FindClose (in: hFindFile=0xbeb58 | out: hFindFile=0xbeb58) returned 1 [0161.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0161.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0161.711] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0161.711] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.711] GetFileType (hFile=0x154) returned 0x1 [0161.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0161.711] GetFileType (hFile=0x154) returned 0x1 [0161.712] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x24398 [0161.712] ReadFile (in: hFile=0x154, lpBuffer=0x2a805e58, nNumberOfBytesToRead=0x24398, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a805e58*, lpNumberOfBytesRead=0x2ae404*=0x24398, lpOverlapped=0x0) returned 1 [0161.740] CloseHandle (hObject=0x154) returned 1 [0161.761] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0161.761] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.764] GetFileType (hFile=0x154) returned 0x1 [0161.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0161.764] GetFileType (hFile=0x154) returned 0x1 [0161.764] WriteFile (in: hFile=0x154, lpBuffer=0x2a8bb0b0*, nNumberOfBytesToWrite=0x243a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a8bb0b0*, lpNumberOfBytesWritten=0x2ae3f8*=0x243a0, lpOverlapped=0x0) returned 1 [0161.767] CloseHandle (hObject=0x154) returned 1 [0161.767] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.767] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0161.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb1e280, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff5c7190, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x243a0)) returned 1 [0161.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0161.767] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\eula.rtf.anonymous")) returned 1 [0161.769] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0161.769] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.769] GetFileType (hFile=0x154) returned 0x1 [0161.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0161.769] GetFileType (hFile=0x154) returned 0x1 [0161.769] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14376 [0161.769] ReadFile (in: hFile=0x154, lpBuffer=0x1a72fd0, nNumberOfBytesToRead=0x14376, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a72fd0*, lpNumberOfBytesRead=0x2ae404*=0x14376, lpOverlapped=0x0) returned 1 [0161.783] CloseHandle (hObject=0x154) returned 1 [0161.797] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0161.797] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.799] GetFileType (hFile=0x154) returned 0x1 [0161.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0161.799] GetFileType (hFile=0x154) returned 0x1 [0161.799] WriteFile (in: hFile=0x154, lpBuffer=0x1afc850*, nNumberOfBytesToWrite=0x14380, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1afc850*, lpNumberOfBytesWritten=0x2ae3f8*=0x14380, lpOverlapped=0x0) returned 1 [0161.802] CloseHandle (hObject=0x154) returned 1 [0161.802] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.802] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0161.802] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff613450, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14380)) returned 1 [0161.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0161.802] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1044\\localizeddata.xml.anonymous")) returned 1 [0161.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0161.803] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045", lpFilePart=0x0) returned 0x48 [0161.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\", lpFilePart=0x0) returned 0x49 [0161.803] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0161.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.803] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.804] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0161.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0161.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0161.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0161.804] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045", lpFilePart=0x0) returned 0x48 [0161.804] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\", lpFilePart=0x0) returned 0x49 [0161.804] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbee98 [0161.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.804] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.805] FindNextFileW (in: hFindFile=0xbee98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.805] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0161.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0161.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0161.805] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0161.805] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.805] GetFileType (hFile=0x154) returned 0x1 [0161.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0161.805] GetFileType (hFile=0x154) returned 0x1 [0161.805] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x25053 [0161.806] ReadFile (in: hFile=0x154, lpBuffer=0x2a907b70, nNumberOfBytesToRead=0x25053, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a907b70*, lpNumberOfBytesRead=0x2ae404*=0x25053, lpOverlapped=0x0) returned 1 [0161.814] CloseHandle (hObject=0x154) returned 1 [0161.836] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0161.836] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.838] GetFileType (hFile=0x154) returned 0x1 [0161.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0161.838] GetFileType (hFile=0x154) returned 0x1 [0161.838] WriteFile (in: hFile=0x154, lpBuffer=0x2a9c0d80*, nNumberOfBytesToWrite=0x25060, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2a9c0d80*, lpNumberOfBytesWritten=0x2ae3f8*=0x25060, lpOverlapped=0x0) returned 1 [0161.841] CloseHandle (hObject=0x154) returned 1 [0161.841] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.841] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0161.841] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb443e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff685870, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x25060)) returned 1 [0161.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0161.842] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\eula.rtf.anonymous")) returned 1 [0161.844] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0161.844] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.844] GetFileType (hFile=0x154) returned 0x1 [0161.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0161.845] GetFileType (hFile=0x154) returned 0x1 [0161.845] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14e3a [0161.845] ReadFile (in: hFile=0x154, lpBuffer=0x2a9e5e00, nNumberOfBytesToRead=0x14e3a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2a9e5e00*, lpNumberOfBytesRead=0x2ae404*=0x14e3a, lpOverlapped=0x0) returned 1 [0161.856] CloseHandle (hObject=0x154) returned 1 [0161.880] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0161.880] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.882] GetFileType (hFile=0x154) returned 0x1 [0161.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0161.882] GetFileType (hFile=0x154) returned 0x1 [0161.882] WriteFile (in: hFile=0x154, lpBuffer=0x2aa4e578*, nNumberOfBytesToWrite=0x14e40, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2aa4e578*, lpNumberOfBytesWritten=0x2ae3f8*=0x14e40, lpOverlapped=0x0) returned 1 [0161.884] CloseHandle (hObject=0x154) returned 1 [0161.884] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.884] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0161.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0161.884] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff6d1b30, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14e40)) returned 1 [0161.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0161.884] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1045\\localizeddata.xml.anonymous")) returned 1 [0161.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0161.885] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046", lpFilePart=0x0) returned 0x48 [0161.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\", lpFilePart=0x0) returned 0x49 [0161.885] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf098 [0161.886] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.886] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.886] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.886] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.886] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.886] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0161.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0161.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0161.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0161.887] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046", lpFilePart=0x0) returned 0x48 [0161.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\", lpFilePart=0x0) returned 0x49 [0161.887] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf098 [0161.887] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.887] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.887] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.887] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0161.888] FindNextFileW (in: hFindFile=0xbf098, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0161.888] FindClose (in: hFindFile=0xbf098 | out: hFindFile=0xbf098) returned 1 [0161.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0161.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0161.888] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0161.888] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.888] GetFileType (hFile=0x154) returned 0x1 [0161.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0161.888] GetFileType (hFile=0x154) returned 0x1 [0161.888] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2180a [0161.889] ReadFile (in: hFile=0x154, lpBuffer=0x2aa633d8, nNumberOfBytesToRead=0x2180a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2aa633d8*, lpNumberOfBytesRead=0x2ae404*=0x2180a, lpOverlapped=0x0) returned 1 [0161.916] CloseHandle (hObject=0x154) returned 1 [0161.950] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0161.950] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.954] GetFileType (hFile=0x154) returned 0x1 [0161.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0161.954] GetFileType (hFile=0x154) returned 0x1 [0161.954] WriteFile (in: hFile=0x154, lpBuffer=0x2ab0ac60*, nNumberOfBytesToWrite=0x21810, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2ab0ac60*, lpNumberOfBytesWritten=0x2ae3f8*=0x21810, lpOverlapped=0x0) returned 1 [0161.958] CloseHandle (hObject=0x154) returned 1 [0161.958] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf", lpFilePart=0x0) returned 0x51 [0161.958] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0161.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0161.958] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb443e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff790210, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x21810)) returned 1 [0161.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0161.958] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\eula.rtf.anonymous")) returned 1 [0161.960] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0161.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0161.960] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0161.961] GetFileType (hFile=0x154) returned 0x1 [0161.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0161.961] GetFileType (hFile=0x154) returned 0x1 [0161.961] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14258 [0161.961] ReadFile (in: hFile=0x154, lpBuffer=0x19e8858, nNumberOfBytesToRead=0x14258, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19e8858*, lpNumberOfBytesRead=0x2ae404*=0x14258, lpOverlapped=0x0) returned 1 [0161.986] CloseHandle (hObject=0x154) returned 1 [0162.000] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.000] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.002] GetFileType (hFile=0x154) returned 0x1 [0162.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.002] GetFileType (hFile=0x154) returned 0x1 [0162.002] WriteFile (in: hFile=0x154, lpBuffer=0x1a71ed0*, nNumberOfBytesToWrite=0x14260, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a71ed0*, lpNumberOfBytesWritten=0x2ae3f8*=0x14260, lpOverlapped=0x0) returned 1 [0162.004] CloseHandle (hObject=0x154) returned 1 [0162.004] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.004] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.004] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff802630, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14260)) returned 1 [0162.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.005] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1046\\localizeddata.xml.anonymous")) returned 1 [0162.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.005] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049", lpFilePart=0x0) returned 0x48 [0162.005] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\", lpFilePart=0x0) returned 0x49 [0162.005] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0162.006] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.006] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.006] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.006] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.006] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.006] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0162.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.006] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049", lpFilePart=0x0) returned 0x48 [0162.006] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\", lpFilePart=0x0) returned 0x49 [0162.006] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbe918 [0162.007] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.007] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.007] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.007] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.007] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.007] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0162.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.007] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.007] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.008] GetFileType (hFile=0x154) returned 0x1 [0162.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.008] GetFileType (hFile=0x154) returned 0x1 [0162.008] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2e145 [0162.008] ReadFile (in: hFile=0x154, lpBuffer=0x2ab54950, nNumberOfBytesToRead=0x2e145, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2ab54950*, lpNumberOfBytesRead=0x2ae404*=0x2e145, lpOverlapped=0x0) returned 1 [0162.035] CloseHandle (hObject=0x154) returned 1 [0162.059] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.059] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.061] GetFileType (hFile=0x154) returned 0x1 [0162.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.061] GetFileType (hFile=0x154) returned 0x1 [0162.061] WriteFile (in: hFile=0x154, lpBuffer=0x2ac3b018*, nNumberOfBytesToWrite=0x2e150, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2ac3b018*, lpNumberOfBytesWritten=0x2ae3f8*=0x2e150, lpOverlapped=0x0) returned 1 [0162.065] CloseHandle (hObject=0x154) returned 1 [0162.065] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.065] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0162.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.065] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb443e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff89abb0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x2e150)) returned 1 [0162.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.065] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\eula.rtf.anonymous")) returned 1 [0162.067] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.067] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.067] GetFileType (hFile=0x154) returned 0x1 [0162.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.067] GetFileType (hFile=0x154) returned 0x1 [0162.067] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14892 [0162.067] ReadFile (in: hFile=0x154, lpBuffer=0x1ad5b64, nNumberOfBytesToRead=0x14892, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ad5b64*, lpNumberOfBytesRead=0x2ae404*=0x14892, lpOverlapped=0x0) returned 1 [0162.087] CloseHandle (hObject=0x154) returned 1 [0162.101] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.101] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.103] GetFileType (hFile=0x154) returned 0x1 [0162.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.103] GetFileType (hFile=0x154) returned 0x1 [0162.103] WriteFile (in: hFile=0x154, lpBuffer=0x1b60344*, nNumberOfBytesToWrite=0x148a0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b60344*, lpNumberOfBytesWritten=0x2ae3f8*=0x148a0, lpOverlapped=0x0) returned 1 [0162.106] CloseHandle (hObject=0x154) returned 1 [0162.106] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.106] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.106] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff90cfd0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x148a0)) returned 1 [0162.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.106] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1049\\localizeddata.xml.anonymous")) returned 1 [0162.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.107] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053", lpFilePart=0x0) returned 0x48 [0162.107] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\", lpFilePart=0x0) returned 0x49 [0162.107] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0162.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.108] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.108] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0162.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.108] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053", lpFilePart=0x0) returned 0x48 [0162.108] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\", lpFilePart=0x0) returned 0x49 [0162.108] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0162.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.109] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.109] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0162.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.109] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.109] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.109] GetFileType (hFile=0x154) returned 0x1 [0162.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.110] GetFileType (hFile=0x154) returned 0x1 [0162.110] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x246f4 [0162.110] ReadFile (in: hFile=0x154, lpBuffer=0x2ac922c8, nNumberOfBytesToRead=0x246f4, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2ac922c8*, lpNumberOfBytesRead=0x2ae404*=0x246f4, lpOverlapped=0x0) returned 1 [0162.119] CloseHandle (hObject=0x154) returned 1 [0162.143] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.143] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.145] GetFileType (hFile=0x154) returned 0x1 [0162.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.145] GetFileType (hFile=0x154) returned 0x1 [0162.145] WriteFile (in: hFile=0x154, lpBuffer=0x2ad485f8*, nNumberOfBytesToWrite=0x24700, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2ad485f8*, lpNumberOfBytesWritten=0x2ae3f8*=0x24700, lpOverlapped=0x0) returned 1 [0162.148] CloseHandle (hObject=0x154) returned 1 [0162.148] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.148] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0162.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.148] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb443e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff959290, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x24700)) returned 1 [0162.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.149] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\eula.rtf.anonymous")) returned 1 [0162.151] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.151] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.152] GetFileType (hFile=0x154) returned 0x1 [0162.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.152] GetFileType (hFile=0x154) returned 0x1 [0162.152] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13e0a [0162.152] ReadFile (in: hFile=0x154, lpBuffer=0x19c4640, nNumberOfBytesToRead=0x13e0a, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x19c4640*, lpNumberOfBytesRead=0x2ae404*=0x13e0a, lpOverlapped=0x0) returned 1 [0162.169] CloseHandle (hObject=0x154) returned 1 [0162.183] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.183] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.186] GetFileType (hFile=0x154) returned 0x1 [0162.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.186] GetFileType (hFile=0x154) returned 0x1 [0162.186] WriteFile (in: hFile=0x154, lpBuffer=0x1a4cfcc*, nNumberOfBytesToWrite=0x13e10, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a4cfcc*, lpNumberOfBytesWritten=0x2ae3f8*=0x13e10, lpOverlapped=0x0) returned 1 [0162.189] CloseHandle (hObject=0x154) returned 1 [0162.189] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.189] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.190] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9216b860, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xff9cb6b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13e10)) returned 1 [0162.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.190] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1053\\localizeddata.xml.anonymous")) returned 1 [0162.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.190] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055", lpFilePart=0x0) returned 0x48 [0162.190] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\", lpFilePart=0x0) returned 0x49 [0162.190] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0162.191] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.191] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.191] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.191] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.191] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.191] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0162.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.192] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055", lpFilePart=0x0) returned 0x48 [0162.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\", lpFilePart=0x0) returned 0x49 [0162.192] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf158 [0162.192] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.192] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.192] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.192] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.192] FindNextFileW (in: hFindFile=0xbf158, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.192] FindClose (in: hFindFile=0xbf158 | out: hFindFile=0xbf158) returned 1 [0162.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.193] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.193] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.193] GetFileType (hFile=0x154) returned 0x1 [0162.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.193] GetFileType (hFile=0x154) returned 0x1 [0162.193] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x2238b [0162.194] ReadFile (in: hFile=0x154, lpBuffer=0x2ad94938, nNumberOfBytesToRead=0x2238b, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2ad94938*, lpNumberOfBytesRead=0x2ae404*=0x2238b, lpOverlapped=0x0) returned 1 [0162.229] CloseHandle (hObject=0x154) returned 1 [0162.266] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.266] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.269] GetFileType (hFile=0x154) returned 0x1 [0162.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.269] GetFileType (hFile=0x154) returned 0x1 [0162.269] WriteFile (in: hFile=0x154, lpBuffer=0x2ae3fb40*, nNumberOfBytesToWrite=0x22390, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2ae3fb40*, lpNumberOfBytesWritten=0x2ae3f8*=0x22390, lpOverlapped=0x0) returned 1 [0162.272] CloseHandle (hObject=0x154) returned 1 [0162.272] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.272] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0162.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.272] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb443e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffa89d90, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x22390)) returned 1 [0162.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.272] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\eula.rtf.anonymous")) returned 1 [0162.274] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.274] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.274] GetFileType (hFile=0x154) returned 0x1 [0162.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.274] GetFileType (hFile=0x154) returned 0x1 [0162.274] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x13dec [0162.274] ReadFile (in: hFile=0x154, lpBuffer=0x1ab080c, nNumberOfBytesToRead=0x13dec, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1ab080c*, lpNumberOfBytesRead=0x2ae404*=0x13dec, lpOverlapped=0x0) returned 1 [0162.284] CloseHandle (hObject=0x154) returned 1 [0162.298] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.298] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.300] GetFileType (hFile=0x154) returned 0x1 [0162.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.300] GetFileType (hFile=0x154) returned 0x1 [0162.300] WriteFile (in: hFile=0x154, lpBuffer=0x1b38fd8*, nNumberOfBytesToWrite=0x13df0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b38fd8*, lpNumberOfBytesWritten=0x2ae3f8*=0x13df0, lpOverlapped=0x0) returned 1 [0162.302] CloseHandle (hObject=0x154) returned 1 [0162.302] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.303] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.303] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9216b860, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffad6050, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x13df0)) returned 1 [0162.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.303] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\1055\\localizeddata.xml.anonymous")) returned 1 [0162.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.303] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052", lpFilePart=0x0) returned 0x48 [0162.303] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\", lpFilePart=0x0) returned 0x49 [0162.303] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0162.304] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.305] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.305] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.305] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.305] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.305] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0162.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.305] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052", lpFilePart=0x0) returned 0x48 [0162.305] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\", lpFilePart=0x0) returned 0x49 [0162.305] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0162.305] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.306] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.306] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.306] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.306] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.306] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0162.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.306] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.306] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.306] GetFileType (hFile=0x154) returned 0x1 [0162.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.306] GetFileType (hFile=0x154) returned 0x1 [0162.306] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x23b61 [0162.307] ReadFile (in: hFile=0x154, lpBuffer=0x2ae89ad0, nNumberOfBytesToRead=0x23b61, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2ae89ad0*, lpNumberOfBytesRead=0x2ae404*=0x23b61, lpOverlapped=0x0) returned 1 [0162.347] CloseHandle (hObject=0x154) returned 1 [0162.367] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.367] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.370] GetFileType (hFile=0x154) returned 0x1 [0162.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.370] GetFileType (hFile=0x154) returned 0x1 [0162.370] WriteFile (in: hFile=0x154, lpBuffer=0x2af3c430*, nNumberOfBytesToWrite=0x23b70, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2af3c430*, lpNumberOfBytesWritten=0x2ae3f8*=0x23b70, lpOverlapped=0x0) returned 1 [0162.373] CloseHandle (hObject=0x154) returned 1 [0162.373] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.373] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0162.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.373] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb6a540, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffb94730, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x23b70)) returned 1 [0162.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.373] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\eula.rtf.anonymous")) returned 1 [0162.375] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.375] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.375] GetFileType (hFile=0x154) returned 0x1 [0162.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.375] GetFileType (hFile=0x154) returned 0x1 [0162.375] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x10776 [0162.375] ReadFile (in: hFile=0x154, lpBuffer=0x1b9c800, nNumberOfBytesToRead=0x10776, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b9c800*, lpNumberOfBytesRead=0x2ae404*=0x10776, lpOverlapped=0x0) returned 1 [0162.396] CloseHandle (hObject=0x154) returned 1 [0162.412] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.413] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.415] GetFileType (hFile=0x154) returned 0x1 [0162.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.415] GetFileType (hFile=0x154) returned 0x1 [0162.415] WriteFile (in: hFile=0x154, lpBuffer=0x1a2b3f8*, nNumberOfBytesToWrite=0x10780, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a2b3f8*, lpNumberOfBytesWritten=0x2ae3f8*=0x10780, lpOverlapped=0x0) returned 1 [0162.419] CloseHandle (hObject=0x154) returned 1 [0162.419] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.419] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.419] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffc06b50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x10780)) returned 1 [0162.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.419] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2052\\localizeddata.xml.anonymous")) returned 1 [0162.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.420] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070", lpFilePart=0x0) returned 0x48 [0162.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\", lpFilePart=0x0) returned 0x49 [0162.420] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0162.420] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.420] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.421] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.421] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.421] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.421] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0162.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.421] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070", lpFilePart=0x0) returned 0x48 [0162.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\", lpFilePart=0x0) returned 0x49 [0162.421] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbeb98 [0162.421] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.422] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.422] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.422] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.422] FindNextFileW (in: hFindFile=0xbeb98, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.422] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0162.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.422] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.422] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.423] GetFileType (hFile=0x154) returned 0x1 [0162.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.423] GetFileType (hFile=0x154) returned 0x1 [0162.423] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x240ce [0162.424] ReadFile (in: hFile=0x154, lpBuffer=0x2af80ec0, nNumberOfBytesToRead=0x240ce, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2af80ec0*, lpNumberOfBytesRead=0x2ae404*=0x240ce, lpOverlapped=0x0) returned 1 [0162.436] CloseHandle (hObject=0x154) returned 1 [0162.457] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.458] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.460] GetFileType (hFile=0x154) returned 0x1 [0162.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.460] GetFileType (hFile=0x154) returned 0x1 [0162.460] WriteFile (in: hFile=0x154, lpBuffer=0x2b035310*, nNumberOfBytesToWrite=0x240d0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2b035310*, lpNumberOfBytesWritten=0x2ae3f8*=0x240d0, lpOverlapped=0x0) returned 1 [0162.463] CloseHandle (hObject=0x154) returned 1 [0162.464] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.464] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0162.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb6a540, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffc52e10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x240d0)) returned 1 [0162.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.464] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\eula.rtf.anonymous")) returned 1 [0162.467] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.467] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.467] GetFileType (hFile=0x154) returned 0x1 [0162.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.468] GetFileType (hFile=0x154) returned 0x1 [0162.468] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x148d6 [0162.468] ReadFile (in: hFile=0x154, lpBuffer=0x1a8b700, nNumberOfBytesToRead=0x148d6, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1a8b700*, lpNumberOfBytesRead=0x2ae404*=0x148d6, lpOverlapped=0x0) returned 1 [0162.496] CloseHandle (hObject=0x154) returned 1 [0162.510] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.511] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.513] GetFileType (hFile=0x154) returned 0x1 [0162.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.513] GetFileType (hFile=0x154) returned 0x1 [0162.513] WriteFile (in: hFile=0x154, lpBuffer=0x1b15fa0*, nNumberOfBytesToWrite=0x148e0, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1b15fa0*, lpNumberOfBytesWritten=0x2ae3f8*=0x148e0, lpOverlapped=0x0) returned 1 [0162.515] CloseHandle (hObject=0x154) returned 1 [0162.515] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.515] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.515] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x92145700, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffceb390, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x148e0)) returned 1 [0162.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.515] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\2070\\localizeddata.xml.anonymous")) returned 1 [0162.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.516] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082", lpFilePart=0x0) returned 0x48 [0162.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\", lpFilePart=0x0) returned 0x49 [0162.516] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0162.516] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.517] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.517] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.517] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.517] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.517] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0162.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.517] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082", lpFilePart=0x0) returned 0x48 [0162.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\", lpFilePart=0x0) returned 0x49 [0162.517] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbea18 [0162.517] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.517] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.518] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.518] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.518] FindNextFileW (in: hFindFile=0xbea18, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.518] FindClose (in: hFindFile=0xbea18 | out: hFindFile=0xbea18) returned 1 [0162.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.518] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.518] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.518] GetFileType (hFile=0x154) returned 0x1 [0162.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.518] GetFileType (hFile=0x154) returned 0x1 [0162.518] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x1fb5b [0162.519] ReadFile (in: hFile=0x154, lpBuffer=0x2b0825c0, nNumberOfBytesToRead=0x1fb5b, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x2b0825c0*, lpNumberOfBytesRead=0x2ae404*=0x1fb5b, lpOverlapped=0x0) returned 1 [0162.542] CloseHandle (hObject=0x154) returned 1 [0162.561] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.562] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.564] GetFileType (hFile=0x154) returned 0x1 [0162.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.564] GetFileType (hFile=0x154) returned 0x1 [0162.564] WriteFile (in: hFile=0x154, lpBuffer=0x2b120ed8*, nNumberOfBytesToWrite=0x1fb60, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x2b120ed8*, lpNumberOfBytesWritten=0x2ae3f8*=0x1fb60, lpOverlapped=0x0) returned 1 [0162.567] CloseHandle (hObject=0x154) returned 1 [0162.567] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf", lpFilePart=0x0) returned 0x51 [0162.567] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf.anonymous", lpFilePart=0x0) returned 0x5b [0162.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.567] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xcd7cbf00, ftCreationTime.dwHighDateTime=0x1d09f02, ftLastAccessTime.dwLowDateTime=0x8eb6a540, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffd5d7b0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1fb60)) returned 1 [0162.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.567] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\eula.rtf"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\eula.rtf.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\eula.rtf.anonymous")) returned 1 [0162.569] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae350) returned 1 [0162.569] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.570] GetFileType (hFile=0x154) returned 0x1 [0162.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae34c) returned 1 [0162.570] GetFileType (hFile=0x154) returned 0x1 [0162.570] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae458 | out: lpFileSizeHigh=0x2ae458*=0x0) returned 0x14614 [0162.570] ReadFile (in: hFile=0x154, lpBuffer=0x1b7a2b0, nNumberOfBytesToRead=0x14614, lpNumberOfBytesRead=0x2ae404, lpOverlapped=0x0 | out: lpBuffer=0x1b7a2b0*, lpNumberOfBytesRead=0x2ae404*=0x14614, lpOverlapped=0x0) returned 1 [0162.631] CloseHandle (hObject=0x154) returned 1 [0162.648] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae33c) returned 1 [0162.648] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.650] GetFileType (hFile=0x154) returned 0x1 [0162.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae338) returned 1 [0162.650] GetFileType (hFile=0x154) returned 0x1 [0162.650] WriteFile (in: hFile=0x154, lpBuffer=0x1a08160*, nNumberOfBytesToWrite=0x14620, lpNumberOfBytesWritten=0x2ae3f8, lpOverlapped=0x0 | out: lpBuffer=0x1a08160*, lpNumberOfBytesWritten=0x2ae3f8*=0x14620, lpOverlapped=0x0) returned 1 [0162.652] CloseHandle (hObject=0x154) returned 1 [0162.652] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x5a [0162.653] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml.anonymous", lpFilePart=0x0) returned 0x64 [0162.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3dc) returned 1 [0162.653] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae458 | out: lpFileInformation=0x2ae458*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x29ab2a00, ftCreationTime.dwHighDateTime=0x1d0ab24, ftLastAccessTime.dwLowDateTime=0x9211f5a0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffe41ff0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x14620)) returned 1 [0162.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0162.653] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\localizeddata.xml"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\LocalizedData.xml.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\setupcache\\v4.6.00081\\3082\\localizeddata.xml.anonymous")) returned 1 [0162.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.654] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics", lpFilePart=0x0) returned 0x4c [0162.654] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\", lpFilePart=0x0) returned 0x4d [0162.654] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0162.656] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.656] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.656] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.657] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.658] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.658] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.658] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.658] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.658] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.658] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0162.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0162.659] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics", nBufferLength=0x105, lpBuffer=0x2adf94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics", lpFilePart=0x0) returned 0x4c [0162.659] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\", nBufferLength=0x105, lpBuffer=0x2adf68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\", lpFilePart=0x0) returned 0x4d [0162.659] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0162.660] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.660] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.660] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.660] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.661] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.662] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.662] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.662] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.662] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.662] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 1 [0162.662] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae1c4 | out: lpFindFileData=0x2ae1c4) returned 0 [0162.662] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0162.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0162.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0162.663] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL", lpFilePart=0x0) returned 0x31 [0162.663] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\", lpFilePart=0x0) returned 0x32 [0162.663] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0162.664] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0162.664] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0162.664] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0162.664] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0162.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0162.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0162.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0162.664] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL", lpFilePart=0x0) returned 0x31 [0162.664] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\", lpFilePart=0x0) returned 0x32 [0162.664] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0162.664] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0162.665] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0162.665] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0162.665] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0162.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0162.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0162.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0162.665] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en", lpFilePart=0x0) returned 0x34 [0162.665] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\", lpFilePart=0x0) returned 0x35 [0162.665] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0162.684] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.684] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.684] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.685] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.686] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.686] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.686] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0162.686] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0162.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0162.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0162.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0162.687] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en", lpFilePart=0x0) returned 0x34 [0162.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\", lpFilePart=0x0) returned 0x35 [0162.687] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0162.688] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.688] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.688] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.688] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.689] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0162.690] FindNextFileW (in: hFindFile=0xbf198, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0162.690] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0162.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0162.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0162.691] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x58 [0162.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.691] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.693] GetFileType (hFile=0x154) returned 0x1 [0162.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.693] GetFileType (hFile=0x154) returned 0x1 [0162.693] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x4af [0162.693] ReadFile (in: hFile=0x154, lpBuffer=0x1a28778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a28778*, lpNumberOfBytesRead=0x2ae478*=0x4af, lpOverlapped=0x0) returned 1 [0162.694] CloseHandle (hObject=0x154) returned 1 [0162.706] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x58 [0162.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.706] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.710] GetFileType (hFile=0x154) returned 0x1 [0162.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.710] GetFileType (hFile=0x154) returned 0x1 [0162.710] WriteFile (in: hFile=0x154, lpBuffer=0x1a77fac*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a77fac*, lpNumberOfBytesWritten=0x2ae440*=0x4b0, lpOverlapped=0x0) returned 1 [0162.712] CloseHandle (hObject=0x154) returned 1 [0162.712] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x58 [0162.712] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql.anonymous", lpFilePart=0x0) returned 0x62 [0162.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.712] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94933600, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x4eb1ab20, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xffeb4410, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x4b0)) returned 1 [0162.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.712] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql.anonymous")) returned 1 [0162.713] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql", lpFilePart=0x0) returned 0x59 [0162.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.713] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.713] GetFileType (hFile=0x154) returned 0x1 [0162.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.713] GetFileType (hFile=0x154) returned 0x1 [0162.713] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x528 [0162.713] ReadFile (in: hFile=0x154, lpBuffer=0x1a798dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a798dc*, lpNumberOfBytesRead=0x2ae478*=0x528, lpOverlapped=0x0) returned 1 [0162.716] CloseHandle (hObject=0x154) returned 1 [0162.727] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql", lpFilePart=0x0) returned 0x59 [0162.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.727] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.730] GetFileType (hFile=0x154) returned 0x1 [0162.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.730] GetFileType (hFile=0x154) returned 0x1 [0162.730] WriteFile (in: hFile=0x154, lpBuffer=0x1ac923c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1ac923c*, lpNumberOfBytesWritten=0x2ae440*=0x530, lpOverlapped=0x0) returned 1 [0162.733] CloseHandle (hObject=0x154) returned 1 [0162.733] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql", lpFilePart=0x0) returned 0x59 [0162.733] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql.anonymous", lpFilePart=0x0) returned 0x63 [0162.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.733] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94933600, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x4eb1ab20, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfff006d0, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0162.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.733] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql.anonymous")) returned 1 [0162.734] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql", lpFilePart=0x0) returned 0x5a [0162.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.734] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.734] GetFileType (hFile=0x154) returned 0x1 [0162.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.734] GetFileType (hFile=0x154) returned 0x1 [0162.734] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x17b1 [0162.734] ReadFile (in: hFile=0x154, lpBuffer=0x1aca63c, nNumberOfBytesToRead=0x17b1, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1aca63c*, lpNumberOfBytesRead=0x2ae478*=0x17b1, lpOverlapped=0x0) returned 1 [0162.735] CloseHandle (hObject=0x154) returned 1 [0162.748] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql", lpFilePart=0x0) returned 0x5a [0162.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.748] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.749] GetFileType (hFile=0x154) returned 0x1 [0162.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.749] GetFileType (hFile=0x154) returned 0x1 [0162.749] WriteFile (in: hFile=0x154, lpBuffer=0x1b1eae8*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b1eae8*, lpNumberOfBytesWritten=0x2ae46c*=0x17c0, lpOverlapped=0x0) returned 1 [0162.751] CloseHandle (hObject=0x154) returned 1 [0162.751] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql", lpFilePart=0x0) returned 0x5a [0162.751] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql.anonymous", lpFilePart=0x0) returned 0x64 [0162.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.751] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1c9e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x4eb40c80, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfff26830, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x17c0)) returned 1 [0162.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.751] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql.anonymous")) returned 1 [0162.751] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql", lpFilePart=0x0) returned 0x5b [0162.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.752] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.752] GetFileType (hFile=0x154) returned 0x1 [0162.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.752] GetFileType (hFile=0x154) returned 0x1 [0162.752] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xeee [0162.753] ReadFile (in: hFile=0x154, lpBuffer=0x1b2172c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b2172c*, lpNumberOfBytesRead=0x2ae478*=0xeee, lpOverlapped=0x0) returned 1 [0162.754] CloseHandle (hObject=0x154) returned 1 [0162.765] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql", lpFilePart=0x0) returned 0x5b [0162.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.765] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.767] GetFileType (hFile=0x154) returned 0x1 [0162.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.767] GetFileType (hFile=0x154) returned 0x1 [0162.767] WriteFile (in: hFile=0x154, lpBuffer=0x1b74150*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1b74150*, lpNumberOfBytesWritten=0x2ae440*=0xef0, lpOverlapped=0x0) returned 1 [0162.768] CloseHandle (hObject=0x154) returned 1 [0162.768] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql", lpFilePart=0x0) returned 0x5b [0162.768] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql.anonymous", lpFilePart=0x0) returned 0x65 [0162.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1c9e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x4eb40c80, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfff4c990, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xef0)) returned 1 [0162.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.768] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql.anonymous")) returned 1 [0162.769] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x54 [0162.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.769] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.769] GetFileType (hFile=0x154) returned 0x1 [0162.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.769] GetFileType (hFile=0x154) returned 0x1 [0162.769] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x1a58 [0162.769] ReadFile (in: hFile=0x154, lpBuffer=0x1b75544, nNumberOfBytesToRead=0x1a58, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b75544*, lpNumberOfBytesRead=0x2ae478*=0x1a58, lpOverlapped=0x0) returned 1 [0162.789] CloseHandle (hObject=0x154) returned 1 [0162.803] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x54 [0162.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.803] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.805] GetFileType (hFile=0x154) returned 0x1 [0162.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.805] GetFileType (hFile=0x154) returned 0x1 [0162.805] WriteFile (in: hFile=0x154, lpBuffer=0x19b9b5c*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19b9b5c*, lpNumberOfBytesWritten=0x2ae46c*=0x1a60, lpOverlapped=0x0) returned 1 [0162.806] CloseHandle (hObject=0x154) returned 1 [0162.806] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql", lpFilePart=0x0) returned 0x54 [0162.806] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql.anonymous", lpFilePart=0x0) returned 0x5e [0162.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.806] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94933600, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x52a2f220, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfff98c50, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x1a60)) returned 1 [0162.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.806] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql.anonymous")) returned 1 [0162.807] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql", lpFilePart=0x0) returned 0x55 [0162.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.807] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.807] GetFileType (hFile=0x154) returned 0x1 [0162.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.807] GetFileType (hFile=0x154) returned 0x1 [0162.807] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x860 [0162.807] ReadFile (in: hFile=0x154, lpBuffer=0x19bc35c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19bc35c*, lpNumberOfBytesRead=0x2ae478*=0x860, lpOverlapped=0x0) returned 1 [0162.809] CloseHandle (hObject=0x154) returned 1 [0162.821] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql", lpFilePart=0x0) returned 0x55 [0162.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.822] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.823] GetFileType (hFile=0x154) returned 0x1 [0162.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.823] GetFileType (hFile=0x154) returned 0x1 [0162.823] WriteFile (in: hFile=0x154, lpBuffer=0x1a0ce50*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2ae440, lpOverlapped=0x0 | out: lpBuffer=0x1a0ce50*, lpNumberOfBytesWritten=0x2ae440*=0x870, lpOverlapped=0x0) returned 1 [0162.824] CloseHandle (hObject=0x154) returned 1 [0162.824] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql", lpFilePart=0x0) returned 0x55 [0162.824] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql.anonymous", lpFilePart=0x0) returned 0x5f [0162.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.825] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94933600, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x52a55380, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xfffe4f10, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0x870)) returned 1 [0162.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.825] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql.anonymous")) returned 1 [0162.825] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql", lpFilePart=0x0) returned 0x54 [0162.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.825] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.826] GetFileType (hFile=0x154) returned 0x1 [0162.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.826] GetFileType (hFile=0x154) returned 0x1 [0162.826] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5d5c [0162.826] ReadFile (in: hFile=0x154, lpBuffer=0x1a0e220, nNumberOfBytesToRead=0x5d5c, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a0e220*, lpNumberOfBytesRead=0x2ae478*=0x5d5c, lpOverlapped=0x0) returned 1 [0162.831] CloseHandle (hObject=0x154) returned 1 [0162.842] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql", lpFilePart=0x0) returned 0x54 [0162.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.842] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.844] GetFileType (hFile=0x154) returned 0x1 [0162.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.844] GetFileType (hFile=0x154) returned 0x1 [0162.844] WriteFile (in: hFile=0x154, lpBuffer=0x1a782e8*, nNumberOfBytesToWrite=0x5d60, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a782e8*, lpNumberOfBytesWritten=0x2ae46c*=0x5d60, lpOverlapped=0x0) returned 1 [0162.845] CloseHandle (hObject=0x154) returned 1 [0162.845] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql", lpFilePart=0x0) returned 0x54 [0162.845] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql.anonymous", lpFilePart=0x0) returned 0x5e [0162.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.845] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7550e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x52a55380, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xb070, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x5d60)) returned 1 [0162.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.846] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql.anonymous")) returned 1 [0162.846] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql", lpFilePart=0x0) returned 0x55 [0162.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.846] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.850] GetFileType (hFile=0x154) returned 0x1 [0162.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.850] GetFileType (hFile=0x154) returned 0x1 [0162.850] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x10c8 [0162.850] ReadFile (in: hFile=0x154, lpBuffer=0x1a7e57c, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1a7e57c*, lpNumberOfBytesRead=0x2ae478*=0x10c8, lpOverlapped=0x0) returned 1 [0162.855] CloseHandle (hObject=0x154) returned 1 [0162.866] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql", lpFilePart=0x0) returned 0x55 [0162.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.866] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.868] GetFileType (hFile=0x154) returned 0x1 [0162.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.868] GetFileType (hFile=0x154) returned 0x1 [0162.868] WriteFile (in: hFile=0x154, lpBuffer=0x1ad0774*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1ad0774*, lpNumberOfBytesWritten=0x2ae46c*=0x10d0, lpOverlapped=0x0) returned 1 [0162.869] CloseHandle (hObject=0x154) returned 1 [0162.869] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql", lpFilePart=0x0) returned 0x55 [0162.869] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql.anonymous", lpFilePart=0x0) returned 0x5f [0162.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.869] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7550e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x52a55380, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x311d0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x10d0)) returned 1 [0162.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.869] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql.anonymous")) returned 1 [0162.886] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql", lpFilePart=0x0) returned 0x56 [0162.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.886] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.887] GetFileType (hFile=0x154) returned 0x1 [0162.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.887] GetFileType (hFile=0x154) returned 0x1 [0162.887] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xf89e [0162.887] ReadFile (in: hFile=0x154, lpBuffer=0x1ad1d80, nNumberOfBytesToRead=0xf89e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ad1d80*, lpNumberOfBytesRead=0x2ae478*=0xf89e, lpOverlapped=0x0) returned 1 [0162.888] CloseHandle (hObject=0x154) returned 1 [0162.902] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql", lpFilePart=0x0) returned 0x56 [0162.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.902] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.904] GetFileType (hFile=0x154) returned 0x1 [0162.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.904] GetFileType (hFile=0x154) returned 0x1 [0162.904] WriteFile (in: hFile=0x154, lpBuffer=0x1b4d560*, nNumberOfBytesToWrite=0xf8a0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b4d560*, lpNumberOfBytesWritten=0x2ae46c*=0xf8a0, lpOverlapped=0x0) returned 1 [0162.906] CloseHandle (hObject=0x154) returned 1 [0162.906] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql", lpFilePart=0x0) returned 0x56 [0162.906] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql.anonymous", lpFilePart=0x0) returned 0x60 [0162.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.906] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1c9e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x52a55380, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xa35f0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0xf8a0)) returned 1 [0162.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.906] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql.anonymous")) returned 1 [0162.907] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql", lpFilePart=0x0) returned 0x57 [0162.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.907] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.907] GetFileType (hFile=0x154) returned 0x1 [0162.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.907] GetFileType (hFile=0x154) returned 0x1 [0162.907] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x7088 [0162.907] ReadFile (in: hFile=0x154, lpBuffer=0x1b5d350, nNumberOfBytesToRead=0x7088, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1b5d350*, lpNumberOfBytesRead=0x2ae478*=0x7088, lpOverlapped=0x0) returned 1 [0162.913] CloseHandle (hObject=0x154) returned 1 [0162.931] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql", lpFilePart=0x0) returned 0x57 [0162.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.931] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.934] GetFileType (hFile=0x154) returned 0x1 [0162.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.935] GetFileType (hFile=0x154) returned 0x1 [0162.938] WriteFile (in: hFile=0x154, lpBuffer=0x19d4a58*, nNumberOfBytesToWrite=0x7090, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x19d4a58*, lpNumberOfBytesWritten=0x2ae46c*=0x7090, lpOverlapped=0x0) returned 1 [0162.939] CloseHandle (hObject=0x154) returned 1 [0162.939] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql", lpFilePart=0x0) returned 0x57 [0162.939] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql.anonymous", lpFilePart=0x0) returned 0x61 [0162.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.939] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1c9e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x52a55380, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0xef8b0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x7090)) returned 1 [0162.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.940] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql.anonymous")) returned 1 [0162.940] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql", lpFilePart=0x0) returned 0x5e [0162.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.940] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.941] GetFileType (hFile=0x154) returned 0x1 [0162.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0162.941] GetFileType (hFile=0x154) returned 0x1 [0162.941] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x137b9 [0162.941] ReadFile (in: hFile=0x154, lpBuffer=0x19dc058, nNumberOfBytesToRead=0x137b9, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x19dc058*, lpNumberOfBytesRead=0x2ae478*=0x137b9, lpOverlapped=0x0) returned 1 [0162.971] CloseHandle (hObject=0x154) returned 1 [0162.986] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql", lpFilePart=0x0) returned 0x5e [0162.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0162.986] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0162.988] GetFileType (hFile=0x154) returned 0x1 [0162.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0162.988] GetFileType (hFile=0x154) returned 0x1 [0162.988] WriteFile (in: hFile=0x154, lpBuffer=0x1a636f4*, nNumberOfBytesToWrite=0x137c0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1a636f4*, lpNumberOfBytesWritten=0x2ae46c*=0x137c0, lpOverlapped=0x0) returned 1 [0162.990] CloseHandle (hObject=0x154) returned 1 [0162.990] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql", lpFilePart=0x0) returned 0x5e [0162.990] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql.anonymous", lpFilePart=0x0) returned 0x68 [0162.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0162.990] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf49b7d00, ftCreationTime.dwHighDateTime=0x1cd5d75, ftLastAccessTime.dwLowDateTime=0x52a7b4e0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x161cd0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x137c0)) returned 1 [0162.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0162.990] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql.anonymous")) returned 1 [0162.991] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql", lpFilePart=0x0) returned 0x47 [0162.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0162.991] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.002] GetFileType (hFile=0x154) returned 0x1 [0163.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0163.002] GetFileType (hFile=0x154) returned 0x1 [0163.002] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0x5d2a4 [0163.003] ReadFile (in: hFile=0x154, lpBuffer=0x2b1af758, nNumberOfBytesToRead=0x5d2a4, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x2b1af758*, lpNumberOfBytesRead=0x2ae478*=0x5d2a4, lpOverlapped=0x0) returned 1 [0163.026] CloseHandle (hObject=0x154) returned 1 [0163.060] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql", lpFilePart=0x0) returned 0x47 [0163.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0163.060] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.065] GetFileType (hFile=0x154) returned 0x1 [0163.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0163.065] GetFileType (hFile=0x154) returned 0x1 [0163.065] WriteFile (in: hFile=0x154, lpBuffer=0x2b3814f8*, nNumberOfBytesToWrite=0x5d2b0, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x2b3814f8*, lpNumberOfBytesWritten=0x2ae46c*=0x5d2b0, lpOverlapped=0x0) returned 1 [0163.072] CloseHandle (hObject=0x154) returned 1 [0163.072] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql", lpFilePart=0x0) returned 0x47 [0163.072] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql.anonymous", lpFilePart=0x0) returned 0x51 [0163.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0163.073] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7550e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x55e1b200, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x2203b0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x5d2b0)) returned 1 [0163.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0163.073] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql.anonymous")) returned 1 [0163.074] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql", nBufferLength=0x105, lpBuffer=0x2aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql", lpFilePart=0x0) returned 0x48 [0163.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3c4) returned 1 [0163.074] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.074] GetFileType (hFile=0x154) returned 0x1 [0163.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3c0) returned 1 [0163.074] GetFileType (hFile=0x154) returned 0x1 [0163.074] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae4cc | out: lpFileSizeHigh=0x2ae4cc*=0x0) returned 0xc66e [0163.074] ReadFile (in: hFile=0x154, lpBuffer=0x1ac4684, nNumberOfBytesToRead=0xc66e, lpNumberOfBytesRead=0x2ae478, lpOverlapped=0x0 | out: lpBuffer=0x1ac4684*, lpNumberOfBytesRead=0x2ae478*=0xc66e, lpOverlapped=0x0) returned 1 [0163.079] CloseHandle (hObject=0x154) returned 1 [0163.092] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql", nBufferLength=0x105, lpBuffer=0x2adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql", lpFilePart=0x0) returned 0x48 [0163.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3b0) returned 1 [0163.092] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.094] GetFileType (hFile=0x154) returned 0x1 [0163.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3ac) returned 1 [0163.094] GetFileType (hFile=0x154) returned 0x1 [0163.094] WriteFile (in: hFile=0x154, lpBuffer=0x1b367d4*, nNumberOfBytesToWrite=0xc670, lpNumberOfBytesWritten=0x2ae46c, lpOverlapped=0x0 | out: lpBuffer=0x1b367d4*, lpNumberOfBytesWritten=0x2ae46c*=0xc670, lpOverlapped=0x0) returned 1 [0163.095] CloseHandle (hObject=0x154) returned 1 [0163.096] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql", lpFilePart=0x0) returned 0x48 [0163.096] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql.anonymous", nBufferLength=0x105, lpBuffer=0x2adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql.anonymous", lpFilePart=0x0) returned 0x52 [0163.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae450) returned 1 [0163.096] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql"), fInfoLevelId=0x0, lpFileInformation=0x2ae4cc | out: lpFileInformation=0x2ae4cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7550e00, ftCreationTime.dwHighDateTime=0x1cd0cb2, ftLastAccessTime.dwLowDateTime=0x55e41360, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x26c670, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0xc670)) returned 1 [0163.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0163.096] MoveFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql.anonymous" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql.anonymous")) returned 1 [0163.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.096] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files", lpFilePart=0x0) returned 0x45 [0163.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\", lpFilePart=0x0) returned 0x46 [0163.096] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0163.097] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.097] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0163.097] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.097] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files", lpFilePart=0x0) returned 0x45 [0163.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\", lpFilePart=0x0) returned 0x46 [0163.097] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0163.097] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.098] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0163.098] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.098] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF", lpFilePart=0x0) returned 0x31 [0163.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\", lpFilePart=0x0) returned 0x32 [0163.098] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0163.100] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.100] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.101] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.102] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.103] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.104] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0163.104] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.105] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF", lpFilePart=0x0) returned 0x31 [0163.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\", lpFilePart=0x0) returned 0x32 [0163.106] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbee58 [0163.106] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.107] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 1 [0163.108] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae2ac | out: lpFindFileData=0x2ae2ac) returned 0 [0163.108] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.109] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US", lpFilePart=0x0) returned 0x37 [0163.109] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\", lpFilePart=0x0) returned 0x38 [0163.109] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0163.110] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.110] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.111] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0163.111] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.111] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US", lpFilePart=0x0) returned 0x37 [0163.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\", lpFilePart=0x0) returned 0x38 [0163.111] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0163.111] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.111] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.111] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0163.111] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.111] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts", lpFilePart=0x0) returned 0x37 [0163.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\", lpFilePart=0x0) returned 0x38 [0163.111] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0163.115] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.115] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.115] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.115] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.115] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.115] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0163.115] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.116] GetFullPathNameW (in: lpFileName="\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts", nBufferLength=0x105, lpBuffer=0x2ae008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts", lpFilePart=0x0) returned 0x37 [0163.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2adfdc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\", lpFilePart=0x0) returned 0x38 [0163.117] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbee58 [0163.117] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.118] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.118] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.118] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.118] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 1 [0163.118] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae238 | out: lpFindFileData=0x2ae238) returned 0 [0163.118] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.119] GetFullPathNameW (in: lpFileName="\\Windows\\Migration", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration", lpFilePart=0x0) returned 0x14 [0163.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\Migration\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration\\", lpFilePart=0x0) returned 0x15 [0163.119] FindFirstFileW (in: lpFileName="C:\\Windows\\Migration\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.119] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.119] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.119] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.119] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.119] GetFullPathNameW (in: lpFileName="\\Windows\\Migration", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration", lpFilePart=0x0) returned 0x14 [0163.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\Migration\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration\\", lpFilePart=0x0) returned 0x15 [0163.119] FindFirstFileW (in: lpFileName="C:\\Windows\\Migration\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.120] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.120] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.120] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.120] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.120] GetFullPathNameW (in: lpFileName="\\Windows\\Migration\\WTR", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration\\WTR", lpFilePart=0x0) returned 0x18 [0163.120] GetFullPathNameW (in: lpFileName="C:\\Windows\\Migration\\WTR\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration\\WTR\\", lpFilePart=0x0) returned 0x19 [0163.120] FindFirstFileW (in: lpFileName="C:\\Windows\\Migration\\WTR\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0163.120] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.120] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.120] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.120] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.120] GetFullPathNameW (in: lpFileName="\\Windows\\Migration\\WTR", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration\\WTR", lpFilePart=0x0) returned 0x18 [0163.120] GetFullPathNameW (in: lpFileName="C:\\Windows\\Migration\\WTR\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Migration\\WTR\\", lpFilePart=0x0) returned 0x19 [0163.121] FindFirstFileW (in: lpFileName="C:\\Windows\\Migration\\WTR\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0163.121] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.121] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.121] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.121] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.121] GetFullPathNameW (in: lpFileName="\\Windows\\ModemLogs", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ModemLogs", lpFilePart=0x0) returned 0x14 [0163.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\ModemLogs\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ModemLogs\\", lpFilePart=0x0) returned 0x15 [0163.121] FindFirstFileW (in: lpFileName="C:\\Windows\\ModemLogs\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.121] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.121] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.121] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.121] GetFullPathNameW (in: lpFileName="\\Windows\\ModemLogs", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ModemLogs", lpFilePart=0x0) returned 0x14 [0163.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\ModemLogs\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ModemLogs\\", lpFilePart=0x0) returned 0x15 [0163.122] FindFirstFileW (in: lpFileName="C:\\Windows\\ModemLogs\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.122] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.122] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.122] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.122] GetFullPathNameW (in: lpFileName="\\Windows\\Offline Web Pages", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Offline Web Pages", lpFilePart=0x0) returned 0x1c [0163.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\Offline Web Pages\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Offline Web Pages\\", lpFilePart=0x0) returned 0x1d [0163.122] FindFirstFileW (in: lpFileName="C:\\Windows\\Offline Web Pages\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.122] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.122] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.122] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.122] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.122] GetFullPathNameW (in: lpFileName="\\Windows\\Offline Web Pages", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Offline Web Pages", lpFilePart=0x0) returned 0x1c [0163.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\Offline Web Pages\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Offline Web Pages\\", lpFilePart=0x0) returned 0x1d [0163.122] FindFirstFileW (in: lpFileName="C:\\Windows\\Offline Web Pages\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.123] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.123] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.123] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.123] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.123] GetFullPathNameW (in: lpFileName="\\Windows\\Panther", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther", lpFilePart=0x0) returned 0x12 [0163.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\", lpFilePart=0x0) returned 0x13 [0163.123] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.126] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.127] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.127] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.128] GetFullPathNameW (in: lpFileName="\\Windows\\Panther", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther", lpFilePart=0x0) returned 0x12 [0163.128] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\", lpFilePart=0x0) returned 0x13 [0163.128] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee58 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.129] FindNextFileW (in: hFindFile=0xbee58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.129] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.130] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagerr.xml", nBufferLength=0x105, lpBuffer=0x2ae0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagerr.xml", lpFilePart=0x0) returned 0x1e [0163.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae594) returned 1 [0163.130] CreateFileW (lpFileName="C:\\Windows\\Panther\\diagerr.xml" (normalized: "c:\\windows\\panther\\diagerr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.132] GetFileType (hFile=0x154) returned 0x1 [0163.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae590) returned 1 [0163.132] GetFileType (hFile=0x154) returned 0x1 [0163.132] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x46f5 [0163.132] ReadFile (in: hFile=0x154, lpBuffer=0x1b588e8, nNumberOfBytesToRead=0x46f5, lpNumberOfBytesRead=0x2ae648, lpOverlapped=0x0 | out: lpBuffer=0x1b588e8*, lpNumberOfBytesRead=0x2ae648*=0x46f5, lpOverlapped=0x0) returned 1 [0163.134] CloseHandle (hObject=0x154) returned 1 [0163.146] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagerr.xml", nBufferLength=0x105, lpBuffer=0x2ae08c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagerr.xml", lpFilePart=0x0) returned 0x1e [0163.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae580) returned 1 [0163.146] CreateFileW (lpFileName="C:\\Windows\\Panther\\diagerr.xml" (normalized: "c:\\windows\\panther\\diagerr.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.147] GetFileType (hFile=0x154) returned 0x1 [0163.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae57c) returned 1 [0163.147] GetFileType (hFile=0x154) returned 0x1 [0163.147] WriteFile (in: hFile=0x154, lpBuffer=0x1bbb9d4*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x2ae63c, lpOverlapped=0x0 | out: lpBuffer=0x1bbb9d4*, lpNumberOfBytesWritten=0x2ae63c*=0x4700, lpOverlapped=0x0) returned 1 [0163.149] CloseHandle (hObject=0x154) returned 1 [0163.149] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagerr.xml", nBufferLength=0x105, lpBuffer=0x2ae1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagerr.xml", lpFilePart=0x0) returned 0x1e [0163.149] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagerr.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagerr.xml.anonymous", lpFilePart=0x0) returned 0x28 [0163.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae620) returned 1 [0163.149] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Panther\\diagerr.xml" (normalized: "c:\\windows\\panther\\diagerr.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae69c | out: lpFileInformation=0x2ae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a288e60, ftCreationTime.dwHighDateTime=0x1d2da3e, ftLastAccessTime.dwLowDateTime=0x6a288e60, ftLastAccessTime.dwHighDateTime=0x1d2da3e, ftLastWriteTime.dwLowDateTime=0x2dea90, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x4700)) returned 1 [0163.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.149] MoveFileW (lpExistingFileName="C:\\Windows\\Panther\\diagerr.xml" (normalized: "c:\\windows\\panther\\diagerr.xml"), lpNewFileName="C:\\Windows\\Panther\\diagerr.xml.anonymous" (normalized: "c:\\windows\\panther\\diagerr.xml.anonymous")) returned 1 [0163.150] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagwrn.xml", nBufferLength=0x105, lpBuffer=0x2ae0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagwrn.xml", lpFilePart=0x0) returned 0x1e [0163.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae594) returned 1 [0163.150] CreateFileW (lpFileName="C:\\Windows\\Panther\\diagwrn.xml" (normalized: "c:\\windows\\panther\\diagwrn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.150] GetFileType (hFile=0x154) returned 0x1 [0163.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae590) returned 1 [0163.150] GetFileType (hFile=0x154) returned 0x1 [0163.150] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x5866 [0163.153] ReadFile (in: hFile=0x154, lpBuffer=0x19b0b80, nNumberOfBytesToRead=0x5866, lpNumberOfBytesRead=0x2ae648, lpOverlapped=0x0 | out: lpBuffer=0x19b0b80*, lpNumberOfBytesRead=0x2ae648*=0x5866, lpOverlapped=0x0) returned 1 [0163.160] CloseHandle (hObject=0x154) returned 1 [0163.172] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagwrn.xml", nBufferLength=0x105, lpBuffer=0x2ae08c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagwrn.xml", lpFilePart=0x0) returned 0x1e [0163.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae580) returned 1 [0163.172] CreateFileW (lpFileName="C:\\Windows\\Panther\\diagwrn.xml" (normalized: "c:\\windows\\panther\\diagwrn.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.174] GetFileType (hFile=0x154) returned 0x1 [0163.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae57c) returned 1 [0163.174] GetFileType (hFile=0x154) returned 0x1 [0163.174] WriteFile (in: hFile=0x154, lpBuffer=0x1a194f8*, nNumberOfBytesToWrite=0x5870, lpNumberOfBytesWritten=0x2ae63c, lpOverlapped=0x0 | out: lpBuffer=0x1a194f8*, lpNumberOfBytesWritten=0x2ae63c*=0x5870, lpOverlapped=0x0) returned 1 [0163.175] CloseHandle (hObject=0x154) returned 1 [0163.175] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagwrn.xml", nBufferLength=0x105, lpBuffer=0x2ae1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagwrn.xml", lpFilePart=0x0) returned 0x1e [0163.175] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\diagwrn.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\diagwrn.xml.anonymous", lpFilePart=0x0) returned 0x28 [0163.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae620) returned 1 [0163.175] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Panther\\diagwrn.xml" (normalized: "c:\\windows\\panther\\diagwrn.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae69c | out: lpFileInformation=0x2ae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a288e60, ftCreationTime.dwHighDateTime=0x1d2da3e, ftLastAccessTime.dwLowDateTime=0x6a288e60, ftLastAccessTime.dwHighDateTime=0x1d2da3e, ftLastWriteTime.dwLowDateTime=0x32ad50, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x5870)) returned 1 [0163.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.176] MoveFileW (lpExistingFileName="C:\\Windows\\Panther\\diagwrn.xml" (normalized: "c:\\windows\\panther\\diagwrn.xml"), lpNewFileName="C:\\Windows\\Panther\\diagwrn.xml.anonymous" (normalized: "c:\\windows\\panther\\diagwrn.xml.anonymous")) returned 1 [0163.179] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\unattend.xml", nBufferLength=0x105, lpBuffer=0x2ae0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\unattend.xml", lpFilePart=0x0) returned 0x1f [0163.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae594) returned 1 [0163.179] CreateFileW (lpFileName="C:\\Windows\\Panther\\unattend.xml" (normalized: "c:\\windows\\panther\\unattend.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.180] GetFileType (hFile=0x154) returned 0x1 [0163.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae590) returned 1 [0163.180] GetFileType (hFile=0x154) returned 0x1 [0163.180] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x1ad3 [0163.180] ReadFile (in: hFile=0x154, lpBuffer=0x1a1f0a8, nNumberOfBytesToRead=0x1ad3, lpNumberOfBytesRead=0x2ae648, lpOverlapped=0x0 | out: lpBuffer=0x1a1f0a8*, lpNumberOfBytesRead=0x2ae648*=0x1ad3, lpOverlapped=0x0) returned 1 [0163.186] CloseHandle (hObject=0x154) returned 1 [0163.198] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\unattend.xml", nBufferLength=0x105, lpBuffer=0x2ae08c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\unattend.xml", lpFilePart=0x0) returned 0x1f [0163.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae580) returned 1 [0163.198] CreateFileW (lpFileName="C:\\Windows\\Panther\\unattend.xml" (normalized: "c:\\windows\\panther\\unattend.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.199] GetFileType (hFile=0x154) returned 0x1 [0163.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae57c) returned 1 [0163.199] GetFileType (hFile=0x154) returned 0x1 [0163.199] WriteFile (in: hFile=0x154, lpBuffer=0x1a744f4*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x2ae63c, lpOverlapped=0x0 | out: lpBuffer=0x1a744f4*, lpNumberOfBytesWritten=0x2ae63c*=0x1ae0, lpOverlapped=0x0) returned 1 [0163.200] CloseHandle (hObject=0x154) returned 1 [0163.200] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\unattend.xml", nBufferLength=0x105, lpBuffer=0x2ae1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\unattend.xml", lpFilePart=0x0) returned 0x1f [0163.200] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\unattend.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\unattend.xml.anonymous", lpFilePart=0x0) returned 0x29 [0163.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae620) returned 1 [0163.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Panther\\unattend.xml" (normalized: "c:\\windows\\panther\\unattend.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae69c | out: lpFileInformation=0x2ae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2aefc0, ftCreationTime.dwHighDateTime=0x1d2da3e, ftLastAccessTime.dwLowDateTime=0x9043390, ftLastAccessTime.dwHighDateTime=0x1d2da0d, ftLastWriteTime.dwLowDateTime=0x377010, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0)) returned 1 [0163.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.201] MoveFileW (lpExistingFileName="C:\\Windows\\Panther\\unattend.xml" (normalized: "c:\\windows\\panther\\unattend.xml"), lpNewFileName="C:\\Windows\\Panther\\unattend.xml.anonymous" (normalized: "c:\\windows\\panther\\unattend.xml.anonymous")) returned 1 [0163.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.201] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\actionqueue", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\actionqueue", lpFilePart=0x0) returned 0x1e [0163.201] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\actionqueue\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\actionqueue\\", lpFilePart=0x0) returned 0x1f [0163.201] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\actionqueue\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0163.201] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.201] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.201] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.201] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.201] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0163.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.202] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\actionqueue", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\actionqueue", lpFilePart=0x0) returned 0x1e [0163.202] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\actionqueue\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\actionqueue\\", lpFilePart=0x0) returned 0x1f [0163.202] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\actionqueue\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0163.202] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.202] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.202] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.202] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.202] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0163.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.202] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\setup.exe", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\setup.exe", lpFilePart=0x0) returned 0x1c [0163.202] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\setup.exe\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\setup.exe\\", lpFilePart=0x0) returned 0x1d [0163.202] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\setup.exe\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0163.203] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.203] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.203] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0163.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.203] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\setup.exe", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\setup.exe", lpFilePart=0x0) returned 0x1c [0163.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\setup.exe\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\setup.exe\\", lpFilePart=0x0) returned 0x1d [0163.203] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\setup.exe\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.204] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0163.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.204] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC", lpFilePart=0x0) returned 0x1d [0163.204] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\", lpFilePart=0x0) returned 0x1e [0163.204] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.204] FindNextFileW (in: hFindFile=0xbe918, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.204] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0163.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.205] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC", lpFilePart=0x0) returned 0x1d [0163.205] GetFullPathNameW (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\", lpFilePart=0x0) returned 0x1e [0163.205] FindFirstFileW (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe918 [0163.205] FindClose (in: hFindFile=0xbe918 | out: hFindFile=0xbe918) returned 1 [0163.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.205] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagerr.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml", lpFilePart=0x0) returned 0x29 [0163.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0163.205] CreateFileW (lpFileName="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagerr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.205] GetFileType (hFile=0x154) returned 0x1 [0163.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0163.205] GetFileType (hFile=0x154) returned 0x1 [0163.205] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1010 [0163.207] CloseHandle (hObject=0x154) returned 1 [0163.219] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagerr.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml", lpFilePart=0x0) returned 0x29 [0163.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0163.219] CreateFileW (lpFileName="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagerr.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.220] GetFileType (hFile=0x154) returned 0x1 [0163.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0163.220] GetFileType (hFile=0x154) returned 0x1 [0163.220] WriteFile (in: hFile=0x154, lpBuffer=0x1acb87c*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1acb87c*, lpNumberOfBytesWritten=0x2ae5c8*=0x1020, lpOverlapped=0x0) returned 1 [0163.221] CloseHandle (hObject=0x154) returned 1 [0163.222] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagerr.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml", lpFilePart=0x0) returned 0x29 [0163.222] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagerr.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml.anonymous", lpFilePart=0x0) returned 0x33 [0163.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0163.222] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagerr.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0243de0, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xb0243de0, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0x39d170, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x1020)) returned 1 [0163.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.222] MoveFileW (lpExistingFileName="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagerr.xml"), lpNewFileName="C:\\Windows\\Panther\\UnattendGC\\diagerr.xml.anonymous" (normalized: "c:\\windows\\panther\\unattendgc\\diagerr.xml.anonymous")) returned 1 [0163.224] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagwrn.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml", lpFilePart=0x0) returned 0x29 [0163.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae520) returned 1 [0163.224] CreateFileW (lpFileName="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagwrn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.224] GetFileType (hFile=0x154) returned 0x1 [0163.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae51c) returned 1 [0163.224] GetFileType (hFile=0x154) returned 0x1 [0163.224] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x129f [0163.227] CloseHandle (hObject=0x154) returned 1 [0163.238] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagwrn.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml", lpFilePart=0x0) returned 0x29 [0163.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae50c) returned 1 [0163.239] CreateFileW (lpFileName="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagwrn.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.241] GetFileType (hFile=0x154) returned 0x1 [0163.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae508) returned 1 [0163.241] GetFileType (hFile=0x154) returned 0x1 [0163.241] WriteFile (in: hFile=0x154, lpBuffer=0x1b1f6d0*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x2ae5c8, lpOverlapped=0x0 | out: lpBuffer=0x1b1f6d0*, lpNumberOfBytesWritten=0x2ae5c8*=0x12a0, lpOverlapped=0x0) returned 1 [0163.244] CloseHandle (hObject=0x154) returned 1 [0163.244] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagwrn.xml", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml", lpFilePart=0x0) returned 0x29 [0163.244] GetFullPathNameW (in: lpFileName="\\Windows\\Panther\\UnattendGC\\diagwrn.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml.anonymous", lpFilePart=0x0) returned 0x33 [0163.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5ac) returned 1 [0163.244] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagwrn.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0243de0, ftCreationTime.dwHighDateTime=0x1d2da36, ftLastAccessTime.dwLowDateTime=0xb0243de0, ftLastAccessTime.dwHighDateTime=0x1d2da36, ftLastWriteTime.dwLowDateTime=0x3c32d0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x12a0)) returned 1 [0163.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.244] MoveFileW (lpExistingFileName="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml" (normalized: "c:\\windows\\panther\\unattendgc\\diagwrn.xml"), lpNewFileName="C:\\Windows\\Panther\\UnattendGC\\diagwrn.xml.anonymous" (normalized: "c:\\windows\\panther\\unattendgc\\diagwrn.xml.anonymous")) returned 1 [0163.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.245] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH", lpFilePart=0x0) returned 0x13 [0163.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\", lpFilePart=0x0) returned 0x14 [0163.245] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0163.246] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.246] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH", lpFilePart=0x0) returned 0x13 [0163.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\", lpFilePart=0x0) returned 0x14 [0163.246] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0163.246] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.246] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH\\ERRORREP", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP", lpFilePart=0x0) returned 0x1c [0163.246] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\", lpFilePart=0x0) returned 0x1d [0163.246] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0163.247] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.247] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH\\ERRORREP", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP", lpFilePart=0x0) returned 0x1c [0163.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\", lpFilePart=0x0) returned 0x1d [0163.247] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0163.247] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.247] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES", lpFilePart=0x0) returned 0x25 [0163.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\", lpFilePart=0x0) returned 0x26 [0163.247] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0163.247] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.248] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES", lpFilePart=0x0) returned 0x25 [0163.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\", lpFilePart=0x0) returned 0x26 [0163.248] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0163.248] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.248] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF", lpFilePart=0x0) returned 0x25 [0163.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\", lpFilePart=0x0) returned 0x26 [0163.248] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0163.248] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.248] GetFullPathNameW (in: lpFileName="\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF", lpFilePart=0x0) returned 0x25 [0163.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\", lpFilePart=0x0) returned 0x26 [0163.249] FindFirstFileW (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0163.249] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.249] GetFullPathNameW (in: lpFileName="\\Windows\\Performance", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance", lpFilePart=0x0) returned 0x16 [0163.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\Performance\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\", lpFilePart=0x0) returned 0x17 [0163.249] FindFirstFileW (in: lpFileName="C:\\Windows\\Performance\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0163.249] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.249] GetFullPathNameW (in: lpFileName="\\Windows\\Performance", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance", lpFilePart=0x0) returned 0x16 [0163.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\Performance\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\", lpFilePart=0x0) returned 0x17 [0163.249] FindFirstFileW (in: lpFileName="C:\\Windows\\Performance\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf118 [0163.249] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.249] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT", lpFilePart=0x0) returned 0x1d [0163.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\", lpFilePart=0x0) returned 0x1e [0163.250] FindFirstFileW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0163.250] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.250] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT", lpFilePart=0x0) returned 0x1d [0163.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\", lpFilePart=0x0) returned 0x1e [0163.250] FindFirstFileW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf118 [0163.250] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.250] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore", lpFilePart=0x0) returned 0x27 [0163.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\", lpFilePart=0x0) returned 0x28 [0163.250] FindFirstFileW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0163.250] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.251] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore", lpFilePart=0x0) returned 0x27 [0163.251] GetFullPathNameW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\", lpFilePart=0x0) returned 0x28 [0163.251] FindFirstFileW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf118 [0163.251] FindClose (in: hFindFile=0xbf118 | out: hFindFile=0xbf118) returned 1 [0163.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.251] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0163.251] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-05-31 11.01.22.116 dwm.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.251] GetFileType (hFile=0x154) returned 0x1 [0163.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0163.251] GetFileType (hFile=0x154) returned 0x1 [0163.251] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x276a [0163.253] CloseHandle (hObject=0x154) returned 1 [0163.264] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0163.264] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-05-31 11.01.22.116 dwm.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.266] GetFileType (hFile=0x154) returned 0x1 [0163.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0163.266] GetFileType (hFile=0x154) returned 0x1 [0163.266] WriteFile (in: hFile=0x154, lpBuffer=0x1b869e4*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b869e4*, lpNumberOfBytesWritten=0x2ae554*=0x2770, lpOverlapped=0x0) returned 1 [0163.267] CloseHandle (hObject=0x154) returned 1 [0163.267] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.267] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x6d [0163.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0163.267] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-05-31 11.01.22.116 dwm.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x243aa80, ftCreationTime.dwHighDateTime=0x1d2da0e, ftLastAccessTime.dwLowDateTime=0x243aa80, ftLastAccessTime.dwHighDateTime=0x1d2da0e, ftLastWriteTime.dwLowDateTime=0x40f590, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x2770)) returned 1 [0163.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.267] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-05-31 11.01.22.116 dwm.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-05-31 11.01.22.116 DWM.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-05-31 11.01.22.116 dwm.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.268] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0163.268] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 cpu.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.268] GetFileType (hFile=0x154) returned 0x1 [0163.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0163.268] GetFileType (hFile=0x154) returned 0x1 [0163.268] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x753a [0163.278] CloseHandle (hObject=0x154) returned 1 [0163.292] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0163.292] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 cpu.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.293] GetFileType (hFile=0x154) returned 0x1 [0163.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0163.293] GetFileType (hFile=0x154) returned 0x1 [0163.293] WriteFile (in: hFile=0x154, lpBuffer=0x1a03448*, nNumberOfBytesToWrite=0x7540, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a03448*, lpNumberOfBytesWritten=0x2ae554*=0x7540, lpOverlapped=0x0) returned 1 [0163.295] CloseHandle (hObject=0x154) returned 1 [0163.295] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.295] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x6d [0163.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0163.295] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 cpu.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385bcd00, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0x385bcd00, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0x45b850, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x7540)) returned 1 [0163.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.295] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 cpu.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Cpu.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 cpu.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.296] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x64 [0163.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0163.296] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 disk.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.296] GetFileType (hFile=0x154) returned 0x1 [0163.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0163.296] GetFileType (hFile=0x154) returned 0x1 [0163.296] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xdcb8 [0163.309] CloseHandle (hObject=0x154) returned 1 [0163.322] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x64 [0163.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0163.322] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 disk.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.325] GetFileType (hFile=0x154) returned 0x1 [0163.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0163.325] GetFileType (hFile=0x154) returned 0x1 [0163.325] WriteFile (in: hFile=0x154, lpBuffer=0x1a81554*, nNumberOfBytesToWrite=0xdcc0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a81554*, lpNumberOfBytesWritten=0x2ae554*=0xdcc0, lpOverlapped=0x0) returned 1 [0163.327] CloseHandle (hObject=0x154) returned 1 [0163.327] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x64 [0163.327] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x6e [0163.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0163.327] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 disk.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385e2e60, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0x385e2e60, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0x4a7b10, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0xdcc0)) returned 1 [0163.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.327] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 disk.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Disk.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 disk.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.328] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x6a [0163.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0163.328] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphics3d.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.328] GetFileType (hFile=0x154) returned 0x1 [0163.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0163.328] GetFileType (hFile=0x154) returned 0x1 [0163.328] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9ac0 [0163.334] CloseHandle (hObject=0x154) returned 1 [0163.346] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x6a [0163.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0163.346] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphics3d.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.348] GetFileType (hFile=0x154) returned 0x1 [0163.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0163.348] GetFileType (hFile=0x154) returned 0x1 [0163.348] WriteFile (in: hFile=0x154, lpBuffer=0x1b0cc6c*, nNumberOfBytesToWrite=0x9ad0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b0cc6c*, lpNumberOfBytesWritten=0x2ae554*=0x9ad0, lpOverlapped=0x0) returned 1 [0163.350] CloseHandle (hObject=0x154) returned 1 [0163.350] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x6a [0163.350] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x74 [0163.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0163.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphics3d.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385bcd00, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0x385bcd00, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0x4cdc70, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x9ad0)) returned 1 [0163.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.350] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphics3d.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Graphics3D.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphics3d.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.351] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x6d [0163.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae4ac) returned 1 [0163.351] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphicsmedia.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.352] GetFileType (hFile=0x154) returned 0x1 [0163.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4a8) returned 1 [0163.352] GetFileType (hFile=0x154) returned 0x1 [0163.352] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x2f94 [0163.362] CloseHandle (hObject=0x154) returned 1 [0163.373] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x6d [0163.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae498) returned 1 [0163.373] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphicsmedia.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.375] GetFileType (hFile=0x154) returned 0x1 [0163.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae494) returned 1 [0163.375] GetFileType (hFile=0x154) returned 0x1 [0163.375] WriteFile (in: hFile=0x154, lpBuffer=0x1b729e8*, nNumberOfBytesToWrite=0x2fa0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1b729e8*, lpNumberOfBytesWritten=0x2ae554*=0x2fa0, lpOverlapped=0x0) returned 1 [0163.376] CloseHandle (hObject=0x154) returned 1 [0163.376] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x6d [0163.376] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x77 [0163.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae538) returned 1 [0163.376] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphicsmedia.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385bcd00, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0x385bcd00, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0x519f30, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0)) returned 1 [0163.376] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphicsmedia.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 GraphicsMedia.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 graphicsmedia.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.377] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.377] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 mem.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.377] GetFileType (hFile=0x154) returned 0x1 [0163.377] GetFileType (hFile=0x154) returned 0x1 [0163.377] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x20e4 [0163.386] CloseHandle (hObject=0x154) returned 1 [0163.399] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.399] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 mem.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.401] GetFileType (hFile=0x154) returned 0x1 [0163.401] GetFileType (hFile=0x154) returned 0x1 [0163.401] WriteFile (in: hFile=0x154, lpBuffer=0x19c7e54*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x19c7e54*, lpNumberOfBytesWritten=0x2ae554*=0x20f0, lpOverlapped=0x0) returned 1 [0163.402] CloseHandle (hObject=0x154) returned 1 [0163.402] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x63 [0163.402] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x6d [0163.402] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 mem.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385e2e60, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0x385e2e60, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0x5661f0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x20f0)) returned 1 [0163.402] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 mem.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.51.56.143 Mem.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.51.56.143 mem.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.403] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x66 [0163.403] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.55.07.538 formal.assessment (initial).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.403] GetFileType (hFile=0x154) returned 0x1 [0163.403] GetFileType (hFile=0x154) returned 0x1 [0163.403] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1ef90 [0163.404] ReadFile (in: hFile=0x154, lpBuffer=0x2b412e28, nNumberOfBytesToRead=0x1ef90, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2b412e28*, lpNumberOfBytesRead=0x2ae560*=0x1ef90, lpOverlapped=0x0) returned 1 [0163.412] CloseHandle (hObject=0x154) returned 1 [0163.431] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x66 [0163.431] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.55.07.538 formal.assessment (initial).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.433] GetFileType (hFile=0x154) returned 0x1 [0163.433] GetFileType (hFile=0x154) returned 0x1 [0163.433] WriteFile (in: hFile=0x154, lpBuffer=0x2b4adc78*, nNumberOfBytesToWrite=0x1efa0, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2b4adc78*, lpNumberOfBytesWritten=0x2ae554*=0x1efa0, lpOverlapped=0x0) returned 1 [0163.436] CloseHandle (hObject=0x154) returned 1 [0163.436] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml", lpFilePart=0x0) returned 0x66 [0163.436] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x70 [0163.436] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.55.07.538 formal.assessment (initial).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38739ac0, ftCreationTime.dwHighDateTime=0x1d2f5c0, ftLastAccessTime.dwLowDateTime=0x38739ac0, ftLastAccessTime.dwHighDateTime=0x1d2f5c0, ftLastWriteTime.dwLowDateTime=0x5b24b0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x1efa0)) returned 1 [0163.436] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.55.07.538 formal.assessment (initial).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-07-05 16.55.07.538 Formal.Assessment (Initial).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-07-05 16.55.07.538 formal.assessment (initial).winsat.xml.anonymous")) returned 1 [0163.437] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml", lpFilePart=0x0) returned 0x62 [0163.437] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.38.16.229 cpu.assessment (recent).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.438] GetFileType (hFile=0x154) returned 0x1 [0163.438] GetFileType (hFile=0x154) returned 0x1 [0163.438] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x765e [0163.459] CloseHandle (hObject=0x154) returned 1 [0163.471] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml", lpFilePart=0x0) returned 0x62 [0163.471] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.38.16.229 cpu.assessment (recent).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.473] GetFileType (hFile=0x154) returned 0x1 [0163.473] GetFileType (hFile=0x154) returned 0x1 [0163.474] WriteFile (in: hFile=0x154, lpBuffer=0x1a89910*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1a89910*, lpNumberOfBytesWritten=0x2ae554*=0x7660, lpOverlapped=0x0) returned 1 [0163.476] CloseHandle (hObject=0x154) returned 1 [0163.476] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml", lpFilePart=0x0) returned 0x62 [0163.477] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x6c [0163.477] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.38.16.229 cpu.assessment (recent).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3df1e90, ftCreationTime.dwHighDateTime=0x1d336f6, ftLastAccessTime.dwLowDateTime=0xd3df1e90, ftLastAccessTime.dwHighDateTime=0x1d336f6, ftLastWriteTime.dwLowDateTime=0x5fe770, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x7660)) returned 1 [0163.477] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.38.16.229 cpu.assessment (recent).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.38.16.229 Cpu.Assessment (Recent).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.38.16.229 cpu.assessment (recent).winsat.xml.anonymous")) returned 1 [0163.477] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfb8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml", lpFilePart=0x0) returned 0x65 [0163.477] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.39.46.834 formal.assessment (recent).winsat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.477] GetFileType (hFile=0x154) returned 0x1 [0163.478] GetFileType (hFile=0x154) returned 0x1 [0163.478] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1f0f0 [0163.478] ReadFile (in: hFile=0x154, lpBuffer=0x2b4ccc38, nNumberOfBytesToRead=0x1f0f0, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2b4ccc38*, lpNumberOfBytesRead=0x2ae560*=0x1f0f0, lpOverlapped=0x0) returned 1 [0163.481] CloseHandle (hObject=0x154) returned 1 [0163.500] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2adfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml", lpFilePart=0x0) returned 0x65 [0163.500] CreateFileW (lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.39.46.834 formal.assessment (recent).winsat.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.502] GetFileType (hFile=0x154) returned 0x1 [0163.502] GetFileType (hFile=0x154) returned 0x1 [0163.502] WriteFile (in: hFile=0x154, lpBuffer=0x2b568168*, nNumberOfBytesToWrite=0x1f100, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x2b568168*, lpNumberOfBytesWritten=0x2ae554*=0x1f100, lpOverlapped=0x0) returned 1 [0163.505] CloseHandle (hObject=0x154) returned 1 [0163.505] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml", lpFilePart=0x0) returned 0x65 [0163.505] GetFullPathNameW (in: lpFileName="\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml.anonymous", nBufferLength=0x105, lpBuffer=0x2ae0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml.anonymous", lpFilePart=0x0) returned 0x6f [0163.505] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.39.46.834 formal.assessment (recent).winsat.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40071d0, ftCreationTime.dwHighDateTime=0x1d336f6, ftLastAccessTime.dwLowDateTime=0xd40071d0, ftLastAccessTime.dwHighDateTime=0x1d336f6, ftLastWriteTime.dwLowDateTime=0x64aa30, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x1f100)) returned 1 [0163.506] MoveFileW (lpExistingFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.39.46.834 formal.assessment (recent).winsat.xml"), lpNewFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\2017-09-26 16.39.46.834 Formal.Assessment (Recent).WinSAT.xml.anonymous" (normalized: "c:\\windows\\performance\\winsat\\datastore\\2017-09-26 16.39.46.834 formal.assessment (recent).winsat.xml.anonymous")) returned 1 [0163.506] GetFullPathNameW (in: lpFileName="\\Windows\\PLA", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA", lpFilePart=0x0) returned 0xe [0163.506] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\", lpFilePart=0x0) returned 0xf [0163.506] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbeb98 [0163.507] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0163.507] GetFullPathNameW (in: lpFileName="\\Windows\\PLA", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA", lpFilePart=0x0) returned 0xe [0163.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\", lpFilePart=0x0) returned 0xf [0163.507] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbeb98 [0163.507] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0163.507] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Reports", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Reports", lpFilePart=0x0) returned 0x16 [0163.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\Reports\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Reports\\", lpFilePart=0x0) returned 0x17 [0163.507] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\Reports\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0163.509] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0163.510] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Reports", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Reports", lpFilePart=0x0) returned 0x16 [0163.510] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\Reports\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Reports\\", lpFilePart=0x0) returned 0x17 [0163.510] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\Reports\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbeb98 [0163.511] FindClose (in: hFindFile=0xbeb98 | out: hFindFile=0xbeb98) returned 1 [0163.512] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Reports\\Report.System.Common.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Reports\\Report.System.Common.xml", lpFilePart=0x0) returned 0x2f [0163.512] CreateFileW (lpFileName="C:\\Windows\\PLA\\Reports\\Report.System.Common.xml" (normalized: "c:\\windows\\pla\\reports\\report.system.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.530] GetFileType (hFile=0x154) returned 0x1 [0163.530] GetFileType (hFile=0x154) returned 0x1 [0163.530] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x787 [0163.536] CloseHandle (hObject=0x154) returned 1 [0163.547] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Reports\\Report.System.Common.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Reports\\Report.System.Common.xml", lpFilePart=0x0) returned 0x2f [0163.548] CreateFileW (lpFileName="C:\\Windows\\PLA\\Reports\\Report.System.Common.xml" (normalized: "c:\\windows\\pla\\reports\\report.system.common.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0163.549] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Rules", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Rules", lpFilePart=0x0) returned 0x14 [0163.549] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\Rules\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Rules\\", lpFilePart=0x0) returned 0x15 [0163.549] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\Rules\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0163.552] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.553] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Rules", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Rules", lpFilePart=0x0) returned 0x14 [0163.553] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\Rules\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Rules\\", lpFilePart=0x0) returned 0x15 [0163.553] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\Rules\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbee58 [0163.556] FindClose (in: hFindFile=0xbee58 | out: hFindFile=0xbee58) returned 1 [0163.557] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Rules\\Rules.System.Common.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Rules\\Rules.System.Common.xml", lpFilePart=0x0) returned 0x2c [0163.557] CreateFileW (lpFileName="C:\\Windows\\PLA\\Rules\\Rules.System.Common.xml" (normalized: "c:\\windows\\pla\\rules\\rules.system.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.559] GetFileType (hFile=0x154) returned 0x1 [0163.559] GetFileType (hFile=0x154) returned 0x1 [0163.559] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xbf3 [0163.559] ReadFile (in: hFile=0x154, lpBuffer=0x1b37bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b37bb0*, lpNumberOfBytesRead=0x2ae5d4*=0xbf3, lpOverlapped=0x0) returned 1 [0163.569] CloseHandle (hObject=0x154) returned 1 [0163.603] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Rules\\Rules.System.Common.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Rules\\Rules.System.Common.xml", lpFilePart=0x0) returned 0x2c [0163.603] CreateFileW (lpFileName="C:\\Windows\\PLA\\Rules\\Rules.System.Common.xml" (normalized: "c:\\windows\\pla\\rules\\rules.system.common.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0163.604] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\System", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\System", lpFilePart=0x0) returned 0x15 [0163.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\System\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\System\\", lpFilePart=0x0) returned 0x16 [0163.604] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\System\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0163.605] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0163.605] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\System", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\System", lpFilePart=0x0) returned 0x15 [0163.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\System\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\System\\", lpFilePart=0x0) returned 0x16 [0163.605] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\System\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbe8d8 [0163.606] FindClose (in: hFindFile=0xbe8d8 | out: hFindFile=0xbe8d8) returned 1 [0163.606] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\System\\System Diagnostics.xml", nBufferLength=0x105, lpBuffer=0x2ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\System\\System Diagnostics.xml", lpFilePart=0x0) returned 0x2c [0163.606] CreateFileW (lpFileName="C:\\Windows\\PLA\\System\\System Diagnostics.xml" (normalized: "c:\\windows\\pla\\system\\system diagnostics.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.606] GetFileType (hFile=0x154) returned 0x1 [0163.606] GetFileType (hFile=0x154) returned 0x1 [0163.606] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x34e5 [0163.607] ReadFile (in: hFile=0x154, lpBuffer=0x1b8ae58, nNumberOfBytesToRead=0x34e5, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x1b8ae58*, lpNumberOfBytesRead=0x2ae5d4*=0x34e5, lpOverlapped=0x0) returned 1 [0163.608] CloseHandle (hObject=0x154) returned 1 [0163.622] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\System\\System Diagnostics.xml", nBufferLength=0x105, lpBuffer=0x2ae018, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\System\\System Diagnostics.xml", lpFilePart=0x0) returned 0x2c [0163.622] CreateFileW (lpFileName="C:\\Windows\\PLA\\System\\System Diagnostics.xml" (normalized: "c:\\windows\\pla\\system\\system diagnostics.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0163.624] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Templates", lpFilePart=0x0) returned 0x18 [0163.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Templates\\", lpFilePart=0x0) returned 0x19 [0163.624] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.624] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.624] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.624] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.624] GetFullPathNameW (in: lpFileName="\\Windows\\PLA\\Templates", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Templates", lpFilePart=0x0) returned 0x18 [0163.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\PLA\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PLA\\Templates\\", lpFilePart=0x0) returned 0x19 [0163.625] FindFirstFileW (in: lpFileName="C:\\Windows\\PLA\\Templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.625] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 1 [0163.625] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae394 | out: lpFindFileData=0x2ae394) returned 0 [0163.625] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.625] GetFullPathNameW (in: lpFileName="\\Windows\\PolicyDefinitions", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions", lpFilePart=0x0) returned 0x1c [0163.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions\\", lpFilePart=0x0) returned 0x1d [0163.625] FindFirstFileW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.628] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.629] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.630] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.631] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.631] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.631] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.631] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.632] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.633] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.634] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.635] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.635] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.635] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.636] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.637] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.638] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.639] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.640] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.641] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.642] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 0 [0163.642] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.643] GetFullPathNameW (in: lpFileName="\\Windows\\PolicyDefinitions", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions", lpFilePart=0x0) returned 0x1c [0163.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions\\", lpFilePart=0x0) returned 0x1d [0163.643] FindFirstFileW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.644] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.644] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.644] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.644] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.645] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.646] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.647] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.648] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.648] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.648] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.648] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.648] FindNextFileW (in: hFindFile=0xbf218, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0163.648] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.649] GetFullPathNameW (in: lpFileName="\\Windows\\PolicyDefinitions\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions\\en-US", lpFilePart=0x0) returned 0x22 [0163.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions\\en-US\\", lpFilePart=0x0) returned 0x23 [0163.649] FindFirstFileW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.658] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.661] GetFullPathNameW (in: lpFileName="\\Windows\\PolicyDefinitions\\en-US", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions\\en-US", lpFilePart=0x0) returned 0x22 [0163.661] GetFullPathNameW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\PolicyDefinitions\\en-US\\", lpFilePart=0x0) returned 0x23 [0163.661] FindFirstFileW (in: lpFileName="C:\\Windows\\PolicyDefinitions\\en-US\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.664] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.667] GetFullPathNameW (in: lpFileName="\\Windows\\Prefetch", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch", lpFilePart=0x0) returned 0x13 [0163.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\", lpFilePart=0x0) returned 0x14 [0163.667] FindFirstFileW (in: lpFileName="C:\\Windows\\Prefetch\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.668] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.668] GetFullPathNameW (in: lpFileName="\\Windows\\Prefetch", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch", lpFilePart=0x0) returned 0x13 [0163.668] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\", lpFilePart=0x0) returned 0x14 [0163.668] FindFirstFileW (in: lpFileName="C:\\Windows\\Prefetch\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.668] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.669] GetFullPathNameW (in: lpFileName="\\Windows\\Prefetch\\ReadyBoot", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot", lpFilePart=0x0) returned 0x1d [0163.669] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot\\", lpFilePart=0x0) returned 0x1e [0163.669] FindFirstFileW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.669] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.669] GetFullPathNameW (in: lpFileName="\\Windows\\Prefetch\\ReadyBoot", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot", lpFilePart=0x0) returned 0x1d [0163.669] GetFullPathNameW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Prefetch\\ReadyBoot\\", lpFilePart=0x0) returned 0x1e [0163.669] FindFirstFileW (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.669] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.670] GetFullPathNameW (in: lpFileName="\\Windows\\Registration", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration", lpFilePart=0x0) returned 0x17 [0163.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\Registration\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration\\", lpFilePart=0x0) returned 0x18 [0163.670] FindFirstFileW (in: lpFileName="C:\\Windows\\Registration\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.670] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.670] GetFullPathNameW (in: lpFileName="\\Windows\\Registration", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration", lpFilePart=0x0) returned 0x17 [0163.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\Registration\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration\\", lpFilePart=0x0) returned 0x18 [0163.670] FindFirstFileW (in: lpFileName="C:\\Windows\\Registration\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.670] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.670] GetFullPathNameW (in: lpFileName="\\Windows\\Registration\\CRMLog", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration\\CRMLog", lpFilePart=0x0) returned 0x1e [0163.670] GetFullPathNameW (in: lpFileName="C:\\Windows\\Registration\\CRMLog\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration\\CRMLog\\", lpFilePart=0x0) returned 0x1f [0163.671] FindFirstFileW (in: lpFileName="C:\\Windows\\Registration\\CRMLog\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.671] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.671] GetFullPathNameW (in: lpFileName="\\Windows\\Registration\\CRMLog", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration\\CRMLog", lpFilePart=0x0) returned 0x1e [0163.671] GetFullPathNameW (in: lpFileName="C:\\Windows\\Registration\\CRMLog\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Registration\\CRMLog\\", lpFilePart=0x0) returned 0x1f [0163.671] FindFirstFileW (in: lpFileName="C:\\Windows\\Registration\\CRMLog\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.671] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.671] GetFullPathNameW (in: lpFileName="\\Windows\\rescache", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache", lpFilePart=0x0) returned 0x13 [0163.671] GetFullPathNameW (in: lpFileName="C:\\Windows\\rescache\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\", lpFilePart=0x0) returned 0x14 [0163.671] FindFirstFileW (in: lpFileName="C:\\Windows\\rescache\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.671] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.672] GetFullPathNameW (in: lpFileName="\\Windows\\rescache", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache", lpFilePart=0x0) returned 0x13 [0163.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\rescache\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\", lpFilePart=0x0) returned 0x14 [0163.672] FindFirstFileW (in: lpFileName="C:\\Windows\\rescache\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.672] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.672] GetFullPathNameW (in: lpFileName="\\Windows\\rescache\\rc0001", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0001", lpFilePart=0x0) returned 0x1a [0163.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\rescache\\rc0001\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0001\\", lpFilePart=0x0) returned 0x1b [0163.672] FindFirstFileW (in: lpFileName="C:\\Windows\\rescache\\rc0001\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.672] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.672] GetFullPathNameW (in: lpFileName="\\Windows\\rescache\\rc0001", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0001", lpFilePart=0x0) returned 0x1a [0163.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\rescache\\rc0001\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0001\\", lpFilePart=0x0) returned 0x1b [0163.673] FindFirstFileW (in: lpFileName="C:\\Windows\\rescache\\rc0001\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.673] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.673] GetFullPathNameW (in: lpFileName="\\Windows\\rescache\\rc0002", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0002", lpFilePart=0x0) returned 0x1a [0163.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\rescache\\rc0002\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0002\\", lpFilePart=0x0) returned 0x1b [0163.673] FindFirstFileW (in: lpFileName="C:\\Windows\\rescache\\rc0002\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.673] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.673] GetFullPathNameW (in: lpFileName="\\Windows\\rescache\\rc0002", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0002", lpFilePart=0x0) returned 0x1a [0163.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\rescache\\rc0002\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\rescache\\rc0002\\", lpFilePart=0x0) returned 0x1b [0163.673] FindFirstFileW (in: lpFileName="C:\\Windows\\rescache\\rc0002\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.673] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.674] GetFullPathNameW (in: lpFileName="\\Windows\\Resources", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources", lpFilePart=0x0) returned 0x14 [0163.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\", lpFilePart=0x0) returned 0x15 [0163.674] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.674] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.674] GetFullPathNameW (in: lpFileName="\\Windows\\Resources", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources", lpFilePart=0x0) returned 0x14 [0163.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\", lpFilePart=0x0) returned 0x15 [0163.674] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.674] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.674] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Ease of Access Themes", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Ease of Access Themes", lpFilePart=0x0) returned 0x2a [0163.675] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Ease of Access Themes\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Ease of Access Themes\\", lpFilePart=0x0) returned 0x2b [0163.675] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Ease of Access Themes\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.678] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.680] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Ease of Access Themes", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Ease of Access Themes", lpFilePart=0x0) returned 0x2a [0163.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Ease of Access Themes\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Ease of Access Themes\\", lpFilePart=0x0) returned 0x2b [0163.680] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Ease of Access Themes\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.682] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.685] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Themes", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes", lpFilePart=0x0) returned 0x1b [0163.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Themes\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\", lpFilePart=0x0) returned 0x1c [0163.685] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.685] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.685] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Themes", nBufferLength=0x105, lpBuffer=0x2ae164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes", lpFilePart=0x0) returned 0x1b [0163.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Themes\\", nBufferLength=0x105, lpBuffer=0x2ae138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\", lpFilePart=0x0) returned 0x1c [0163.685] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.685] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.685] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Themes\\Aero", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero", lpFilePart=0x0) returned 0x20 [0163.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero\\", lpFilePart=0x0) returned 0x21 [0163.686] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0163.686] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.686] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Themes\\Aero", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero", lpFilePart=0x0) returned 0x20 [0163.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\", nBufferLength=0x105, lpBuffer=0x2ae0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero\\", lpFilePart=0x0) returned 0x21 [0163.686] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0163.686] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.686] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Themes\\Aero\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero\\en-US", lpFilePart=0x0) returned 0x26 [0163.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\", lpFilePart=0x0) returned 0x27 [0163.686] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.687] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.687] GetFullPathNameW (in: lpFileName="\\Windows\\Resources\\Themes\\Aero\\en-US", nBufferLength=0x105, lpBuffer=0x2ae07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero\\en-US", lpFilePart=0x0) returned 0x26 [0163.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\", lpFilePart=0x0) returned 0x27 [0163.687] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.687] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.687] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.687] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.687] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.688] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.688] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.688] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.688] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.688] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0163.688] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.688] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0163.689] FindFirstFileW (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\en-US\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.689] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.689] FindFirstFileW (in: lpFileName="C:\\Windows\\SchCache\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.689] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.689] FindFirstFileW (in: lpFileName="C:\\Windows\\SchCache\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.689] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.690] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.693] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.695] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.697] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.700] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\AvailableNetwork\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.703] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.703] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\AvailableNetwork\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.703] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.703] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\EAPHost\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.705] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.706] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\EAPHost\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.707] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.708] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.709] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.710] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.711] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.712] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\TSWorkSpace\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.713] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.713] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\TSWorkSpace\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.713] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.713] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\WCN\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.713] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.713] FindFirstFileW (in: lpFileName="C:\\Windows\\schemas\\WCN\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.713] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.714] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.715] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.716] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.717] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.718] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\ApplicationId\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.719] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.719] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\ApplicationId\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.719] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.719] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\ApplicationId\\PolicyManagement\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0163.720] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.720] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\ApplicationId\\PolicyManagement\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0163.720] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.720] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\audit\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.720] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.721] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\audit\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.721] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.721] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\database\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.722] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.724] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\database\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.725] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.726] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\logs\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.726] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.726] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\logs\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.726] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.726] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.727] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.727] FindFirstFileW (in: lpFileName="C:\\Windows\\security\\templates\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.727] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.727] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.727] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0163.727] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbf218 [0163.727] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0163.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.728] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.728] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae65c) returned 1 [0163.728] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf218 [0163.728] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae61c) returned 1 [0163.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae628) returned 1 [0163.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.728] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0163.728] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e8) returned 1 [0163.729] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf218 [0163.729] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5a8) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5b4) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.729] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.729] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae574) returned 1 [0163.729] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.729] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae534) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae540) returned 1 [0163.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.729] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.730] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae500) returned 1 [0163.730] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.730] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4c0) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae4cc) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0163.730] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.730] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae48c) returned 1 [0163.730] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.730] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae44c) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae458) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0163.731] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.731] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0163.731] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.731] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0163.731] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.731] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0163.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0163.731] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.732] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0163.732] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf218 [0163.732] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae3a4) returned 1 [0163.732] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf218 [0163.732] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae364) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae370) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0163.732] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.732] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3d8) returned 1 [0163.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae3e4) returned 1 [0163.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae418) returned 1 [0163.733] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.733] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.733] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf218 [0163.733] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.733] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf218 [0163.733] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.733] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3OLEUV53\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.734] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.734] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3OLEUV53\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.734] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.734] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\IXU0UU0M\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.735] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.735] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\IXU0UU0M\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.735] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.735] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\L2SNS5PE\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.736] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.736] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\L2SNS5PE\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.736] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.736] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\M2N78YPO\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.737] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.737] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\M2N78YPO\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf218 [0163.737] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.737] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.737] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.737] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.737] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.737] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.737] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.738] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf218 [0163.738] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.738] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.738] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.738] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf218 [0163.738] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.738] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.738] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.738] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.739] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.739] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.739] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.739] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.739] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.739] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.739] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.739] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf218 [0163.739] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.739] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.740] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.740] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.740] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.740] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.740] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.740] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.741] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.741] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.741] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.741] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.741] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.741] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.742] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.742] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.742] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.742] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.758] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.759] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf218 [0163.760] FindClose (in: hFindFile=0xbf218 | out: hFindFile=0xbf218) returned 1 [0163.761] CreateFileW (lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.762] GetFileType (hFile=0x154) returned 0x1 [0163.762] GetFileType (hFile=0x154) returned 0x1 [0163.763] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x6aa [0163.792] CloseHandle (hObject=0x154) returned 1 [0163.804] CreateFileW (lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.806] GetFileType (hFile=0x154) returned 0x1 [0163.806] GetFileType (hFile=0x154) returned 0x1 [0163.806] WriteFile (in: hFile=0x154, lpBuffer=0x1ae2dcc*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1ae2dcc*, lpNumberOfBytesWritten=0x2ae358*=0x6b0, lpOverlapped=0x0) returned 1 [0163.807] CloseHandle (hObject=0x154) returned 1 [0163.807] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c145ac8, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7c145ac8, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0x9445b0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x6b0)) returned 1 [0163.807] MoveFileW (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk.anonymous" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.anonymous")) returned 1 [0163.808] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.809] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.809] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.809] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.809] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.809] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.809] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.809] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.809] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0163.810] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.810] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0163.810] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.810] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0163.810] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.810] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0163.810] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.811] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0163.811] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.811] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbf198 [0163.811] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.811] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0163.812] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.812] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbf198 [0163.812] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.812] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.812] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.812] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.812] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.812] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Desktop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.813] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.813] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Desktop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.813] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.813] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Documents\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.814] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.814] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Documents\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.814] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.814] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Downloads\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.814] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.814] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Downloads\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.814] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.814] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Favorites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.815] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.815] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Favorites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.815] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.815] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.815] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.815] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.815] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.815] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.816] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.816] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.816] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.816] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.816] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.817] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.817] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.817] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Saved Games\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.817] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.817] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Saved Games\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.817] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.817] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.818] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.818] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.818] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.818] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0163.818] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.818] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\*", lpFindFileData=0x2ae384 | out: lpFindFileData=0x2ae384) returned 0xbf198 [0163.819] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.819] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.819] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.819] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbf198 [0163.819] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.819] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0163.820] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.820] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0163.820] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.820] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0163.820] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.820] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0163.821] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.821] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.822] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.822] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.823] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.823] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.823] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.823] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.823] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.823] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.824] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.824] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.824] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.824] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.824] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.824] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.824] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.824] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.825] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.825] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.825] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.825] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\3.0\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.826] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.826] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\3.0\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.826] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.826] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\3.0\\Icon Files\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.826] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.826] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\3.0\\Icon Files\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.826] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.826] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\3.0\\SCPD\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.827] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.827] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows Media Player NSS\\3.0\\SCPD\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.827] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.827] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0163.829] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.830] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0163.831] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.832] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0163.832] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.832] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\*", lpFindFileData=0x2ae29c | out: lpFindFileData=0x2ae29c) returned 0xbf198 [0163.832] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.832] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0163.832] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.832] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ae228 | out: lpFindFileData=0x2ae228) returned 0xbf198 [0163.833] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.833] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.833] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.833] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.833] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.833] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.833] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.833] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.834] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.834] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.834] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.834] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.834] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.834] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.834] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.834] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.834] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.834] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.835] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.835] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.835] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.835] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.836] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.836] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.836] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.836] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.836] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.836] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.836] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.836] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.837] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.837] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.837] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.837] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.837] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.837] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbf198 [0163.838] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.838] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.839] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.840] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2ae1b4 | out: lpFindFileData=0x2ae1b4) returned 0xbf198 [0163.841] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.842] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.844] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.844] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.844] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.844] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.845] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.845] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.845] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.845] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.845] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.845] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.845] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.845] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.846] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.846] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.846] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.846] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.864] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.865] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbf198 [0163.866] FindClose (in: hFindFile=0xbf198 | out: hFindFile=0xbf198) returned 1 [0163.867] CreateFileW (lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.868] GetFileType (hFile=0x154) returned 0x1 [0163.868] GetFileType (hFile=0x154) returned 0x1 [0163.868] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae3e4 | out: lpFileSizeHigh=0x2ae3e4*=0x0) returned 0x6aa [0163.887] CloseHandle (hObject=0x154) returned 1 [0163.899] CreateFileW (lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.900] GetFileType (hFile=0x154) returned 0x1 [0163.900] GetFileType (hFile=0x154) returned 0x1 [0163.900] WriteFile (in: hFile=0x154, lpBuffer=0x1b87bd8*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2ae358, lpOverlapped=0x0 | out: lpBuffer=0x1b87bd8*, lpNumberOfBytesWritten=0x2ae358*=0x6b0, lpOverlapped=0x0) returned 1 [0163.901] CloseHandle (hObject=0x154) returned 1 [0163.904] GetFileAttributesExW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), fInfoLevelId=0x0, lpFileInformation=0x2ae3e4 | out: lpFileInformation=0x2ae3e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c16bc29, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x7c16bc29, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xa28df0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x6b0)) returned 1 [0163.904] MoveFileW (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax recipient.lnk.anonymous" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.anonymous")) returned 1 [0163.905] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0163.905] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.905] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0163.906] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.906] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee98 [0163.906] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.906] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2ae0cc | out: lpFindFileData=0x2ae0cc) returned 0xbee98 [0163.906] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.906] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee98 [0163.906] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.907] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee98 [0163.907] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.907] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee98 [0163.908] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.908] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee98 [0163.908] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.908] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee98 [0163.908] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.908] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2adfe4 | out: lpFindFileData=0x2adfe4) returned 0xbee98 [0163.908] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.908] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee98 [0163.909] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.909] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2ae058 | out: lpFindFileData=0x2ae058) returned 0xbee98 [0163.909] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.909] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0163.909] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.909] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ae140 | out: lpFindFileData=0x2ae140) returned 0xbee98 [0163.909] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.909] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Desktop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.910] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.910] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Desktop\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.910] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.910] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Documents\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.911] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.911] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Documents\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.911] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.911] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Downloads\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.911] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.911] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Downloads\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.911] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.911] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.912] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.912] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.912] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.912] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.912] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.913] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.913] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.913] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.913] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.913] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Music\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.913] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.913] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.913] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.914] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Pictures\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.914] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.914] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Saved Games\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.914] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.914] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Saved Games\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.914] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.914] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.915] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.915] FindFirstFileW (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Videos\\*", lpFindFileData=0x2ae310 | out: lpFindFileData=0x2ae310) returned 0xbee98 [0163.915] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.915] FindFirstFileW (in: lpFileName="C:\\Windows\\servicing\\*", lpFindFileData=0x2ae3f8 | out: lpFindFileData=0x2ae3f8) returned 0xbee98 [0163.918] FindClose (in: hFindFile=0xbee98 | out: hFindFile=0xbee98) returned 1 [0163.931] CreateFileW (lpFileName="C:\\Windows\\servicing\\Editions\\EditionMatrix.xml" (normalized: "c:\\windows\\servicing\\editions\\editionmatrix.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0163.948] GetFileType (hFile=0x154) returned 0x1 [0163.948] GetFileType (hFile=0x154) returned 0x1 [0163.948] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x1391 [0163.949] CloseHandle (hObject=0x154) returned 1 [0163.962] CreateFileW (lpFileName="C:\\Windows\\servicing\\Editions\\EditionMatrix.xml" (normalized: "c:\\windows\\servicing\\editions\\editionmatrix.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0164.119] CreateFileW (lpFileName="C:\\Windows\\servicing\\Sessions\\1504_272206.back.xml" (normalized: "c:\\windows\\servicing\\sessions\\1504_272206.back.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.121] GetFileType (hFile=0x154) returned 0x1 [0164.121] GetFileType (hFile=0x154) returned 0x1 [0164.121] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x45779 [0164.122] ReadFile (in: hFile=0x154, lpBuffer=0x2b587288, nNumberOfBytesToRead=0x45779, lpNumberOfBytesRead=0x2ae5d4, lpOverlapped=0x0 | out: lpBuffer=0x2b587288*, lpNumberOfBytesRead=0x2ae5d4*=0x45779, lpOverlapped=0x0) returned 1 [0164.142] CloseHandle (hObject=0x154) returned 1 [0164.176] CreateFileW (lpFileName="C:\\Windows\\servicing\\Sessions\\1504_272206.back.xml" (normalized: "c:\\windows\\servicing\\sessions\\1504_272206.back.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0164.222] CreateFileW (lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\wuident.txt" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wuident.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.224] GetFileType (hFile=0x154) returned 0x1 [0164.225] GetFileType (hFile=0x154) returned 0x1 [0164.225] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0xecd [0164.232] CloseHandle (hObject=0x154) returned 1 [0164.259] CreateFileW (lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\wuident.txt" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wuident.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.260] GetFileType (hFile=0x154) returned 0x1 [0164.260] GetFileType (hFile=0x154) returned 0x1 [0164.261] CloseHandle (hObject=0x154) returned 1 [0164.262] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\wuident.txt" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wuident.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc5a100, ftCreationTime.dwHighDateTime=0x1cf75e8, ftLastAccessTime.dwLowDateTime=0x7dc5a100, ftLastAccessTime.dwHighDateTime=0x1cf75e8, ftLastWriteTime.dwLowDateTime=0xd94d90, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0xed0)) returned 1 [0164.262] MoveFileW (lpExistingFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\wuident.txt" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wuident.txt"), lpNewFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\wuident.txt.anonymous" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wuident.txt.anonymous")) returned 1 [0164.262] CreateFileW (lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\WuPackages.xml" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wupackages.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.263] GetFileType (hFile=0x154) returned 0x1 [0164.263] GetFileType (hFile=0x154) returned 0x1 [0164.263] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae628 | out: lpFileSizeHigh=0x2ae628*=0x0) returned 0x322 [0164.273] CloseHandle (hObject=0x154) returned 1 [0164.286] CreateFileW (lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\WuPackages.xml" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wupackages.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.287] GetFileType (hFile=0x154) returned 0x1 [0164.287] GetFileType (hFile=0x154) returned 0x1 [0164.288] CloseHandle (hObject=0x154) returned 1 [0164.289] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\WuPackages.xml" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wupackages.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae628 | out: lpFileInformation=0x2ae628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc03afe00, ftCreationTime.dwHighDateTime=0x1cd40f1, ftLastAccessTime.dwLowDateTime=0xc03afe00, ftLastAccessTime.dwHighDateTime=0x1cd40f1, ftLastWriteTime.dwLowDateTime=0xdbaef0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0164.289] MoveFileW (lpExistingFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\WuPackages.xml" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wupackages.xml"), lpNewFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\WuPackages.xml.anonymous" (normalized: "c:\\windows\\softwaredistribution\\selfupdate\\wupackages.xml.anonymous")) returned 1 [0164.363] CreateFileW (lpFileName="C:\\Windows\\System32\\gatherNetworkInfo.vbs" (normalized: "c:\\windows\\system32\\gathernetworkinfo.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.363] GetFileType (hFile=0x154) returned 0x1 [0164.363] GetFileType (hFile=0x154) returned 0x1 [0164.363] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x9e68 [0164.374] CloseHandle (hObject=0x154) returned 1 [0164.386] CreateFileW (lpFileName="C:\\Windows\\System32\\gatherNetworkInfo.vbs" (normalized: "c:\\windows\\system32\\gathernetworkinfo.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0164.389] CreateFileW (lpFileName="C:\\Windows\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.390] GetFileType (hFile=0x154) returned 0x1 [0164.391] GetFileType (hFile=0x154) returned 0x1 [0164.391] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x0 [0164.391] CloseHandle (hObject=0x154) returned 1 [0164.404] CreateFileW (lpFileName="C:\\Windows\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.404] GetFileType (hFile=0x154) returned 0x1 [0164.404] GetFileType (hFile=0x154) returned 0x1 [0164.405] WriteFile (in: hFile=0x154, lpBuffer=0x1b1d20c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ae610, lpOverlapped=0x0 | out: lpBuffer=0x1b1d20c*, lpNumberOfBytesWritten=0x2ae610*=0x10, lpOverlapped=0x0) returned 1 [0164.406] CloseHandle (hObject=0x154) returned 1 [0164.406] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxsapidebuglogfile.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae69c | out: lpFileInformation=0x2ae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfff9120, ftCreationTime.dwHighDateTime=0x1d2f581, ftLastAccessTime.dwLowDateTime=0xdfff9120, ftLastAccessTime.dwHighDateTime=0x1d2f581, ftLastWriteTime.dwLowDateTime=0xeeb9f0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0164.406] MoveFileW (lpExistingFileName="C:\\Windows\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Windows\\Temp\\FXSAPIDebugLogFile.txt.anonymous" (normalized: "c:\\windows\\temp\\fxsapidebuglogfile.txt.anonymous")) returned 1 [0164.406] CreateFileW (lpFileName="C:\\Windows\\Temp\\FXSTIFFDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxstiffdebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.407] GetFileType (hFile=0x154) returned 0x1 [0164.407] GetFileType (hFile=0x154) returned 0x1 [0164.407] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0x0 [0164.407] CloseHandle (hObject=0x154) returned 1 [0164.419] CreateFileW (lpFileName="C:\\Windows\\Temp\\FXSTIFFDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxstiffdebuglogfile.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.419] GetFileType (hFile=0x154) returned 0x1 [0164.420] GetFileType (hFile=0x154) returned 0x1 [0164.420] WriteFile (in: hFile=0x154, lpBuffer=0x1b6b48c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ae610, lpOverlapped=0x0 | out: lpBuffer=0x1b6b48c*, lpNumberOfBytesWritten=0x2ae610*=0x10, lpOverlapped=0x0) returned 1 [0164.421] CloseHandle (hObject=0x154) returned 1 [0164.421] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Temp\\FXSTIFFDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxstiffdebuglogfile.txt"), fInfoLevelId=0x0, lpFileInformation=0x2ae69c | out: lpFileInformation=0x2ae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea669c0, ftCreationTime.dwHighDateTime=0x1d2f581, ftLastAccessTime.dwLowDateTime=0xdea669c0, ftLastAccessTime.dwHighDateTime=0x1d2f581, ftLastWriteTime.dwLowDateTime=0xf11b50, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0164.421] MoveFileW (lpExistingFileName="C:\\Windows\\Temp\\FXSTIFFDebugLogFile.txt" (normalized: "c:\\windows\\temp\\fxstiffdebuglogfile.txt"), lpNewFileName="C:\\Windows\\Temp\\FXSTIFFDebugLogFile.txt.anonymous" (normalized: "c:\\windows\\temp\\fxstiffdebuglogfile.txt.anonymous")) returned 1 [0164.428] CreateFileW (lpFileName="C:\\Windows\\Vss\\Writers\\System\\0bada1de-01a9-4625-8278-69e735f39dd2.xml" (normalized: "c:\\windows\\vss\\writers\\system\\0bada1de-01a9-4625-8278-69e735f39dd2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.430] GetFileType (hFile=0x154) returned 0x1 [0164.430] GetFileType (hFile=0x154) returned 0x1 [0164.430] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1938 [0164.439] CloseHandle (hObject=0x154) returned 1 [0164.450] CreateFileW (lpFileName="C:\\Windows\\Vss\\Writers\\System\\0bada1de-01a9-4625-8278-69e735f39dd2.xml" (normalized: "c:\\windows\\vss\\writers\\system\\0bada1de-01a9-4625-8278-69e735f39dd2.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.452] GetFileType (hFile=0x154) returned 0x1 [0164.452] GetFileType (hFile=0x154) returned 0x1 [0164.452] WriteFile (in: hFile=0x154, lpBuffer=0x1bc9258*, nNumberOfBytesToWrite=0x1940, lpNumberOfBytesWritten=0x2ae554, lpOverlapped=0x0 | out: lpBuffer=0x1bc9258*, lpNumberOfBytesWritten=0x2ae554*=0x1940, lpOverlapped=0x0) returned 1 [0164.453] CloseHandle (hObject=0x154) returned 1 [0164.453] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Vss\\Writers\\System\\0bada1de-01a9-4625-8278-69e735f39dd2.xml" (normalized: "c:\\windows\\vss\\writers\\system\\0bada1de-01a9-4625-8278-69e735f39dd2.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5477f92a, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5477f92a, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xf5de10, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0x1940)) returned 1 [0164.454] MoveFileW (lpExistingFileName="C:\\Windows\\Vss\\Writers\\System\\0bada1de-01a9-4625-8278-69e735f39dd2.xml" (normalized: "c:\\windows\\vss\\writers\\system\\0bada1de-01a9-4625-8278-69e735f39dd2.xml"), lpNewFileName="C:\\Windows\\Vss\\Writers\\System\\0bada1de-01a9-4625-8278-69e735f39dd2.xml.anonymous" (normalized: "c:\\windows\\vss\\writers\\system\\0bada1de-01a9-4625-8278-69e735f39dd2.xml.anonymous")) returned 1 [0164.454] CreateFileW (lpFileName="C:\\Windows\\Vss\\Writers\\System\\75DFB225-E2E4-4d39-9AC9-FFAFF65DDF06.xml" (normalized: "c:\\windows\\vss\\writers\\system\\75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.455] GetFileType (hFile=0x154) returned 0x1 [0164.455] GetFileType (hFile=0x154) returned 0x1 [0164.455] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xad8 [0164.464] CloseHandle (hObject=0x154) returned 1 [0164.476] CreateFileW (lpFileName="C:\\Windows\\Vss\\Writers\\System\\75DFB225-E2E4-4d39-9AC9-FFAFF65DDF06.xml" (normalized: "c:\\windows\\vss\\writers\\system\\75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.477] GetFileType (hFile=0x154) returned 0x1 [0164.477] GetFileType (hFile=0x154) returned 0x1 [0164.478] CloseHandle (hObject=0x154) returned 1 [0164.479] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Vss\\Writers\\System\\75DFB225-E2E4-4d39-9AC9-FFAFF65DDF06.xml" (normalized: "c:\\windows\\vss\\writers\\system\\75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6574e227, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x6574e227, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xfaa0d0, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0xae0)) returned 1 [0164.479] MoveFileW (lpExistingFileName="C:\\Windows\\Vss\\Writers\\System\\75DFB225-E2E4-4d39-9AC9-FFAFF65DDF06.xml" (normalized: "c:\\windows\\vss\\writers\\system\\75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml"), lpNewFileName="C:\\Windows\\Vss\\Writers\\System\\75DFB225-E2E4-4d39-9AC9-FFAFF65DDF06.xml.anonymous" (normalized: "c:\\windows\\vss\\writers\\system\\75dfb225-e2e4-4d39-9ac9-ffaff65ddf06.xml.anonymous")) returned 1 [0164.479] CreateFileW (lpFileName="C:\\Windows\\Vss\\Writers\\System\\D61D61C8-D73A-4EEE-8CDD-F6F9786B7124.xml" (normalized: "c:\\windows\\vss\\writers\\system\\d61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.480] GetFileType (hFile=0x154) returned 0x1 [0164.480] GetFileType (hFile=0x154) returned 0x1 [0164.480] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0xc74 [0164.492] CloseHandle (hObject=0x154) returned 1 [0164.503] CreateFileW (lpFileName="C:\\Windows\\Vss\\Writers\\System\\D61D61C8-D73A-4EEE-8CDD-F6F9786B7124.xml" (normalized: "c:\\windows\\vss\\writers\\system\\d61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.506] GetFileType (hFile=0x154) returned 0x1 [0164.506] GetFileType (hFile=0x154) returned 0x1 [0164.509] CloseHandle (hObject=0x154) returned 1 [0164.509] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Vss\\Writers\\System\\D61D61C8-D73A-4EEE-8CDD-F6F9786B7124.xml" (normalized: "c:\\windows\\vss\\writers\\system\\d61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml"), fInfoLevelId=0x0, lpFileInformation=0x2ae5b4 | out: lpFileInformation=0x2ae5b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aca9d82, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5aca9d82, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0xff6390, ftLastWriteTime.dwHighDateTime=0x1d45266, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1 [0164.510] MoveFileW (lpExistingFileName="C:\\Windows\\Vss\\Writers\\System\\D61D61C8-D73A-4EEE-8CDD-F6F9786B7124.xml" (normalized: "c:\\windows\\vss\\writers\\system\\d61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml"), lpNewFileName="C:\\Windows\\Vss\\Writers\\System\\D61D61C8-D73A-4EEE-8CDD-F6F9786B7124.xml.anonymous" (normalized: "c:\\windows\\vss\\writers\\system\\d61d61c8-d73a-4eee-8cdd-f6f9786b7124.xml.anonymous")) returned 1 [0164.520] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Architecture\\img13.jpg" (normalized: "c:\\windows\\web\\wallpaper\\architecture\\img13.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.521] GetFileType (hFile=0x154) returned 0x1 [0164.521] GetFileType (hFile=0x154) returned 0x1 [0164.521] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x12cadc [0164.525] ReadFile (in: hFile=0x154, lpBuffer=0x2ceabf18, nNumberOfBytesToRead=0x12cadc, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2ceabf18*, lpNumberOfBytesRead=0x2ae560*=0x12cadc, lpOverlapped=0x0) returned 1 [0164.608] CloseHandle (hObject=0x154) returned 1 [0164.730] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Architecture\\img13.jpg" (normalized: "c:\\windows\\web\\wallpaper\\architecture\\img13.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0164.737] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Characters\\img19.jpg" (normalized: "c:\\windows\\web\\wallpaper\\characters\\img19.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0164.739] GetFileType (hFile=0x154) returned 0x1 [0164.739] GetFileType (hFile=0x154) returned 0x1 [0164.739] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x16794f [0164.745] ReadFile (in: hFile=0x154, lpBuffer=0x2d5b80b0, nNumberOfBytesToRead=0x16794f, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2d5b80b0*, lpNumberOfBytesRead=0x2ae560*=0x16794f, lpOverlapped=0x0) returned 1 [0164.835] CloseHandle (hObject=0x154) returned 1 [0165.042] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Characters\\img19.jpg" (normalized: "c:\\windows\\web\\wallpaper\\characters\\img19.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0165.057] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Landscapes\\img10.jpg" (normalized: "c:\\windows\\web\\wallpaper\\landscapes\\img10.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0165.059] GetFileType (hFile=0x154) returned 0x1 [0165.059] GetFileType (hFile=0x154) returned 0x1 [0165.059] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1742a6 [0165.064] ReadFile (in: hFile=0x154, lpBuffer=0x2df88988, nNumberOfBytesToRead=0x1742a6, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2df88988*, lpNumberOfBytesRead=0x2ae560*=0x1742a6, lpOverlapped=0x0) returned 1 [0165.125] CloseHandle (hObject=0x154) returned 1 [0165.265] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Landscapes\\img10.jpg" (normalized: "c:\\windows\\web\\wallpaper\\landscapes\\img10.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0165.270] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Nature\\img1.jpg" (normalized: "c:\\windows\\web\\wallpaper\\nature\\img1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0165.272] GetFileType (hFile=0x154) returned 0x1 [0165.272] GetFileType (hFile=0x154) returned 0x1 [0165.272] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x15bf5c [0165.276] ReadFile (in: hFile=0x154, lpBuffer=0x2dcbdf80, nNumberOfBytesToRead=0x15bf5c, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2dcbdf80*, lpNumberOfBytesRead=0x2ae560*=0x15bf5c, lpOverlapped=0x0) returned 1 [0165.491] CloseHandle (hObject=0x154) returned 1 [0165.607] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Nature\\img1.jpg" (normalized: "c:\\windows\\web\\wallpaper\\nature\\img1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0165.613] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Scenes\\img25.jpg" (normalized: "c:\\windows\\web\\wallpaper\\scenes\\img25.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0165.615] GetFileType (hFile=0x154) returned 0x1 [0165.615] GetFileType (hFile=0x154) returned 0x1 [0165.615] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x1bba15 [0165.620] ReadFile (in: hFile=0x154, lpBuffer=0x2ef7cf98, nNumberOfBytesToRead=0x1bba15, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2ef7cf98*, lpNumberOfBytesRead=0x2ae560*=0x1bba15, lpOverlapped=0x0) returned 1 [0165.711] CloseHandle (hObject=0x154) returned 1 [0165.826] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Scenes\\img25.jpg" (normalized: "c:\\windows\\web\\wallpaper\\scenes\\img25.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0165.828] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Windows\\img0.jpg" (normalized: "c:\\windows\\web\\wallpaper\\windows\\img0.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0165.829] GetFileType (hFile=0x154) returned 0x1 [0165.829] GetFileType (hFile=0x154) returned 0x1 [0165.829] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae5b4 | out: lpFileSizeHigh=0x2ae5b4*=0x0) returned 0x9cfab [0165.831] ReadFile (in: hFile=0x154, lpBuffer=0x2f9e2cb0, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x2ae560, lpOverlapped=0x0 | out: lpBuffer=0x2f9e2cb0*, lpNumberOfBytesRead=0x2ae560*=0x9cfab, lpOverlapped=0x0) returned 1 [0165.867] CloseHandle (hObject=0x154) returned 1 [0165.927] CreateFileW (lpFileName="C:\\Windows\\Web\\Wallpaper\\Windows\\img0.jpg" (normalized: "c:\\windows\\web\\wallpaper\\windows\\img0.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0165.928] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.962] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.963] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.964] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.964] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.964] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.964] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.964] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.978] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.978] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.978] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.979] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.979] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.979] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.979] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.979] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.979] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.980] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.981] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.985] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.986] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.987] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.987] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0165.987] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.000] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.000] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.000] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.001] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.002] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.002] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.002] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.002] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.002] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.026] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.027] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.028] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.033] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.033] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.033] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.033] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.033] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.034] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.035] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.035] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.039] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.039] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.039] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.039] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.039] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.040] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.040] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.040] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.040] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.040] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.040] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.041] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.041] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.041] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.041] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.050] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.051] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.051] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.051] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.051] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.051] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.051] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.053] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.053] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.054] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.058] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.062] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.063] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.066] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.067] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.067] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.067] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.070] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.071] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.071] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.071] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.071] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.071] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.074] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.075] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.075] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.075] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.075] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.075] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.078] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.078] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.079] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.080] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.080] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.082] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.083] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.086] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.086] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.086] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.086] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0166.086] FindNextFileW (in: hFindFile=0xbeb58, lpFindFileData=0x2ae408 | out: lpFindFileData=0x2ae408) returned 1 [0168.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0168.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0168.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6d0) returned 1 [0168.250] GetFullPathNameW (in: lpFileName="\\Windows\\winsxs", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\winsxs", lpFilePart=0x0) returned 0x11 [0168.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\winsxs\\", nBufferLength=0x105, lpBuffer=0x2ae1ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\winsxs\\", lpFilePart=0x0) returned 0x12 [0168.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae690) returned 1 [0168.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae69c) returned 1 [0168.326] GetFullPathNameW (in: lpFileName="\\Windows\\winsxs\\reboot.xml", nBufferLength=0x105, lpBuffer=0x2ae0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\winsxs\\reboot.xml", lpFilePart=0x0) returned 0x1c [0168.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae594) returned 1 [0168.326] CreateFileW (lpFileName="C:\\Windows\\winsxs\\reboot.xml" (normalized: "c:\\windows\\winsxs\\reboot.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x154 [0168.326] GetFileType (hFile=0x154) returned 0x1 [0168.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae590) returned 1 [0168.326] GetFileType (hFile=0x154) returned 0x1 [0168.326] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x2ae69c | out: lpFileSizeHigh=0x2ae69c*=0x0) returned 0xcd [0168.327] CloseHandle (hObject=0x154) returned 1 [0168.343] GetFullPathNameW (in: lpFileName="\\Windows\\winsxs\\reboot.xml", nBufferLength=0x105, lpBuffer=0x2ae08c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\winsxs\\reboot.xml", lpFilePart=0x0) returned 0x1c [0168.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae580) returned 1 [0168.344] CreateFileW (lpFileName="C:\\Windows\\winsxs\\reboot.xml" (normalized: "c:\\windows\\winsxs\\reboot.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0168.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ad3e8) returned 1 [0168.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae7b8) returned 1 [0168.345] GetFullPathNameW (in: lpFileName="D:\\", nBufferLength=0x105, lpBuffer=0x2ae2c0, lpFilePart=0x0 | out: lpBuffer="D:\\", lpFilePart=0x0) returned 0x3 [0168.345] GetFullPathNameW (in: lpFileName="D:\\", nBufferLength=0x105, lpBuffer=0x2ae294, lpFilePart=0x0 | out: lpBuffer="D:\\", lpFilePart=0x0) returned 0x3 [0168.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae77c) returned 1 [0168.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae7b8) returned 1 [0168.346] GetFullPathNameW (in: lpFileName="E:\\", nBufferLength=0x105, lpBuffer=0x2ae2c0, lpFilePart=0x0 | out: lpBuffer="E:\\", lpFilePart=0x0) returned 0x3 [0168.346] GetFullPathNameW (in: lpFileName="E:\\", nBufferLength=0x105, lpBuffer=0x2ae294, lpFilePart=0x0 | out: lpBuffer="E:\\", lpFilePart=0x0) returned 0x3 [0168.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae77c) returned 1 [0168.349] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x2ae1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\AppData\\Roaming\\READ_ME.txt", lpFilePart=0x0) returned 0x2c [0168.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6cc) returned 1 [0168.350] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\AppData\\Roaming\\READ_ME.txt" (normalized: "c:\\users\\eebsym5\\appdata\\roaming\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x154 [0168.350] GetFileType (hFile=0x154) returned 0x1 [0168.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae6c8) returned 1 [0168.351] GetFileType (hFile=0x154) returned 0x1 [0168.351] WriteFile (in: hFile=0x154, lpBuffer=0x1e43890*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x2ae764, lpOverlapped=0x0 | out: lpBuffer=0x1e43890*, lpNumberOfBytesWritten=0x2ae764*=0x39, lpOverlapped=0x0) returned 1 [0168.352] CloseHandle (hObject=0x154) returned 1 [0168.355] CoTaskMemAlloc (cb=0x20c) returned 0x3f02cc0 [0168.355] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x3f02cc0 | out: pszPath="C:\\Users\\EEBsYm5\\Desktop") returned 0x0 [0168.356] CoTaskMemFree (pv=0x3f02cc0) [0168.356] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop", nBufferLength=0x105, lpBuffer=0x2ae29c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop", lpFilePart=0x0) returned 0x18 [0168.356] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\YOU_MUST_READ_ME.rtf", nBufferLength=0x105, lpBuffer=0x2ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\YOU_MUST_READ_ME.rtf", lpFilePart=0x0) returned 0x2d [0168.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae6e4) returned 1 [0168.356] CreateFileW (lpFileName="C:\\Users\\EEBsYm5\\Desktop\\YOU_MUST_READ_ME.rtf" (normalized: "c:\\users\\eebsym5\\desktop\\you_must_read_me.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x278 [0168.358] GetFileType (hFile=0x278) returned 0x1 [0168.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae6e0) returned 1 [0168.358] GetFileType (hFile=0x278) returned 0x1 [0168.360] CloseHandle (hObject=0x278) returned 1 [0168.362] CoTaskMemAlloc (cb=0x20c) returned 0x3f02cc0 [0168.362] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x3f02cc0 | out: pszPath="C:\\Users\\EEBsYm5\\Documents") returned 0x0 [0168.363] CoTaskMemFree (pv=0x3f02cc0) [0168.363] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Documents", nBufferLength=0x105, lpBuffer=0x2ae2a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Documents", lpFilePart=0x0) returned 0x1a [0168.449] GetUserObjectInformationA (in: hObj=0x40, nIndex=1, pvInfo=0x1e48a30, nLength=0xc, lpnLengthNeeded=0x2ae914 | out: pvInfo=0x1e48a30, lpnLengthNeeded=0x2ae914) returned 1 [0168.525] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.525] AdjustWindowRectEx (in: lpRect=0x2ae7f4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae7f4) returned 1 [0168.526] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.526] AdjustWindowRectEx (in: lpRect=0x2ae7f0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae7f0) returned 1 [0168.526] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.526] AdjustWindowRectEx (in: lpRect=0x2ae7ec, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae7ec) returned 1 [0168.526] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.526] AdjustWindowRectEx (in: lpRect=0x2ae7ec, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae7ec) returned 1 [0168.526] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.526] AdjustWindowRectEx (in: lpRect=0x2ae7ec, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae7ec) returned 1 [0168.527] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.527] AdjustWindowRectEx (in: lpRect=0x2ae7ec, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae7ec) returned 1 [0168.527] GetDC (hWnd=0x0) returned 0x3010800 [0168.527] GdipCreateFromHDC (hdc=0x3010800, graphics=0x2ae6c4) returned 0x0 [0168.527] GdipGetFontHeight (font=0x5a95f10, graphics=0x1755128, height=0x2ae6bc) returned 0x0 [0168.527] GdipDeleteGraphics (graphics=0x1755128) returned 0x0 [0168.527] ReleaseDC (hWnd=0x0, hDC=0x3010800) returned 1 [0168.527] GetSystemMetrics (nIndex=5) returned 1 [0168.527] GetSystemMetrics (nIndex=6) returned 1 [0168.528] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.528] AdjustWindowRectEx (in: lpRect=0x2ae7ec, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ae7ec) returned 1 [0168.529] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0168.529] AdjustWindowRectEx (in: lpRect=0x2ae7c0, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ae7c0) returned 1 [0169.058] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2ae2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0169.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae728) returned 1 [0169.060] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorlib.dll"), fInfoLevelId=0x0, lpFileInformation=0x2ae7a4 | out: lpFileInformation=0x2ae7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c62800, ftCreationTime.dwHighDateTime=0x1d0aaf6, ftLastAccessTime.dwLowDateTime=0x91f303c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x84c62800, ftLastWriteTime.dwHighDateTime=0x1d0aaf6, nFileSizeHigh=0x0, nFileSizeLow=0x53b8a0)) returned 1 [0169.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae724) returned 1 [0169.102] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", lpdwHandle=0x2ae818 | out: lpdwHandle=0x2ae818) returned 0x80c [0169.256] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", dwHandle=0x0, dwLen=0x80c, lpData=0x1e541c8 | out: lpData=0x1e541c8) returned 1 [0169.258] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae7ec, puLen=0x2ae7e8 | out: lplpBuffer=0x2ae7ec*=0x1e545c8, puLen=0x2ae7e8) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e54280, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e542d4, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e54354, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e543b0, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e543f0, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e54478, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e544b4, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5450c, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e54538, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e54574, puLen=0x2ae768) returned 1 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.259] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae760, puLen=0x2ae75c | out: lplpBuffer=0x2ae760*=0x1e545c8, puLen=0x2ae75c) returned 1 [0169.260] VerLanguageNameW (in: wLang=0x409, szLang=0x2ae4f0, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0169.265] VerQueryValueW (in: pBlock=0x1e541c8, lpSubBlock="\\", lplpBuffer=0x2ae770, puLen=0x2ae76c | out: lplpBuffer=0x2ae770*=0x1e541f0, puLen=0x2ae76c) returned 1 [0169.280] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", nBufferLength=0x105, lpBuffer=0x2ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", lpFilePart=0x0) returned 0x37 [0169.280] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", nBufferLength=0x105, lpBuffer=0x2ae1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", lpFilePart=0x0) returned 0x37 [0169.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x2ae184, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0169.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ae150, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0169.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ae1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0169.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae614) returned 1 [0169.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x2ae690 | out: lpFileInformation=0x2ae690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56012300, ftCreationTime.dwHighDateTime=0x1cd5d59, ftLastAccessTime.dwLowDateTime=0x50f67aa0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x56012300, ftLastWriteTime.dwHighDateTime=0x1cd5d59, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0169.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae610) returned 1 [0169.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ae0f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0169.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae5e4) returned 1 [0169.681] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x288 [0169.681] GetFileType (hFile=0x288) returned 0x1 [0169.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae5e0) returned 1 [0169.681] GetFileType (hFile=0x288) returned 0x1 [0169.784] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x2ae61c | out: lpFileSizeHigh=0x2ae61c*=0x0) returned 0x8c8f [0169.784] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae5d8*=0x1000, lpOverlapped=0x0) returned 1 [0169.799] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae578, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae578*=0x1000, lpOverlapped=0x0) returned 1 [0169.799] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4f4, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae4f4*=0x1000, lpOverlapped=0x0) returned 1 [0169.800] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4f4, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae4f4*=0x1000, lpOverlapped=0x0) returned 1 [0169.800] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4f4, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae4f4*=0x1000, lpOverlapped=0x0) returned 1 [0169.800] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4f4, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae4f4*=0x1000, lpOverlapped=0x0) returned 1 [0169.800] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae574, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae574*=0x1000, lpOverlapped=0x0) returned 1 [0169.800] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4f4, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae4f4*=0x1000, lpOverlapped=0x0) returned 1 [0169.800] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae4f4, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae4f4*=0xc8f, lpOverlapped=0x0) returned 1 [0169.801] ReadFile (in: hFile=0x288, lpBuffer=0x1e57928, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ae59c, lpOverlapped=0x0 | out: lpBuffer=0x1e57928*, lpNumberOfBytesRead=0x2ae59c*=0x0, lpOverlapped=0x0) returned 1 [0169.801] CloseHandle (hObject=0x288) returned 1 [0169.801] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", nBufferLength=0x105, lpBuffer=0x2ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", lpFilePart=0x0) returned 0x37 [0169.801] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", nBufferLength=0x105, lpBuffer=0x2ae1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config", lpFilePart=0x0) returned 0x37 [0169.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae610) returned 1 [0169.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe.config" (normalized: "c:\\users\\eebsym5\\desktop\\qinynore ransomware.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2ae68c | out: lpFileInformation=0x2ae68c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0169.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae60c) returned 1 [0169.802] GetFullPathNameW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", nBufferLength=0x105, lpBuffer=0x2ae2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", lpFilePart=0x0) returned 0x30 [0169.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae728) returned 1 [0169.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe" (normalized: "c:\\users\\eebsym5\\desktop\\qinynore ransomware.exe"), fInfoLevelId=0x0, lpFileInformation=0x2ae7a4 | out: lpFileInformation=0x2ae7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe876b470, ftCreationTime.dwHighDateTime=0x1d42049, ftLastAccessTime.dwLowDateTime=0xe876b470, ftLastAccessTime.dwHighDateTime=0x1d42049, ftLastWriteTime.dwLowDateTime=0x9e347700, ftLastWriteTime.dwHighDateTime=0x1d45265, nFileSizeHigh=0x0, nFileSizeLow=0xaaa00)) returned 1 [0169.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae724) returned 1 [0169.802] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", lpdwHandle=0x2ae818 | out: lpdwHandle=0x2ae818) returned 0x6dc [0169.802] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", dwHandle=0x0, dwLen=0x6dc, lpData=0x1e5e834 | out: lpData=0x1e5e834) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae7ec, puLen=0x2ae7e8 | out: lplpBuffer=0x2ae7ec*=0x1e5e8d0, puLen=0x2ae7e8) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5e948, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5e978, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5e9c0, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5e9f0, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5ea44, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5eabc, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5eb0c, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5eb58, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5e926, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e5ea8c, puLen=0x2ae768) returned 1 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae760, puLen=0x2ae75c | out: lplpBuffer=0x2ae760*=0x1e5e8d0, puLen=0x2ae75c) returned 1 [0169.803] VerLanguageNameW (in: wLang=0x0, szLang=0x2ae4f0, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0169.803] VerQueryValueW (in: pBlock=0x1e5e834, lpSubBlock="\\", lplpBuffer=0x2ae770, puLen=0x2ae76c | out: lplpBuffer=0x2ae770*=0x1e5e85c, puLen=0x2ae76c) returned 1 [0169.810] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ae2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0169.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae728) returned 1 [0169.810] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll"), fInfoLevelId=0x0, lpFileInformation=0x2ae7a4 | out: lpFileInformation=0x2ae7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c62800, ftCreationTime.dwHighDateTime=0x1d0aaf6, ftLastAccessTime.dwLowDateTime=0x9af0d560, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x84c62800, ftLastWriteTime.dwHighDateTime=0x1d0aaf6, nFileSizeHigh=0x0, nFileSizeLow=0x498ed0)) returned 1 [0169.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae724) returned 1 [0169.810] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpdwHandle=0x2ae818 | out: lpdwHandle=0x2ae818) returned 0x7ec [0169.812] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", dwHandle=0x0, dwLen=0x7ec, lpData=0x1e60b64 | out: lpData=0x1e60b64) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae7ec, puLen=0x2ae7e8 | out: lplpBuffer=0x2ae7ec*=0x1e60f54, puLen=0x2ae7e8) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60c1c, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60c70, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60cb0, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60d0c, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60d64, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60dec, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60e40, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60e98, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60ec4, puLen=0x2ae768) returned 1 [0169.813] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.814] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e60f00, puLen=0x2ae768) returned 1 [0169.814] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.814] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae760, puLen=0x2ae75c | out: lplpBuffer=0x2ae760*=0x1e60f54, puLen=0x2ae75c) returned 1 [0169.814] VerLanguageNameW (in: wLang=0x409, szLang=0x2ae4f0, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0169.814] VerQueryValueW (in: pBlock=0x1e60b64, lpSubBlock="\\", lplpBuffer=0x2ae770, puLen=0x2ae76c | out: lplpBuffer=0x2ae770*=0x1e60b8c, puLen=0x2ae76c) returned 1 [0169.814] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2ae2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x5b [0169.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae728) returned 1 [0169.814] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system\\v4.0_4.0.0.0__b77a5c561934e089\\system.dll"), fInfoLevelId=0x0, lpFileInformation=0x2ae7a4 | out: lpFileInformation=0x2ae7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c62800, ftCreationTime.dwHighDateTime=0x1d0aaf6, ftLastAccessTime.dwLowDateTime=0x980eeb20, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x84c62800, ftLastWriteTime.dwHighDateTime=0x1d0aaf6, nFileSizeHigh=0x0, nFileSizeLow=0x352280)) returned 1 [0169.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae724) returned 1 [0169.815] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", lpdwHandle=0x2ae818 | out: lpdwHandle=0x2ae818) returned 0x77c [0169.891] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", dwHandle=0x0, dwLen=0x77c, lpData=0x1e62fe4 | out: lpData=0x1e62fe4) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae7ec, puLen=0x2ae7e8 | out: lplpBuffer=0x2ae7ec*=0x1e6339c, puLen=0x2ae7e8) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e6309c, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e630f0, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e63130, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e6318c, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e631c8, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e63250, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e63288, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e632e0, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e6330c, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e63348, puLen=0x2ae768) returned 1 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae760, puLen=0x2ae75c | out: lplpBuffer=0x2ae760*=0x1e6339c, puLen=0x2ae75c) returned 1 [0169.892] VerLanguageNameW (in: wLang=0x409, szLang=0x2ae4f0, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0169.892] VerQueryValueW (in: pBlock=0x1e62fe4, lpSubBlock="\\", lplpBuffer=0x2ae770, puLen=0x2ae76c | out: lplpBuffer=0x2ae770*=0x1e6300c, puLen=0x2ae76c) returned 1 [0169.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x2ae2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x6b [0169.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae728) returned 1 [0169.893] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll"), fInfoLevelId=0x0, lpFileInformation=0x2ae7a4 | out: lpFileInformation=0x2ae7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c62800, ftCreationTime.dwHighDateTime=0x1d0aaf6, ftLastAccessTime.dwLowDateTime=0x98d6dea0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x84c62800, ftLastWriteTime.dwHighDateTime=0x1d0aaf6, nFileSizeHigh=0x0, nFileSizeLow=0x912b0)) returned 1 [0169.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae724) returned 1 [0169.893] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpdwHandle=0x2ae818 | out: lpdwHandle=0x2ae818) returned 0x7bc [0169.947] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", dwHandle=0x0, dwLen=0x7bc, lpData=0x1e65710 | out: lpData=0x1e65710) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae7ec, puLen=0x2ae7e8 | out: lplpBuffer=0x2ae7ec*=0x1e65ae8, puLen=0x2ae7e8) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e657c8, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e6581c, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e6585c, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e658b8, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e65904, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e6598c, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e659d4, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e65a2c, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e65a58, puLen=0x2ae768) returned 1 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.950] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e65a94, puLen=0x2ae768) returned 1 [0169.951] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.951] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae760, puLen=0x2ae75c | out: lplpBuffer=0x2ae760*=0x1e65ae8, puLen=0x2ae75c) returned 1 [0169.951] VerLanguageNameW (in: wLang=0x409, szLang=0x2ae4f0, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0169.951] VerQueryValueW (in: pBlock=0x1e65710, lpSubBlock="\\", lplpBuffer=0x2ae770, puLen=0x2ae76c | out: lplpBuffer=0x2ae770*=0x1e65738, puLen=0x2ae76c) returned 1 [0169.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x2ae2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x65 [0169.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae728) returned 1 [0169.952] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.core\\v4.0_4.0.0.0__b77a5c561934e089\\system.core.dll"), fInfoLevelId=0x0, lpFileInformation=0x2ae7a4 | out: lpFileInformation=0x2ae7a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c62800, ftCreationTime.dwHighDateTime=0x1d0aaf6, ftLastAccessTime.dwLowDateTime=0x95be34c0, ftLastAccessTime.dwHighDateTime=0x1d2f5a1, ftLastWriteTime.dwLowDateTime=0x84c62800, ftLastWriteTime.dwHighDateTime=0x1d0aaf6, nFileSizeHigh=0x0, nFileSizeLow=0x141ea0)) returned 1 [0169.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae724) returned 1 [0169.952] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", lpdwHandle=0x2ae818 | out: lpdwHandle=0x2ae818) returned 0x79c [0169.990] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", dwHandle=0x0, dwLen=0x79c, lpData=0x1e67d94 | out: lpData=0x1e67d94) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae7ec, puLen=0x2ae7e8 | out: lplpBuffer=0x2ae7ec*=0x1e6815c, puLen=0x2ae7e8) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e67e4c, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e67ea0, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e67ee0, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e67f3c, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e67f80, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e68008, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e68048, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e680a0, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e680cc, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x1e68108, puLen=0x2ae768) returned 1 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ae76c, puLen=0x2ae768 | out: lplpBuffer=0x2ae76c*=0x0, puLen=0x2ae768) returned 0 [0169.991] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ae760, puLen=0x2ae75c | out: lplpBuffer=0x2ae760*=0x1e6815c, puLen=0x2ae75c) returned 1 [0169.992] VerLanguageNameW (in: wLang=0x409, szLang=0x2ae4f0, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0169.992] VerQueryValueW (in: pBlock=0x1e67d94, lpSubBlock="\\", lplpBuffer=0x2ae770, puLen=0x2ae76c | out: lplpBuffer=0x2ae770*=0x1e67dbc, puLen=0x2ae76c) returned 1 [0169.992] GetCurrentActCtx (in: lphActCtx=0x2ae798 | out: lphActCtx=0x2ae798*=0xb3664) returned 1 [0169.992] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0169.992] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0169.992] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=0, Y=0, nWidth=100, nHeight=23, hWndParent=0x201c2, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201b8 [0169.992] SetWindowLongW (hWnd=0x201b8, nIndex=-4, dwNewLong=1949808841) returned 23464838 [0169.992] GetWindowLongW (hWnd=0x201b8, nIndex=-4) returned 1949808841 [0169.993] SetWindowLongW (hWnd=0x201b8, nIndex=-4, dwNewLong=23508854) returned 1949808841 [0169.993] GetWindowLongW (hWnd=0x201b8, nIndex=-4) returned 23508854 [0169.993] GetWindowLongW (hWnd=0x201b8, nIndex=-16) returned 1174405133 [0169.993] GetWindowLongW (hWnd=0x201b8, nIndex=-12) returned 0 [0169.993] SetWindowLongW (hWnd=0x201b8, nIndex=-12, dwNewLong=131512) returned 0 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x81, wParam=0x0, lParam=0x2ae1e4) returned 0x1 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x83, wParam=0x0, lParam=0x2ae268) returned 0x0 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x1, wParam=0x0, lParam=0x2ae1e4) returned 0x0 [0169.993] GetClientRect (in: hWnd=0x201b8, lpRect=0x2adf24 | out: lpRect=0x2adf24) returned 1 [0169.993] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2adf24 | out: lpRect=0x2adf24) returned 1 [0169.993] GetParent (hWnd=0x201b8) returned 0x201c2 [0169.993] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf24, cPoints=0x2 | out: lpPoints=0x2adf24) returned -1900552 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0169.993] GetClientRect (in: hWnd=0x201b8, lpRect=0x2adfdc | out: lpRect=0x2adfdc) returned 1 [0169.993] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2adfdc | out: lpRect=0x2adfdc) returned 1 [0169.993] GetParent (hWnd=0x201b8) returned 0x201c2 [0169.993] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adfdc, cPoints=0x2 | out: lpPoints=0x2adfdc) returned -1900552 [0169.993] SendMessageW (hWnd=0x201b8, Msg=0x2210, wParam=0x1b80001, lParam=0x201b8) returned 0x0 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x2210, wParam=0x1b80001, lParam=0x201b8) returned 0x0 [0169.993] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0169.993] GetParent (hWnd=0x201b8) returned 0x201c2 [0169.994] GdipCreateFromHWND (hwnd=0x201b8, graphics=0x2ae81c) returned 0x0 [0170.005] GdipMeasureString (graphics=0x1755128, string="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.", length=248, font=0x5a95f10, layoutRect=0x2ae7e4, stringFormat=0x0, boundingBox=0x2ae7d4, codepointsFitted=0x2ae7d0, linesFilled=0x2ae7cc) returned 0x0 [0170.033] GdipDeleteGraphics (graphics=0x1755128) returned 0x0 [0170.034] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.034] GetCursorPos (in: lpPoint=0x1e6d790 | out: lpPoint=0x1e6d790*(x=977, y=452)) returned 1 [0170.038] GetSystemMetrics (nIndex=80) returned 1 [0170.039] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae5c4 | out: lpmi=0x2ae5c4) returned 1 [0170.039] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x48010843 [0170.039] GetDeviceCaps (hdc=0x48010843, index=12) returned 32 [0170.039] GetDeviceCaps (hdc=0x48010843, index=14) returned 1 [0170.039] DeleteDC (hdc=0x48010843) returned 1 [0170.040] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae618 | out: lpmi=0x2ae618) returned 1 [0170.040] AdjustWindowRectEx (in: lpRect=0x2ae7b0, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ae7b0) returned 1 [0170.040] GetSystemMetrics (nIndex=59) returned 1460 [0170.040] GetSystemMetrics (nIndex=60) returned 920 [0170.040] GetSystemMetrics (nIndex=34) returned 132 [0170.040] GetSystemMetrics (nIndex=35) returned 38 [0170.040] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.040] GetCursorPos (in: lpPoint=0x1e6da70 | out: lpPoint=0x1e6da70*(x=977, y=452)) returned 1 [0170.040] MonitorFromPoint (pt=0x3d2, dwFlags=0x1c3) returned 0x10001 [0170.040] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae4c8 | out: lpmi=0x2ae4c8) returned 1 [0170.040] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x49010843 [0170.040] GetDeviceCaps (hdc=0x49010843, index=12) returned 32 [0170.040] GetDeviceCaps (hdc=0x49010843, index=14) returned 1 [0170.040] DeleteDC (hdc=0x49010843) returned 1 [0170.040] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae51c | out: lpmi=0x2ae51c) returned 1 [0170.040] AdjustWindowRectEx (in: lpRect=0x2ae6b0, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ae6b0) returned 1 [0170.041] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.041] AdjustWindowRectEx (in: lpRect=0x2ae77c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae77c) returned 1 [0170.043] LoadIconW (hInstance=0x0, lpIconName=0x7f01) returned 0x1002d [0170.049] GetIconInfo (in: hIcon=0x1002d, piconinfo=0x1e6dde4 | out: piconinfo=0x1e6dde4) returned 1 [0170.057] GetObjectW (in: h=0x6605024c, c=24, pv=0x1e6de00 | out: pv=0x1e6de00) returned 24 [0170.058] GdipCreateBitmapFromHBITMAP (hbm=0x6605024c, hpal=0x0, bitmap=0x2ae708) returned 0x0 [0170.058] GdipGetImageWidth (image=0x178d7d0, width=0x2ae724) returned 0x0 [0170.058] GdipGetImageHeight (image=0x178d7d0, height=0x2ae720) returned 0x0 [0170.058] GdipGetImagePixelFormat (image=0x178d7d0, format=0x2ae718) returned 0x0 [0170.059] GdipBitmapLockBits (bitmap=0x178d7d0, rect=0x2ae6dc, flags=0x1, format=0x22009, lockedBitmapData=0x1e6ded4) returned 0x0 [0170.086] GdipCreateBitmapFromScan0 (width=32, height=32, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2ae718) returned 0x0 [0170.086] GdipBitmapLockBits (bitmap=0x178f018, rect=0x2ae6dc, flags=0x2, format=0x26200a, lockedBitmapData=0x1e6df0c) returned 0x0 [0170.087] RtlMoveMemory (in: Destination=0x177e850, Source=0x1780f28, Length=0x80 | out: Destination=0x177e850) [0170.087] RtlMoveMemory (in: Destination=0x177e8d0, Source=0x1780ea8, Length=0x80 | out: Destination=0x177e8d0) [0170.087] RtlMoveMemory (in: Destination=0x177e950, Source=0x1780e28, Length=0x80 | out: Destination=0x177e950) [0170.087] RtlMoveMemory (in: Destination=0x177e9d0, Source=0x1780da8, Length=0x80 | out: Destination=0x177e9d0) [0170.087] RtlMoveMemory (in: Destination=0x177ea50, Source=0x1780d28, Length=0x80 | out: Destination=0x177ea50) [0170.087] RtlMoveMemory (in: Destination=0x177ead0, Source=0x1780ca8, Length=0x80 | out: Destination=0x177ead0) [0170.087] RtlMoveMemory (in: Destination=0x177eb50, Source=0x1780c28, Length=0x80 | out: Destination=0x177eb50) [0170.087] RtlMoveMemory (in: Destination=0x177ebd0, Source=0x1780ba8, Length=0x80 | out: Destination=0x177ebd0) [0170.087] RtlMoveMemory (in: Destination=0x177ec50, Source=0x1780b28, Length=0x80 | out: Destination=0x177ec50) [0170.087] RtlMoveMemory (in: Destination=0x177ecd0, Source=0x1780aa8, Length=0x80 | out: Destination=0x177ecd0) [0170.087] RtlMoveMemory (in: Destination=0x177ed50, Source=0x1780a28, Length=0x80 | out: Destination=0x177ed50) [0170.087] RtlMoveMemory (in: Destination=0x177edd0, Source=0x17809a8, Length=0x80 | out: Destination=0x177edd0) [0170.087] RtlMoveMemory (in: Destination=0x177ee50, Source=0x1780928, Length=0x80 | out: Destination=0x177ee50) [0170.087] RtlMoveMemory (in: Destination=0x177eed0, Source=0x17808a8, Length=0x80 | out: Destination=0x177eed0) [0170.087] RtlMoveMemory (in: Destination=0x177ef50, Source=0x1780828, Length=0x80 | out: Destination=0x177ef50) [0170.088] RtlMoveMemory (in: Destination=0x177efd0, Source=0x17807a8, Length=0x80 | out: Destination=0x177efd0) [0170.088] RtlMoveMemory (in: Destination=0x177f050, Source=0x1780728, Length=0x80 | out: Destination=0x177f050) [0170.088] RtlMoveMemory (in: Destination=0x177f0d0, Source=0x17806a8, Length=0x80 | out: Destination=0x177f0d0) [0170.088] RtlMoveMemory (in: Destination=0x177f150, Source=0x1780628, Length=0x80 | out: Destination=0x177f150) [0170.088] RtlMoveMemory (in: Destination=0x177f1d0, Source=0x17805a8, Length=0x80 | out: Destination=0x177f1d0) [0170.088] RtlMoveMemory (in: Destination=0x177f250, Source=0x1780528, Length=0x80 | out: Destination=0x177f250) [0170.088] RtlMoveMemory (in: Destination=0x177f2d0, Source=0x17804a8, Length=0x80 | out: Destination=0x177f2d0) [0170.088] RtlMoveMemory (in: Destination=0x177f350, Source=0x1780428, Length=0x80 | out: Destination=0x177f350) [0170.088] RtlMoveMemory (in: Destination=0x177f3d0, Source=0x17803a8, Length=0x80 | out: Destination=0x177f3d0) [0170.088] RtlMoveMemory (in: Destination=0x177f450, Source=0x1780328, Length=0x80 | out: Destination=0x177f450) [0170.088] RtlMoveMemory (in: Destination=0x177f4d0, Source=0x17802a8, Length=0x80 | out: Destination=0x177f4d0) [0170.088] RtlMoveMemory (in: Destination=0x177f550, Source=0x1780228, Length=0x80 | out: Destination=0x177f550) [0170.088] RtlMoveMemory (in: Destination=0x177f5d0, Source=0x17801a8, Length=0x80 | out: Destination=0x177f5d0) [0170.088] RtlMoveMemory (in: Destination=0x177f650, Source=0x1780128, Length=0x80 | out: Destination=0x177f650) [0170.088] RtlMoveMemory (in: Destination=0x177f6d0, Source=0x17800a8, Length=0x80 | out: Destination=0x177f6d0) [0170.088] RtlMoveMemory (in: Destination=0x177f750, Source=0x1780028, Length=0x80 | out: Destination=0x177f750) [0170.088] RtlMoveMemory (in: Destination=0x177f7d0, Source=0x177ffa8, Length=0x80 | out: Destination=0x177f7d0) [0170.088] GdipBitmapUnlockBits (bitmap=0x178d7d0, lockedBitmapData=0x1e6ded4) returned 0x0 [0170.088] GdipBitmapUnlockBits (bitmap=0x178f018, lockedBitmapData=0x1e6df0c) returned 0x0 [0170.089] GdipDisposeImage (image=0x178d7d0) returned 0x0 [0170.089] DeleteObject (ho=0x6605024c) returned 1 [0170.089] DeleteObject (ho=0x4a050843) returned 1 [0170.089] GetCurrentThreadId () returned 0x970 [0170.089] GetCurrentThreadId () returned 0x970 [0170.102] SetWindowPos (hWnd=0x201b8, hWndInsertAfter=0x0, X=64, Y=8, cx=354, cy=81, uFlags=0x14) returned 1 [0170.102] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x46, wParam=0x0, lParam=0x2ae6fc) returned 0x0 [0170.102] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x83, wParam=0x1, lParam=0x2ae6d0) returned 0x0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x47, wParam=0x0, lParam=0x2ae6fc) returned 0x0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0 [0170.103] GetClientRect (in: hWnd=0x201b8, lpRect=0x2adf40 | out: lpRect=0x2adf40) returned 1 [0170.103] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2adf40 | out: lpRect=0x2adf40) returned 1 [0170.103] GetParent (hWnd=0x201b8) returned 0x201c2 [0170.103] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2adf40, cPoints=0x2 | out: lpPoints=0x2adf40) returned -1900552 [0170.103] InvalidateRect (hWnd=0x201b8, lpRect=0x0, bErase=1) returned 1 [0170.103] GetWindowTextLengthW (hWnd=0x201b8) returned 0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.103] GetSystemMetrics (nIndex=42) returned 0 [0170.103] GetWindowTextW (in: hWnd=0x201b8, lpString=0x2addd0, nMaxCount=1 | out: lpString="") returned 0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xd, wParam=0x1, lParam=0x2addd0) returned 0x0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x5, wParam=0x0, lParam=0x510162) returned 0x0 [0170.103] GetClientRect (in: hWnd=0x201b8, lpRect=0x2ae458 | out: lpRect=0x2ae458) returned 1 [0170.103] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2ae458 | out: lpRect=0x2ae458) returned 1 [0170.103] GetParent (hWnd=0x201b8) returned 0x201c2 [0170.103] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201c2, lpPoints=0x2ae458, cPoints=0x2 | out: lpPoints=0x2ae458) returned -1900552 [0170.103] GetWindowTextLengthW (hWnd=0x201b8) returned 0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.103] GetSystemMetrics (nIndex=42) returned 0 [0170.103] GetWindowTextW (in: hWnd=0x201b8, lpString=0x2ae754, nMaxCount=1 | out: lpString="") returned 0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xd, wParam=0x1, lParam=0x2ae754) returned 0x0 [0170.103] GetWindowTextLengthW (hWnd=0x201b8) returned 0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.103] GetSystemMetrics (nIndex=42) returned 0 [0170.103] GetWindowTextW (in: hWnd=0x201b8, lpString=0x2ae750, nMaxCount=1 | out: lpString="") returned 0 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xd, wParam=0x1, lParam=0x2ae750) returned 0x0 [0170.103] SetWindowTextW (hWnd=0x201b8, lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.") returned 1 [0170.103] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xc, wParam=0x0, lParam=0x1e4b5ec) returned 0x1 [0170.104] InvalidateRect (hWnd=0x201b8, lpRect=0x0, bErase=1) returned 1 [0170.104] GetCurrentThreadId () returned 0x970 [0170.104] GetWindowThreadProcessId (in: hWnd=0x201b8, lpdwProcessId=0x2ae7dc | out: lpdwProcessId=0x2ae7dc) returned 0x970 [0170.106] GdipCreateBitmapFromStream (stream=0x3a0010, bitmap=0x2ae818) returned 0x0 [0170.171] GdipImageForceValidation (image=0x178d7d0) returned 0x0 [0170.172] GdipGetImageRawFormat (image=0x178d7d0, format=0x2ae79c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0170.173] GdipGetImageHeight (image=0x178d7d0, height=0x2ae7fc) returned 0x0 [0170.173] GdipGetImageWidth (image=0x178d7d0, width=0x2ae7fc) returned 0x0 [0170.173] GdipGetImageWidth (image=0x178d7d0, width=0x2ae7e8) returned 0x0 [0170.173] GdipGetImageHeight (image=0x178d7d0, height=0x2ae7e8) returned 0x0 [0170.173] GdipGetImageWidth (image=0x178d7d0, width=0x2ae7d8) returned 0x0 [0170.173] GdipGetImageHeight (image=0x178d7d0, height=0x2ae7d8) returned 0x0 [0170.173] GdipBitmapGetPixel (bitmap=0x178d7d0, x=0, y=15, color=0x2ae7e8) returned 0x0 [0170.173] GdipGetImageRawFormat (image=0x178d7d0, format=0x2ae718*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0170.173] GdipGetImageWidth (image=0x178d7d0, width=0x2ae718) returned 0x0 [0170.173] GdipGetImageHeight (image=0x178d7d0, height=0x2ae718) returned 0x0 [0170.173] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2ae71c) returned 0x0 [0170.173] GdipGetImagePixelFormat (image=0x5a7b888, format=0x2ae718) returned 0x0 [0170.173] GdipGetImageGraphicsContext (image=0x5a7b888, graphics=0x2ae724) returned 0x0 [0170.174] GdipGraphicsClear (graphics=0x5a7bbb8, color=0xffffff) returned 0x0 [0170.174] GdipCreateImageAttributes (imageattr=0x2ae728) returned 0x0 [0170.174] GdipSetImageAttributesColorKeys (imageattr=0x17e2870, type=0x0, enableFlag=1, colorLow=0xffc0c0c0, colorHigh=0xffc0c0c0) returned 0x0 [0170.175] GdipDrawImageRectRectI (graphics=0x5a7bbb8, image=0x178d7d0, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x17e2870, callback=0x0, callbackData=0x0) returned 0x0 [0170.175] GdipDisposeImageAttributes (imageattr=0x17e2870) returned 0x0 [0170.175] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.175] GdipDisposeImage (image=0x178d7d0) returned 0x0 [0170.176] GdipCreateBitmapFromStream (stream=0x3afff0, bitmap=0x2ae818) returned 0x0 [0170.176] GdipImageForceValidation (image=0x178d7d0) returned 0x0 [0170.177] GdipGetImageRawFormat (image=0x178d7d0, format=0x2ae79c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0170.177] GdipGetImageHeight (image=0x178d7d0, height=0x2ae7fc) returned 0x0 [0170.177] GdipGetImageWidth (image=0x178d7d0, width=0x2ae7fc) returned 0x0 [0170.177] GdipGetImageWidth (image=0x178d7d0, width=0x2ae7e8) returned 0x0 [0170.177] GdipGetImageHeight (image=0x178d7d0, height=0x2ae7e8) returned 0x0 [0170.177] GdipGetImageWidth (image=0x178d7d0, width=0x2ae7d8) returned 0x0 [0170.177] GdipGetImageHeight (image=0x178d7d0, height=0x2ae7d8) returned 0x0 [0170.177] GdipBitmapGetPixel (bitmap=0x178d7d0, x=0, y=15, color=0x2ae7e8) returned 0x0 [0170.178] GdipGetImageRawFormat (image=0x178d7d0, format=0x2ae718*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0170.178] GdipGetImageWidth (image=0x178d7d0, width=0x2ae718) returned 0x0 [0170.178] GdipGetImageHeight (image=0x178d7d0, height=0x2ae718) returned 0x0 [0170.178] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2ae71c) returned 0x0 [0170.178] GdipGetImagePixelFormat (image=0x177fae0, format=0x2ae718) returned 0x0 [0170.178] GdipGetImageGraphicsContext (image=0x177fae0, graphics=0x2ae724) returned 0x0 [0170.178] GdipGraphicsClear (graphics=0x5a7bbb8, color=0xffffff) returned 0x0 [0170.178] GdipCreateImageAttributes (imageattr=0x2ae728) returned 0x0 [0170.178] GdipSetImageAttributesColorKeys (imageattr=0x17e2870, type=0x0, enableFlag=1, colorLow=0xffc0c0c0, colorHigh=0xffc0c0c0) returned 0x0 [0170.178] GdipDrawImageRectRectI (graphics=0x5a7bbb8, image=0x178d7d0, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x17e2870, callback=0x0, callbackData=0x0) returned 0x0 [0170.178] GdipDisposeImageAttributes (imageattr=0x17e2870) returned 0x0 [0170.178] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.178] GdipDisposeImage (image=0x178d7d0) returned 0x0 [0170.178] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.178] AdjustWindowRectEx (in: lpRect=0x2ae794, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae794) returned 1 [0170.334] GetCurrentThreadId () returned 0x970 [0170.334] GetCurrentThreadId () returned 0x970 [0170.335] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.335] AdjustWindowRectEx (in: lpRect=0x2ae794, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae794) returned 1 [0170.335] GetCurrentThreadId () returned 0x970 [0170.335] GetCurrentThreadId () returned 0x970 [0170.335] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.335] AdjustWindowRectEx (in: lpRect=0x2ae794, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae794) returned 1 [0170.335] GetCurrentThreadId () returned 0x970 [0170.335] GetCurrentThreadId () returned 0x970 [0170.454] GetSystemMetrics (nIndex=5) returned 1 [0170.454] GetSystemMetrics (nIndex=6) returned 1 [0170.454] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.454] AdjustWindowRectEx (in: lpRect=0x2ae6e8, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ae6e8) returned 1 [0170.454] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.454] AdjustWindowRectEx (in: lpRect=0x2ae6e8, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ae6e8) returned 1 [0170.687] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.687] AdjustWindowRectEx (in: lpRect=0x2ae768, dwStyle=0x563008c4, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ae768) returned 1 [0170.687] GetCurrentThreadId () returned 0x970 [0170.688] GetCurrentThreadId () returned 0x970 [0170.713] GetProcessWindowStation () returned 0x40 [0170.713] GetCurrentActCtx (in: lphActCtx=0x2ae7a4 | out: lphActCtx=0x2ae7a4*=0xb3664) returned 1 [0170.713] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.713] AdjustWindowRectEx (in: lpRect=0x2ae708, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ae708) returned 1 [0170.713] GetCursorPos (in: lpPoint=0x1e6f17c | out: lpPoint=0x1e6f17c*(x=977, y=452)) returned 1 [0170.713] MonitorFromPoint (pt=0x3d1, dwFlags=0x1c4) returned 0x10001 [0170.713] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae5e4 | out: lpmi=0x2ae5e4) returned 1 [0170.713] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x4b010843 [0170.713] GetDeviceCaps (hdc=0x4b010843, index=12) returned 32 [0170.713] GetDeviceCaps (hdc=0x4b010843, index=14) returned 1 [0170.713] DeleteDC (hdc=0x4b010843) returned 1 [0170.713] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae638 | out: lpmi=0x2ae638) returned 1 [0170.714] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.714] CreateWindowExW (dwExStyle=0x50001, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Microsoft .NET Framework", dwStyle=0x2c80000, X=493, Y=342, nWidth=454, nHeight=176, hWndParent=0x0, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201b2 [0170.714] SetWindowLongW (hWnd=0x201b2, nIndex=-4, dwNewLong=1991594109) returned 23463910 [0170.714] GetWindowLongW (hWnd=0x201b2, nIndex=-4) returned 1991594109 [0170.714] SetWindowLongW (hWnd=0x201b2, nIndex=-4, dwNewLong=23508894) returned 1991594109 [0170.714] GetWindowLongW (hWnd=0x201b2, nIndex=-4) returned 23508894 [0170.714] GetWindowLongW (hWnd=0x201b2, nIndex=-16) returned 113770496 [0170.714] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x81, wParam=0x0, lParam=0x2ae1ec) returned 0x1 [0170.714] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x83, wParam=0x0, lParam=0x2ae274) returned 0x0 [0170.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x1, wParam=0x0, lParam=0x2ae1b0) returned 0x0 [0170.715] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adefc | out: lpRect=0x2adefc) returned 1 [0170.715] GetWindowRect (in: hWnd=0x201b2, lpRect=0x2adefc | out: lpRect=0x2adefc) returned 1 [0170.715] SetWindowTextW (hWnd=0x201b2, lpString="Microsoft .NET Framework") returned 1 [0170.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xc, wParam=0x0, lParam=0x1e6d664) returned 0x1 [0170.715] GetStartupInfoW (in: lpStartupInfo=0x1e6f4b8 | out: lpStartupInfo=0x1e6f4b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\EEBsYm5\\Desktop\\Qinynore Ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0170.715] GetParent (hWnd=0x201b2) returned 0x0 [0170.715] SetWindowLongW (hWnd=0x201b2, nIndex=-8, dwNewLong=0) returned 0 [0170.715] SendMessageW (hWnd=0x201b2, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0170.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0170.715] SendMessageW (hWnd=0x201b2, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0170.715] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0170.716] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.716] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.716] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.716] GetSystemMenu (hWnd=0x201b2, bRevert=0) returned 0x9019d [0170.717] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2ae7b4 | out: lpwndpl=0x2ae7b4) returned 1 [0170.717] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0170.717] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0170.717] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0170.717] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0170.717] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0170.717] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae7f8 | out: lpRect=0x2ae7f8) returned 1 [0170.717] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae758 | out: lpRect=0x2ae758) returned 1 [0170.717] GetWindowRect (in: hWnd=0x201b2, lpRect=0x2ae758 | out: lpRect=0x2ae758) returned 1 [0170.717] SetWindowPos (hWnd=0x201b2, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0170.717] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x46, wParam=0x0, lParam=0x2ae774) returned 0x0 [0170.717] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x86, wParam=0x0, lParam=0x201b2) returned 0x1 [0170.718] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x46, wParam=0x0, lParam=0x2ae774) returned 0x0 [0170.718] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x86, wParam=0x0, lParam=0x201c4) returned 0x1 [0170.718] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.718] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.718] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x8, wParam=0x201b2, lParam=0x0) returned 0x0 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0170.719] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0170.719] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0170.719] GetParent (hWnd=0x201b2) returned 0x0 [0170.719] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7, wParam=0x201c4, lParam=0x0) returned 0x0 [0170.719] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2ae53c | out: lpwndpl=0x2ae53c) returned 1 [0170.719] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x47, wParam=0x0, lParam=0x2ae774) returned 0x0 [0170.719] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae4ec | out: lpRect=0x2ae4ec) returned 1 [0170.719] GetWindowRect (in: hWnd=0x201b2, lpRect=0x2ae4ec | out: lpRect=0x2ae4ec) returned 1 [0170.720] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.720] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.720] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.720] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x83, wParam=0x1, lParam=0x2ae370) returned 0x0 [0170.721] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.721] GetWindowLongW (hWnd=0x201b2, nIndex=-16) returned 113770496 [0170.721] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.721] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.721] GetSystemMetrics (nIndex=42) returned 0 [0170.721] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2ae6d4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.721] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ae6d4) returned 0x18 [0170.721] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.721] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.721] GetSystemMetrics (nIndex=42) returned 0 [0170.721] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2ae6d4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.721] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ae6d4) returned 0x18 [0170.721] GetCursorPos (in: lpPoint=0x1e6f760 | out: lpPoint=0x1e6f760*(x=977, y=452)) returned 1 [0170.721] MonitorFromPoint (pt=0x3d0, dwFlags=0x1c5) returned 0x10001 [0170.721] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae624 | out: lpmi=0x2ae624) returned 1 [0170.721] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x4b010826 [0170.721] GetDeviceCaps (hdc=0x4b010826, index=12) returned 32 [0170.721] GetDeviceCaps (hdc=0x4b010826, index=14) returned 1 [0170.721] DeleteDC (hdc=0x4b010826) returned 1 [0170.722] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae678 | out: lpmi=0x2ae678) returned 1 [0170.722] GetWindowLongW (hWnd=0x201b2, nIndex=-16) returned 113770496 [0170.722] GetWindowLongW (hWnd=0x201b2, nIndex=-20) returned 327945 [0170.722] SetWindowLongW (hWnd=0x201b2, nIndex=-16, dwNewLong=46661632) returned 113770496 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7c, wParam=0xfffffff0, lParam=0x2ae754) returned 0x0 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7d, wParam=0xfffffff0, lParam=0x2ae754) returned 0x0 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.722] SetWindowLongW (hWnd=0x201b2, nIndex=-20, dwNewLong=327681) returned 327945 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7c, wParam=0xffffffec, lParam=0x2ae754) returned 0x0 [0170.722] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7d, wParam=0xffffffec, lParam=0x2ae754) returned 0x0 [0170.723] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.723] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.723] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.723] SetWindowPos (hWnd=0x201b2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0170.723] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x46, wParam=0x0, lParam=0x2ae770) returned 0x0 [0170.723] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x83, wParam=0x1, lParam=0x2ae744) returned 0x0 [0170.723] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2ae538 | out: lpwndpl=0x2ae538) returned 1 [0170.723] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x47, wParam=0x0, lParam=0x2ae770) returned 0x0 [0170.723] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae4e8 | out: lpRect=0x2ae4e8) returned 1 [0170.723] GetWindowRect (in: hWnd=0x201b2, lpRect=0x2ae4e8 | out: lpRect=0x2ae4e8) returned 1 [0170.724] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.724] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.724] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.724] RedrawWindow (hWnd=0x201b2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0170.724] GetSystemMenu (hWnd=0x201b2, bRevert=0) returned 0x9019d [0170.724] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2ae7a4 | out: lpwndpl=0x2ae7a4) returned 1 [0170.724] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0170.724] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0170.724] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0170.724] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0170.724] EnableMenuItem (hMenu=0x9019d, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0170.724] GetWindowLongW (hWnd=0x201c4, nIndex=-8) returned 131510 [0170.724] GetWindowLongW (hWnd=0x201b2, nIndex=-8) returned 0 [0170.724] SetWindowLongW (hWnd=0x201b2, nIndex=-8, dwNewLong=131524) returned 0 [0170.725] GetCurrentActCtx (in: lphActCtx=0x2ae824 | out: lphActCtx=0x2ae824*=0xb3664) returned 1 [0170.725] GetProcessWindowStation () returned 0x40 [0170.727] GetCurrentThreadId () returned 0x970 [0170.727] EnumThreadWindows (dwThreadId=0x970, lpfn=0x166b7c6, lParam=0x0) returned 1 [0170.727] IsWindowVisible (hWnd=0x201b2) returned 0 [0170.727] IsWindowVisible (hWnd=0x201c4) returned 0 [0170.727] IsWindowVisible (hWnd=0x201b6) returned 0 [0170.727] IsWindowVisible (hWnd=0x60138) returned 0 [0170.727] IsWindowVisible (hWnd=0x3018c) returned 0 [0170.728] IsWindowVisible (hWnd=0x500f8) returned 0 [0170.728] GetActiveWindow () returned 0x201b2 [0170.728] GetFocus () returned 0x201b2 [0170.728] GetWindowLongW (hWnd=0x201b2, nIndex=-8) returned 131524 [0170.728] GetWindowThreadProcessId (in: hWnd=0x201c4, lpdwProcessId=0x2ae75c | out: lpdwProcessId=0x2ae75c) returned 0x970 [0170.728] GetCurrentThreadId () returned 0x970 [0170.728] GetWindowLongW (hWnd=0x201b2, nIndex=-8) returned 131524 [0170.728] IsWindowEnabled (hWnd=0x201c4) returned 1 [0170.741] EnableWindow (hWnd=0x201c4, bEnable=0) returned 0 [0170.741] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0170.741] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0170.741] IsWindowEnabled (hWnd=0x201b2) returned 1 [0170.741] ShowWindow (hWnd=0x201b2, nCmdShow=5) returned 0 [0170.741] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.741] GetCurrentActCtx (in: lphActCtx=0x2ae32c | out: lphActCtx=0x2ae32c*=0xb3664) returned 1 [0170.742] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.742] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.742] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=64, nHeight=64, hWndParent=0x201b2, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201b4 [0170.742] SetWindowLongW (hWnd=0x201b4, nIndex=-4, dwNewLong=1991594109) returned 23463910 [0170.742] GetWindowLongW (hWnd=0x201b4, nIndex=-4) returned 1991594109 [0170.742] SetWindowLongW (hWnd=0x201b4, nIndex=-4, dwNewLong=23508974) returned 1991594109 [0170.742] GetWindowLongW (hWnd=0x201b4, nIndex=-4) returned 23508974 [0170.742] GetWindowLongW (hWnd=0x201b4, nIndex=-16) returned 1174405120 [0170.742] GetWindowLongW (hWnd=0x201b4, nIndex=-12) returned 0 [0170.742] SetWindowLongW (hWnd=0x201b4, nIndex=-12, dwNewLong=131508) returned 0 [0170.742] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x81, wParam=0x0, lParam=0x2add74) returned 0x1 [0170.742] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x83, wParam=0x0, lParam=0x2addfc) returned 0x0 [0170.742] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x1, wParam=0x0, lParam=0x2add74) returned 0x0 [0170.742] GetWindow (hWnd=0x201b4, uCmd=0x3) returned 0x0 [0170.742] GetClientRect (in: hWnd=0x201b4, lpRect=0x2adaf0 | out: lpRect=0x2adaf0) returned 1 [0170.742] GetWindowRect (in: hWnd=0x201b4, lpRect=0x2adaf0 | out: lpRect=0x2adaf0) returned 1 [0170.743] GetParent (hWnd=0x201b4) returned 0x201b2 [0170.743] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adaf0, cPoints=0x2 | out: lpPoints=0x2adaf0) returned -24314357 [0170.743] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x5, wParam=0x0, lParam=0x400040) returned 0x0 [0170.743] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0170.743] GetClientRect (in: hWnd=0x201b4, lpRect=0x2adbac | out: lpRect=0x2adbac) returned 1 [0170.743] GetWindowRect (in: hWnd=0x201b4, lpRect=0x2adbac | out: lpRect=0x2adbac) returned 1 [0170.743] GetParent (hWnd=0x201b4) returned 0x201b2 [0170.743] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adbac, cPoints=0x2 | out: lpPoints=0x2adbac) returned -24314357 [0170.743] SendMessageW (hWnd=0x201b4, Msg=0x2210, wParam=0x1b40001, lParam=0x201b4) returned 0x0 [0170.743] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x2210, wParam=0x1b40001, lParam=0x201b4) returned 0x0 [0170.743] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.743] GetParent (hWnd=0x201b4) returned 0x201b2 [0170.743] GetParent (hWnd=0x201b8) returned 0x201c2 [0170.743] SetParent (hWndChild=0x201b8, hWndNewParent=0x201b2) returned 0x201c2 [0170.743] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0170.743] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x46, wParam=0x0, lParam=0x2ae328) returned 0x0 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x47, wParam=0x0, lParam=0x2ae328) returned 0x0 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0 [0170.744] GetClientRect (in: hWnd=0x201b8, lpRect=0x2adb6c | out: lpRect=0x2adb6c) returned 1 [0170.744] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2adb6c | out: lpRect=0x2adb6c) returned 1 [0170.744] GetParent (hWnd=0x201b8) returned 0x201b2 [0170.744] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adb6c, cPoints=0x2 | out: lpPoints=0x2adb6c) returned -24314357 [0170.744] GetClientRect (in: hWnd=0x201b8, lpRect=0x2ae084 | out: lpRect=0x2ae084) returned 1 [0170.744] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2ae084 | out: lpRect=0x2ae084) returned 1 [0170.744] GetParent (hWnd=0x201b8) returned 0x201b2 [0170.744] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2ae084, cPoints=0x2 | out: lpPoints=0x2ae084) returned -24314357 [0170.744] GetParent (hWnd=0x201b8) returned 0x201b2 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.744] GetWindow (hWnd=0x201b8, uCmd=0x3) returned 0x0 [0170.744] SetWindowPos (hWnd=0x201b8, hWndInsertAfter=0x201b4, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x46, wParam=0x0, lParam=0x2ae2d0) returned 0x0 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0170.744] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x47, wParam=0x0, lParam=0x2ae2d0) returned 0x0 [0170.744] GetClientRect (in: hWnd=0x201b8, lpRect=0x2ae02c | out: lpRect=0x2ae02c) returned 1 [0170.744] GetWindowRect (in: hWnd=0x201b8, lpRect=0x2ae02c | out: lpRect=0x2ae02c) returned 1 [0170.744] GetParent (hWnd=0x201b8) returned 0x201b2 [0170.744] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2ae02c, cPoints=0x2 | out: lpPoints=0x2ae02c) returned -24314357 [0170.744] GetParent (hWnd=0x201b8) returned 0x201b2 [0170.744] GetWindow (hWnd=0x201b8, uCmd=0x3) returned 0x201b4 [0170.745] GetWindowThreadProcessId (in: hWnd=0x201b8, lpdwProcessId=0x2ae3a0 | out: lpdwProcessId=0x2ae3a0) returned 0x970 [0170.745] GetCurrentActCtx (in: lphActCtx=0x2ae32c | out: lphActCtx=0x2ae32c*=0xb3664) returned 1 [0170.745] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.745] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x1e6fcb4 | out: lpWndClass=0x1e6fcb4) returned 1 [0170.745] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.745] CoTaskMemAlloc (cb=0x58) returned 0x9fe60 [0170.745] RegisterClassW (lpWndClass=0x2ae1e4) returned 0xc132 [0170.745] CoTaskMemFree (pv=0x9fe60) [0170.745] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.746] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r12_ad1", lpWindowName="&Details", dwStyle=0x5601000b, X=8, Y=107, nWidth=100, nHeight=23, hWndParent=0x201b2, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201ae [0170.746] SetWindowLongW (hWnd=0x201ae, nIndex=-4, dwNewLong=1949873301) returned 23509014 [0170.746] GetWindowLongW (hWnd=0x201ae, nIndex=-4) returned 1949873301 [0170.746] SetWindowLongW (hWnd=0x201ae, nIndex=-4, dwNewLong=23509054) returned 1949873301 [0170.746] GetWindowLongW (hWnd=0x201ae, nIndex=-4) returned 23509054 [0170.746] GetWindowLongW (hWnd=0x201ae, nIndex=-16) returned 1174470667 [0170.746] GetWindowLongW (hWnd=0x201ae, nIndex=-12) returned 0 [0170.746] SetWindowLongW (hWnd=0x201ae, nIndex=-12, dwNewLong=131502) returned 0 [0170.746] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x81, wParam=0x0, lParam=0x2add78) returned 0x1 [0170.746] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x83, wParam=0x0, lParam=0x2addfc) returned 0x0 [0170.746] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x1, wParam=0x0, lParam=0x2add5c) returned 0x0 [0170.746] SendMessageW (hWnd=0x201ae, Msg=0x2055, wParam=0x201ae, lParam=0x3) returned 0x2 [0170.747] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0170.747] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0170.747] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0170.747] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0170.747] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0170.747] RedrawWindow (hWnd=0x201b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0170.747] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0170.747] RedrawWindow (hWnd=0x201b8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0170.747] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0170.747] RedrawWindow (hWnd=0x201ae, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0170.747] RedrawWindow (hWnd=0x201b2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0170.747] GetWindow (hWnd=0x201ae, uCmd=0x3) returned 0x201b8 [0170.747] GetClientRect (in: hWnd=0x201ae, lpRect=0x2ada90 | out: lpRect=0x2ada90) returned 1 [0170.747] GetWindowRect (in: hWnd=0x201ae, lpRect=0x2ada90 | out: lpRect=0x2ada90) returned 1 [0170.747] GetParent (hWnd=0x201ae) returned 0x201b2 [0170.747] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2ada90, cPoints=0x2 | out: lpPoints=0x2ada90) returned -24314357 [0170.747] SetWindowTextW (hWnd=0x201ae, lpString="&Details") returned 1 [0170.747] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0xc, wParam=0x0, lParam=0x1e6e318) returned 0x1 [0170.747] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0170.748] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x3, wParam=0x0, lParam=0x6b0008) returned 0x0 [0170.748] GetClientRect (in: hWnd=0x201ae, lpRect=0x2adb64 | out: lpRect=0x2adb64) returned 1 [0170.748] GetWindowRect (in: hWnd=0x201ae, lpRect=0x2adb64 | out: lpRect=0x2adb64) returned 1 [0170.748] GetParent (hWnd=0x201ae) returned 0x201b2 [0170.748] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adb64, cPoints=0x2 | out: lpPoints=0x2adb64) returned -24314357 [0170.748] SendMessageW (hWnd=0x201ae, Msg=0x2210, wParam=0x1ae0001, lParam=0x201ae) returned 0x0 [0170.748] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x2210, wParam=0x1ae0001, lParam=0x201ae) returned 0x0 [0170.748] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.748] GetParent (hWnd=0x201ae) returned 0x201b2 [0170.748] GetCurrentActCtx (in: lphActCtx=0x2ae32c | out: lphActCtx=0x2ae32c*=0xb3664) returned 1 [0170.748] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.748] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.748] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r12_ad1", lpWindowName="&Continue", dwStyle=0x5601000b, X=225, Y=107, nWidth=100, nHeight=23, hWndParent=0x201b2, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201b0 [0170.748] SetWindowLongW (hWnd=0x201b0, nIndex=-4, dwNewLong=1949873301) returned 23509014 [0170.748] GetWindowLongW (hWnd=0x201b0, nIndex=-4) returned 1949873301 [0170.749] SetWindowLongW (hWnd=0x201b0, nIndex=-4, dwNewLong=23509094) returned 1949873301 [0170.749] GetWindowLongW (hWnd=0x201b0, nIndex=-4) returned 23509094 [0170.749] GetWindowLongW (hWnd=0x201b0, nIndex=-16) returned 1174470667 [0170.749] GetWindowLongW (hWnd=0x201b0, nIndex=-12) returned 0 [0170.749] SetWindowLongW (hWnd=0x201b0, nIndex=-12, dwNewLong=131504) returned 0 [0170.749] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x81, wParam=0x0, lParam=0x2add78) returned 0x1 [0170.749] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x83, wParam=0x0, lParam=0x2addfc) returned 0x0 [0170.749] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x1, wParam=0x0, lParam=0x2add5c) returned 0x0 [0170.749] SendMessageW (hWnd=0x201b0, Msg=0x2055, wParam=0x201b0, lParam=0x3) returned 0x2 [0170.749] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0170.749] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0170.749] GetWindow (hWnd=0x201b0, uCmd=0x3) returned 0x201ae [0170.749] GetClientRect (in: hWnd=0x201b0, lpRect=0x2ada90 | out: lpRect=0x2ada90) returned 1 [0170.749] GetWindowRect (in: hWnd=0x201b0, lpRect=0x2ada90 | out: lpRect=0x2ada90) returned 1 [0170.749] GetParent (hWnd=0x201b0) returned 0x201b2 [0170.749] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2ada90, cPoints=0x2 | out: lpPoints=0x2ada90) returned -24314357 [0170.750] SetWindowTextW (hWnd=0x201b0, lpString="&Continue") returned 1 [0170.750] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0xc, wParam=0x0, lParam=0x1e6e22c) returned 0x1 [0170.750] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0170.750] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x3, wParam=0x0, lParam=0x6b00e1) returned 0x0 [0170.750] GetClientRect (in: hWnd=0x201b0, lpRect=0x2adb64 | out: lpRect=0x2adb64) returned 1 [0170.750] GetWindowRect (in: hWnd=0x201b0, lpRect=0x2adb64 | out: lpRect=0x2adb64) returned 1 [0170.750] GetParent (hWnd=0x201b0) returned 0x201b2 [0170.750] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adb64, cPoints=0x2 | out: lpPoints=0x2adb64) returned -24314357 [0170.750] SendMessageW (hWnd=0x201b0, Msg=0x2210, wParam=0x1b00001, lParam=0x201b0) returned 0x0 [0170.750] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x2210, wParam=0x1b00001, lParam=0x201b0) returned 0x0 [0170.750] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.750] GetParent (hWnd=0x201b0) returned 0x201b2 [0170.750] GetCurrentActCtx (in: lphActCtx=0x2ae32c | out: lphActCtx=0x2ae32c*=0xb3664) returned 1 [0170.750] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.750] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.750] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r12_ad1", lpWindowName="&Quit", dwStyle=0x5601000b, X=330, Y=107, nWidth=100, nHeight=23, hWndParent=0x201b2, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201aa [0170.750] SetWindowLongW (hWnd=0x201aa, nIndex=-4, dwNewLong=1949873301) returned 23509014 [0170.750] GetWindowLongW (hWnd=0x201aa, nIndex=-4) returned 1949873301 [0170.751] SetWindowLongW (hWnd=0x201aa, nIndex=-4, dwNewLong=23509134) returned 1949873301 [0170.751] GetWindowLongW (hWnd=0x201aa, nIndex=-4) returned 23509134 [0170.751] GetWindowLongW (hWnd=0x201aa, nIndex=-16) returned 1174470667 [0170.751] GetWindowLongW (hWnd=0x201aa, nIndex=-12) returned 0 [0170.751] SetWindowLongW (hWnd=0x201aa, nIndex=-12, dwNewLong=131498) returned 0 [0170.751] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x81, wParam=0x0, lParam=0x2add78) returned 0x1 [0170.751] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x83, wParam=0x0, lParam=0x2addfc) returned 0x0 [0170.751] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x1, wParam=0x0, lParam=0x2add64) returned 0x0 [0170.751] SendMessageW (hWnd=0x201aa, Msg=0x2055, wParam=0x201aa, lParam=0x3) returned 0x2 [0170.751] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0170.751] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0170.751] GetWindow (hWnd=0x201aa, uCmd=0x3) returned 0x201b0 [0170.751] GetClientRect (in: hWnd=0x201aa, lpRect=0x2ada98 | out: lpRect=0x2ada98) returned 1 [0170.751] GetWindowRect (in: hWnd=0x201aa, lpRect=0x2ada98 | out: lpRect=0x2ada98) returned 1 [0170.751] GetParent (hWnd=0x201aa) returned 0x201b2 [0170.751] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2ada98, cPoints=0x2 | out: lpPoints=0x2ada98) returned -24314357 [0170.752] SetWindowTextW (hWnd=0x201aa, lpString="&Quit") returned 1 [0170.752] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0xc, wParam=0x0, lParam=0x1e6e280) returned 0x1 [0170.752] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0170.752] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x3, wParam=0x0, lParam=0x6b014a) returned 0x0 [0170.752] GetClientRect (in: hWnd=0x201aa, lpRect=0x2adb64 | out: lpRect=0x2adb64) returned 1 [0170.752] GetWindowRect (in: hWnd=0x201aa, lpRect=0x2adb64 | out: lpRect=0x2adb64) returned 1 [0170.752] GetParent (hWnd=0x201aa) returned 0x201b2 [0170.752] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adb64, cPoints=0x2 | out: lpPoints=0x2adb64) returned -24314357 [0170.752] SendMessageW (hWnd=0x201aa, Msg=0x2210, wParam=0x1aa0001, lParam=0x201aa) returned 0x0 [0170.752] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x2210, wParam=0x1aa0001, lParam=0x201aa) returned 0x0 [0170.752] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.752] GetParent (hWnd=0x201aa) returned 0x201b2 [0170.752] GetCurrentActCtx (in: lphActCtx=0x2ae308 | out: lphActCtx=0x2ae308*=0xb3664) returned 1 [0170.752] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.752] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x1e70214 | out: lpWndClass=0x1e70214) returned 1 [0170.753] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.753] CoTaskMemAlloc (cb=0x54) returned 0x9fe60 [0170.753] RegisterClassW (lpWndClass=0x2ae1c0) returned 0xc13d [0170.753] CoTaskMemFree (pv=0x9fe60) [0170.753] GetModuleHandleW (lpModuleName=0x0) returned 0x1350000 [0170.753] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r12_ad1", lpWindowName="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.ArgumentNullException: Value cannot be null.\r\nParameter name: input\r\n at System.IO.BinaryReader..ctor(Stream input, Encoding encoding, Boolean leaveOpen)\r\n at System.IO.BinaryReader..ctor(Stream input)\r\n at hidden_tear.Form1.Extract(String nameSpace, String outDirectory, String InternalFilePath, String resourceName)\r\n at hidden_tear.Form1.UpdateWallpaper()\r\n at hidden_tear.Form1.startAction()\r\n at hidden_tear.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nQinynore Ransomware\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/EEBsYm5/Desktop/Qinynore%20Ransomware.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n", dwStyle=0x563008c4, X=8, Y=138, nWidth=422, nHeight=154, hWndParent=0x201b2, hMenu=0x0, hInstance=0x1350000, lpParam=0x0) returned 0x201ac [0170.753] SetWindowLongW (hWnd=0x201ac, nIndex=-4, dwNewLong=1949735376) returned 23509174 [0170.753] GetWindowLongW (hWnd=0x201ac, nIndex=-4) returned 1949735376 [0170.754] SetWindowLongW (hWnd=0x201ac, nIndex=-4, dwNewLong=23509214) returned 1949735376 [0170.754] GetWindowLongW (hWnd=0x201ac, nIndex=-4) returned 23509214 [0170.754] GetWindowLongW (hWnd=0x201ac, nIndex=-16) returned 1177553092 [0170.754] GetWindowLongW (hWnd=0x201ac, nIndex=-12) returned 0 [0170.754] SetWindowLongW (hWnd=0x201ac, nIndex=-12, dwNewLong=131500) returned 0 [0170.754] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x81, wParam=0x0, lParam=0x2add58) returned 0x1 [0170.754] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x83, wParam=0x0, lParam=0x2addd8) returned 0x0 [0170.754] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x1, wParam=0x0, lParam=0x2adda8) returned 0x1 [0170.763] GetWindow (hWnd=0x201ac, uCmd=0x3) returned 0x201aa [0170.763] GetClientRect (in: hWnd=0x201ac, lpRect=0x2adafc | out: lpRect=0x2adafc) returned 1 [0170.763] GetWindowRect (in: hWnd=0x201ac, lpRect=0x2adafc | out: lpRect=0x2adafc) returned 1 [0170.763] GetParent (hWnd=0x201ac) returned 0x201b2 [0170.763] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adafc, cPoints=0x2 | out: lpPoints=0x2adafc) returned -24314357 [0170.763] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.763] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.763] GetSystemMetrics (nIndex=42) returned 0 [0170.763] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2ad97c, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.763] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ad97c) returned 0x18 [0170.763] SendMessageW (hWnd=0x201ac, Msg=0x30, wParam=0x130a0726, lParam=0x0) returned 0x1 [0170.763] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x30, wParam=0x130a0726, lParam=0x0) returned 0x1 [0170.773] SetWindowTextW (hWnd=0x201ac, lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.ArgumentNullException: Value cannot be null.\r\nParameter name: input\r\n at System.IO.BinaryReader..ctor(Stream input, Encoding encoding, Boolean leaveOpen)\r\n at System.IO.BinaryReader..ctor(Stream input)\r\n at hidden_tear.Form1.Extract(String nameSpace, String outDirectory, String InternalFilePath, String resourceName)\r\n at hidden_tear.Form1.UpdateWallpaper()\r\n at hidden_tear.Form1.startAction()\r\n at hidden_tear.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nQinynore Ransomware\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/EEBsYm5/Desktop/Qinynore%20Ransomware.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 1 [0170.773] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0xc, wParam=0x0, lParam=0x1e6b9a4) returned 0x1 [0170.774] GetSystemMetrics (nIndex=5) returned 1 [0170.774] GetSystemMetrics (nIndex=6) returned 1 [0170.774] SendMessageW (hWnd=0x201ac, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0170.774] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0170.774] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x5, wParam=0x0, lParam=0x850191) returned 0x1 [0170.774] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x3, wParam=0x0, lParam=0x8c000a) returned 0x0 [0170.774] GetClientRect (in: hWnd=0x201ac, lpRect=0x2adb60 | out: lpRect=0x2adb60) returned 1 [0170.774] GetWindowRect (in: hWnd=0x201ac, lpRect=0x2adb60 | out: lpRect=0x2adb60) returned 1 [0170.774] GetParent (hWnd=0x201ac) returned 0x201b2 [0170.774] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201b2, lpPoints=0x2adb60, cPoints=0x2 | out: lpPoints=0x2adb60) returned -24314357 [0170.774] SendMessageW (hWnd=0x201ac, Msg=0x2210, wParam=0x1ac0001, lParam=0x201ac) returned 0x0 [0170.774] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x2210, wParam=0x1ac0001, lParam=0x201ac) returned 0x0 [0170.774] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0170.774] GetParent (hWnd=0x201ac) returned 0x201b2 [0170.774] GetWindowLongW (hWnd=0x201b2, nIndex=-8) returned 131524 [0170.775] MonitorFromWindow (hwnd=0x201c4, dwFlags=0x2) returned 0x10001 [0170.775] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae268 | out: lpmi=0x2ae268) returned 1 [0170.775] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x57010826 [0170.775] GetDeviceCaps (hdc=0x57010826, index=12) returned 32 [0170.775] GetDeviceCaps (hdc=0x57010826, index=14) returned 1 [0170.775] DeleteDC (hdc=0x57010826) returned 1 [0170.775] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ae290 | out: lpmi=0x2ae290) returned 1 [0170.775] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x2ae340 | out: lpdwProcessId=0x2ae340) returned 0x970 [0170.775] GetCurrentThreadId () returned 0x970 [0170.776] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc13e [0170.776] PostMessageW (hWnd=0x201b2, Msg=0xc13e, wParam=0x0, lParam=0x0) returned 1 [0170.776] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.776] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.776] GetSystemMetrics (nIndex=42) returned 0 [0170.776] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2ae298, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.776] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ae298) returned 0x18 [0170.777] GdipImageGetFrameDimensionsCount (image=0x178f018, count=0x2ae2a4) returned 0x0 [0170.777] GdipImageGetFrameDimensionsList (image=0x178f018, dimensionIDs=0x3edd990*(Data1=0x6e0065, Data2=0x6b, Data3=0x6e, Data4=([0]=0x6f, [1]=0x0, [2]=0x77, [3]=0x0, [4]=0x6e, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0170.779] LocalFree (hMem=0x3edd990) returned 0x0 [0170.781] GdipImageGetFrameDimensionsCount (image=0x5a7b888, count=0x2ae298) returned 0x0 [0170.781] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x3edd9c0 [0170.781] GdipImageGetFrameDimensionsList (image=0x5a7b888, dimensionIDs=0x3edd9c0*(Data1=0x6b, Data2=0x1, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0170.781] LocalFree (hMem=0x3edd9c0) returned 0x0 [0170.782] SystemParametersInfoW (in: uiAction=0x5f, uiParam=0x0, pvParam=0x2ae3d8, fWinIni=0x0 | out: pvParam=0x2ae3d8) returned 1 [0170.782] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x46, wParam=0x0, lParam=0x2ae6bc) returned 0x0 [0170.782] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x46, wParam=0x0, lParam=0x2ae6bc) returned 0x0 [0170.782] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x46, wParam=0x0, lParam=0x2ae6bc) returned 0x0 [0170.784] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0170.784] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.784] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.784] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.785] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2ae49c | out: lpwndpl=0x2ae49c) returned 1 [0170.785] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae448 | out: lpRect=0x2ae448) returned 1 [0170.785] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.785] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.785] GetSystemMetrics (nIndex=42) returned 0 [0170.785] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2ae2ec, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.785] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ae2ec) returned 0x18 [0170.785] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae350 | out: lpRect=0x2ae350) returned 1 [0170.787] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x166b906, dwData=0x0) returned 1 [0170.787] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2adfc8 | out: lpmi=0x2adfc8) returned 1 [0170.788] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x24010840 [0170.788] GetDeviceCaps (hdc=0x24010840, index=12) returned 32 [0170.788] GetDeviceCaps (hdc=0x24010840, index=14) returned 1 [0170.788] DeleteDC (hdc=0x24010840) returned 1 [0170.788] GetCurrentObject (hdc=0x101080f, type=0x1) returned 0x1b00017 [0170.788] GetCurrentObject (hdc=0x101080f, type=0x2) returned 0x1900010 [0170.788] GetCurrentObject (hdc=0x101080f, type=0x7) returned 0x1050032 [0170.788] GetCurrentObject (hdc=0x101080f, type=0x6) returned 0x18a002e [0170.788] SaveDC (hdc=0x101080f) returned 1 [0170.788] GetNearestColor (hdc=0x101080f, color=0xf0f0f0) returned 0xf0f0f0 [0170.789] CreateSolidBrush (color=0xf0f0f0) returned 0x22100834 [0170.789] FillRect (hDC=0x101080f, lprc=0x2ae1f0, hbr=0x22100834) returned 1 [0170.789] DeleteObject (ho=0x22100834) returned 1 [0170.789] RestoreDC (hdc=0x101080f, nSavedDC=-1) returned 1 [0170.790] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0170.790] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0170.790] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0170.790] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x14, wParam=0x3010800, lParam=0x0) returned 0x1 [0170.790] GetStockObject (i=5) returned 0x1900015 [0170.790] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0170.790] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x14, wParam=0x101080f, lParam=0x0) returned 0x1 [0170.790] GetStockObject (i=5) returned 0x1900015 [0170.791] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0170.791] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x14, wParam=0xa0107f7, lParam=0x0) returned 0x1 [0170.791] GetStockObject (i=5) returned 0x1900015 [0170.791] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2ae484 | out: lpwndpl=0x2ae484) returned 1 [0170.791] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x47, wParam=0x0, lParam=0x2ae6bc) returned 0x0 [0170.791] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae434 | out: lpRect=0x2ae434) returned 1 [0170.791] GetWindowRect (in: hWnd=0x201b2, lpRect=0x2ae434 | out: lpRect=0x2ae434) returned 1 [0170.791] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.791] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.791] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.791] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x5, wParam=0x0, lParam=0x8a01b6) returned 0x0 [0170.792] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x3, wParam=0x0, lParam=0x17401f5) returned 0x0 [0170.792] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0170.792] GetWindowRect (in: hWnd=0x201b2, lpRect=0x2ae460 | out: lpRect=0x2ae460) returned 1 [0170.792] InvalidateRect (hWnd=0x201b0, lpRect=0x0, bErase=0) returned 1 [0170.792] InvalidateRect (hWnd=0x201ae, lpRect=0x0, bErase=0) returned 1 [0170.792] GetFocus () returned 0x201b2 [0170.792] GetFocus () returned 0x201b2 [0170.792] SetFocus (hWnd=0x201ae) returned 0x201b2 [0170.792] GetFocus () returned 0x201ae [0170.792] IsChild (hWndParent=0x201b2, hWnd=0x201ae) returned 1 [0170.792] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x8, wParam=0x201ae, lParam=0x0) returned 0x0 [0170.792] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0170.792] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0170.792] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0170.792] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x7, wParam=0x201b2, lParam=0x0) returned 0x0 [0170.792] GetStockObject (i=5) returned 0x1900015 [0170.792] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0170.793] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0xd, wParam=0x9, lParam=0x3edfb88) returned 0x8 [0170.793] GetDlgItem (hDlg=0x201b2, nIDDlgItem=131502) returned 0x201ae [0170.793] SendMessageW (hWnd=0x201ae, Msg=0x202b, wParam=0x201ae, lParam=0x2ae1b8) returned 0x0 [0170.793] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x202b, wParam=0x201ae, lParam=0x2ae1b8) returned 0x0 [0170.793] InvalidateRect (hWnd=0x201ae, lpRect=0x0, bErase=0) returned 1 [0170.793] GetFocus () returned 0x201ae [0170.793] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.793] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0170.793] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0170.808] DefWindowProcW (hWnd=0x60138, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0170.808] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0170.808] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0170.808] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0170.808] IsWindowUnicode (hWnd=0x201b2) returned 1 [0170.809] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.809] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.809] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.810] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.813] GetMessageA (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.813] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.813] DispatchMessageA (lpMsg=0x2ae7a8) returned 0x0 [0170.813] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.813] IsWindowUnicode (hWnd=0x201b2) returned 1 [0170.813] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.813] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.813] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.813] BeginPaint (in: hWnd=0x201b2, lpPaint=0x2ae2d0 | out: lpPaint=0x2ae2d0) returned 0x3010800 [0170.814] GdipCreateHalftonePalette () returned 0x5f080826 [0170.814] SelectPalette (hdc=0x3010800, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.814] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.814] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.814] GetSystemMetrics (nIndex=42) returned 0 [0170.814] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2ae244, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.814] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ae244) returned 0x18 [0170.814] SelectPalette (hdc=0x3010800, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.815] EndPaint (hWnd=0x201b2, lpPaint=0x2ae2cc) returned 1 [0170.815] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.815] IsWindowUnicode (hWnd=0x201b4) returned 1 [0170.815] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.815] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.815] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.815] BeginPaint (in: hWnd=0x201b4, lpPaint=0x2ae2f0 | out: lpPaint=0x2ae2f0) returned 0xa0107f7 [0170.815] SelectPalette (hdc=0xa0107f7, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.815] CreateCompatibleDC (hdc=0xa0107f7) returned 0x68010289 [0170.816] GetObjectType (h=0xa0107f7) returned 0x3 [0170.816] CreateCompatibleBitmap (hdc=0xa0107f7, cx=1, cy=1) returned 0x33050840 [0170.816] GetDIBits (in: hdc=0xa0107f7, hbm=0x33050840, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2adde0, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2adde0) returned 1 [0170.816] GetDIBits (in: hdc=0xa0107f7, hbm=0x33050840, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2adde0, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2adde0) returned 1 [0170.816] DeleteObject (ho=0x33050840) returned 1 [0170.816] CreateDIBSection (in: hdc=0xa0107f7, lpbmi=0x2ade30, usage=0x0, ppvBits=0x2ae324, hSection=0x0, offset=0x0 | out: ppvBits=0x2ae324) returned 0x26050820 [0170.816] SelectObject (hdc=0x68010289, h=0x26050820) returned 0x185000f [0170.817] GdipCreateFromHDC (hdc=0x68010289, graphics=0x2ae308) returned 0x0 [0170.817] GdipTranslateWorldTransform (graphics=0x5a7bbb8, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0170.817] GdipSetClipRectI (graphics=0x5a7bbb8, x=0, y=0, width=64, height=64, combineMode=0x0) returned 0x0 [0170.818] GdipCreateMatrix (matrix=0x2ae350) returned 0x0 [0170.818] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.825] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2ae368) returned 0x0 [0170.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.826] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.827] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.827] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.827] GdipCreateRegion (region=0x2ae350) returned 0x0 [0170.827] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.827] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae35c) returned 0x0 [0170.828] GdipSaveGraphics (graphics=0x5a7bbb8, state=0x2ae388) returned 0x0 [0170.828] GetWindowTextLengthW (hWnd=0x201b4) returned 0 [0170.828] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.828] GetSystemMetrics (nIndex=42) returned 0 [0170.828] GetWindowTextW (in: hWnd=0x201b4, lpString=0x2ae2a0, nMaxCount=1 | out: lpString="") returned 0 [0170.828] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0xd, wParam=0x1, lParam=0x2ae2a0) returned 0x0 [0170.828] GetClientRect (in: hWnd=0x201b4, lpRect=0x2ae350 | out: lpRect=0x2ae350) returned 1 [0170.828] GdipCreateRegion (region=0x2ae1a4) returned 0x0 [0170.828] GdipGetClip (graphics=0x5a7bbb8, region=0x1755318) returned 0x0 [0170.828] GdipCreateMatrix (matrix=0x2ae1a4) returned 0x0 [0170.828] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.828] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2ae1bc) returned 0x0 [0170.828] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.828] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.829] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.829] GdipCombineRegionRegion (region=0x1755318, region2=0x1790808, combineMode=0x1) returned 0x0 [0170.829] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.829] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.829] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.829] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.829] GdipIsInfiniteRegion (region=0x1755318, graphics=0x5a7bbb8, result=0x2ae1e4) returned 0x0 [0170.829] GdipIsInfiniteRegion (region=0x1755318, graphics=0x5a7bbb8, result=0x2ae1d4) returned 0x0 [0170.829] GdipGetRegionHRgn (region=0x1755318, graphics=0x5a7bbb8, hRgn=0x2ae1d4) returned 0x0 [0170.829] GdipDeleteRegion (region=0x1755318) returned 0x0 [0170.829] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae1ec) returned 0x0 [0170.830] GetCurrentObject (hdc=0x68010289, type=0x1) returned 0x1b00017 [0170.830] GetCurrentObject (hdc=0x68010289, type=0x2) returned 0x1900010 [0170.830] GetCurrentObject (hdc=0x68010289, type=0x7) returned 0x26050820 [0170.830] GetCurrentObject (hdc=0x68010289, type=0x6) returned 0x18a002e [0170.830] SaveDC (hdc=0x68010289) returned 1 [0170.830] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3604022e [0170.830] GetClipRgn (hdc=0x68010289, hrgn=0x3604022e) returned 0 [0170.830] SelectClipRgn (hdc=0x68010289, hrgn=0x57040288) returned 2 [0170.830] DeleteObject (ho=0x3604022e) returned 1 [0170.830] DeleteObject (ho=0x57040288) returned 1 [0170.830] OffsetViewportOrgEx (in: hdc=0x68010289, x=0, y=0, lppt=0x1e72cb0 | out: lppt=0x1e72cb0) returned 1 [0170.830] GetNearestColor (hdc=0x68010289, color=0xf0f0f0) returned 0xf0f0f0 [0170.830] CreateSolidBrush (color=0xf0f0f0) returned 0x23100834 [0170.830] FillRect (hDC=0x68010289, lprc=0x2ae1f0, hbr=0x23100834) returned 1 [0170.831] DeleteObject (ho=0x23100834) returned 1 [0170.831] RestoreDC (hdc=0x68010289, nSavedDC=-1) returned 1 [0170.831] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x68010289) returned 0x0 [0170.831] GdipRestoreGraphics (graphics=0x5a7bbb8, state=0xfdb40dbd) returned 0x0 [0170.831] GdipDeleteRegion (region=0x1790808) returned 0x0 [0170.831] GetWindowTextLengthW (hWnd=0x201b4) returned 0 [0170.831] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0170.831] GetSystemMetrics (nIndex=42) returned 0 [0170.831] GetWindowTextW (in: hWnd=0x201b4, lpString=0x2ae2a0, nMaxCount=1 | out: lpString="") returned 0 [0170.831] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0xd, wParam=0x1, lParam=0x2ae2a0) returned 0x0 [0170.831] GdipGetImageWidth (image=0x178f018, width=0x2ae238) returned 0x0 [0170.832] GdipGetImageHeight (image=0x178f018, height=0x2ae238) returned 0x0 [0170.832] GdipGetImageWidth (image=0x178f018, width=0x2ae224) returned 0x0 [0170.832] GdipGetImageHeight (image=0x178f018, height=0x2ae224) returned 0x0 [0170.832] GdipDrawImageRectI (graphics=0x5a7bbb8, image=0x178f018, x=16, y=16, width=32, height=32) returned 0x0 [0170.832] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae348) returned 0x0 [0170.833] BitBlt (hdc=0xa0107f7, x=0, y=0, cx=64, cy=64, hdcSrc=0x68010289, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.833] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x68010289) returned 0x0 [0170.833] SelectPalette (hdc=0xa0107f7, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.833] SelectObject (hdc=0x68010289, h=0x185000f) returned 0x26050820 [0170.833] DeleteDC (hdc=0x68010289) returned 1 [0170.833] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.833] EndPaint (hWnd=0x201b4, lpPaint=0x2ae2ec) returned 1 [0170.833] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.833] IsWindowUnicode (hWnd=0x201b8) returned 1 [0170.833] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.833] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.833] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.833] BeginPaint (in: hWnd=0x201b8, lpPaint=0x2ae2b4 | out: lpPaint=0x2ae2b4) returned 0xa0107f7 [0170.833] SelectPalette (hdc=0xa0107f7, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.833] CreateCompatibleDC (hdc=0xa0107f7) returned 0x6a010289 [0170.834] GetObjectType (h=0xa0107f7) returned 0x3 [0170.834] CreateCompatibleBitmap (hdc=0xa0107f7, cx=1, cy=1) returned 0x21050250 [0170.834] GetDIBits (in: hdc=0xa0107f7, hbm=0x21050250, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2add64, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2add64) returned 1 [0170.834] GetDIBits (in: hdc=0xa0107f7, hbm=0x21050250, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2add64, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2add64) returned 1 [0170.834] DeleteObject (ho=0x21050250) returned 1 [0170.834] CreateDIBSection (in: hdc=0xa0107f7, lpbmi=0x2addb4, usage=0x0, ppvBits=0x2ae2a8, hSection=0x0, offset=0x0 | out: ppvBits=0x2ae2a8) returned 0x140506b7 [0170.834] SelectObject (hdc=0x6a010289, h=0x140506b7) returned 0x185000f [0170.834] GdipCreateFromHDC (hdc=0x6a010289, graphics=0x2ae28c) returned 0x0 [0170.834] GdipTranslateWorldTransform (graphics=0x5a7bbb8, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0170.834] GdipSetClipRectI (graphics=0x5a7bbb8, x=0, y=0, width=354, height=81, combineMode=0x0) returned 0x0 [0170.834] GdipCreateMatrix (matrix=0x2ae314) returned 0x0 [0170.834] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.834] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2ae32c) returned 0x0 [0170.834] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.834] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.834] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.834] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.834] GdipCreateRegion (region=0x2ae314) returned 0x0 [0170.834] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.835] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae320) returned 0x0 [0170.835] GdipSaveGraphics (graphics=0x5a7bbb8, state=0x2ae34c) returned 0x0 [0170.835] GetWindowTextLengthW (hWnd=0x201b8) returned 248 [0170.835] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf8 [0170.835] GetSystemMetrics (nIndex=42) returned 0 [0170.835] GetWindowTextW (in: hWnd=0x201b8, lpString=0x2ae074, nMaxCount=249 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.") returned 248 [0170.835] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xd, wParam=0xf9, lParam=0x2ae074) returned 0xf8 [0170.835] GetClientRect (in: hWnd=0x201b8, lpRect=0x2ae314 | out: lpRect=0x2ae314) returned 1 [0170.835] GdipCreateRegion (region=0x2ae168) returned 0x0 [0170.835] GdipGetClip (graphics=0x5a7bbb8, region=0x1755318) returned 0x0 [0170.835] GdipCreateMatrix (matrix=0x2ae168) returned 0x0 [0170.835] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x5a7eb20) returned 0x0 [0170.835] GdipIsMatrixIdentity (matrix=0x5a7eb20, result=0x2ae180) returned 0x0 [0170.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.835] GdipGetMatrixElements (matrix=0x5a7eb20, matrixOut=0x3ec8648) returned 0x0 [0170.835] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.835] GdipCombineRegionRegion (region=0x1755318, region2=0x1790808, combineMode=0x1) returned 0x0 [0170.835] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.835] GdipGetMatrixElements (matrix=0x5a7eb20, matrixOut=0x3ec8648) returned 0x0 [0170.835] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.835] GdipDeleteMatrix (matrix=0x5a7eb20) returned 0x0 [0170.835] GdipIsInfiniteRegion (region=0x1755318, graphics=0x5a7bbb8, result=0x2ae1a8) returned 0x0 [0170.835] GdipIsInfiniteRegion (region=0x1755318, graphics=0x5a7bbb8, result=0x2ae198) returned 0x0 [0170.835] GdipGetRegionHRgn (region=0x1755318, graphics=0x5a7bbb8, hRgn=0x2ae198) returned 0x0 [0170.835] GdipDeleteRegion (region=0x1755318) returned 0x0 [0170.835] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae1b0) returned 0x0 [0170.835] GetCurrentObject (hdc=0x6a010289, type=0x1) returned 0x1b00017 [0170.835] GetCurrentObject (hdc=0x6a010289, type=0x2) returned 0x1900010 [0170.835] GetCurrentObject (hdc=0x6a010289, type=0x7) returned 0x140506b7 [0170.835] GetCurrentObject (hdc=0x6a010289, type=0x6) returned 0x18a002e [0170.835] SaveDC (hdc=0x6a010289) returned 1 [0170.836] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x58040288 [0170.836] GetClipRgn (hdc=0x6a010289, hrgn=0x58040288) returned 0 [0170.836] SelectClipRgn (hdc=0x6a010289, hrgn=0x3704022e) returned 2 [0170.836] DeleteObject (ho=0x58040288) returned 1 [0170.836] DeleteObject (ho=0x3704022e) returned 1 [0170.836] OffsetViewportOrgEx (in: hdc=0x6a010289, x=0, y=0, lppt=0x1e746d8 | out: lppt=0x1e746d8) returned 1 [0170.836] GetNearestColor (hdc=0x6a010289, color=0xf0f0f0) returned 0xf0f0f0 [0170.836] CreateSolidBrush (color=0xf0f0f0) returned 0x24100834 [0170.836] FillRect (hDC=0x6a010289, lprc=0x2ae1b4, hbr=0x24100834) returned 1 [0170.837] DeleteObject (ho=0x24100834) returned 1 [0170.837] RestoreDC (hdc=0x6a010289, nSavedDC=-1) returned 1 [0170.837] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x6a010289) returned 0x0 [0170.837] GdipRestoreGraphics (graphics=0x5a7bbb8, state=0xfdb20dbd) returned 0x0 [0170.837] GdipDeleteRegion (region=0x1790808) returned 0x0 [0170.837] GetWindowTextLengthW (hWnd=0x201b8) returned 248 [0170.837] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf8 [0170.837] GetSystemMetrics (nIndex=42) returned 0 [0170.837] GetWindowTextW (in: hWnd=0x201b8, lpString=0x2ae074, nMaxCount=249 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.") returned 248 [0170.837] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xd, wParam=0xf9, lParam=0x2ae074) returned 0xf8 [0170.837] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae1d0) returned 0x0 [0170.837] GetCurrentObject (hdc=0x6a010289, type=0x1) returned 0x1b00017 [0170.837] GetCurrentObject (hdc=0x6a010289, type=0x2) returned 0x1900010 [0170.837] GetCurrentObject (hdc=0x6a010289, type=0x7) returned 0x140506b7 [0170.837] GetCurrentObject (hdc=0x6a010289, type=0x6) returned 0x18a002e [0170.837] SaveDC (hdc=0x6a010289) returned 1 [0170.837] GetNearestColor (hdc=0x6a010289, color=0x0) returned 0x0 [0170.837] RestoreDC (hdc=0x6a010289, nSavedDC=-1) returned 1 [0170.837] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x6a010289) returned 0x0 [0170.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74360000 [0170.837] AdjustWindowRectEx (in: lpRect=0x2ae0f4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ae0f4) returned 1 [0170.837] GdipGetFamilyName (in: family=0x163f690, name=0x2adfe4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0170.844] GetDeviceCaps (hdc=0x21010238, index=90) returned 96 [0170.844] CoTaskMemAlloc (cb=0x5c) returned 0xbf978 [0170.844] CreateFontIndirectW (lplf=0xbf978) returned 0x50a0812 [0170.844] CoTaskMemFree (pv=0xbf978) [0170.844] GetObjectW (in: h=0x50a0812, c=92, pv=0x2adfbc | out: pv=0x2adfbc) returned 92 [0170.844] SelectObject (hdc=0x21010238, h=0x50a0812) returned 0x600a0230 [0170.844] GetMapMode (hdc=0x21010238) returned 1 [0170.844] GetTextMetricsW (in: hdc=0x21010238, lptm=0x2adfc8 | out: lptm=0x2adfc8) returned 1 [0170.845] DrawTextExW (in: hdc=0x21010238, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.", cchText=248, lprc=0x2ae0dc, format=0x102400, lpdtp=0x1e750ec | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.", lprc=0x2ae0dc) returned 52 [0170.845] GdipGetTextRenderingHint (graphics=0x5a7bbb8, mode=0x2ae170) returned 0x0 [0170.845] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae15c) returned 0x0 [0170.845] GetCurrentObject (hdc=0x6a010289, type=0x1) returned 0x1b00017 [0170.845] GetCurrentObject (hdc=0x6a010289, type=0x2) returned 0x1900010 [0170.845] GetCurrentObject (hdc=0x6a010289, type=0x7) returned 0x140506b7 [0170.845] GetCurrentObject (hdc=0x6a010289, type=0x6) returned 0x18a002e [0170.845] SaveDC (hdc=0x6a010289) returned 1 [0170.846] GetTextAlign (hdc=0x6a010289) returned 0x0 [0170.846] GetTextColor (hdc=0x6a010289) returned 0x0 [0170.846] GetCurrentObject (hdc=0x6a010289, type=0x6) returned 0x18a002e [0170.846] GetObjectW (in: h=0x18a002e, c=92, pv=0x2ade64 | out: pv=0x2ade64) returned 92 [0170.846] SelectObject (hdc=0x6a010289, h=0x50a0812) returned 0x18a002e [0170.846] GetBkMode (hdc=0x6a010289) returned 2 [0170.846] SetBkMode (hdc=0x6a010289, mode=1) returned 2 [0170.846] DrawTextExW (in: hdc=0x6a010289, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.", cchText=248, lprc=0x2ae0f0, format=0x102010, lpdtp=0x1e75304 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.", lprc=0x2ae0f0) returned 78 [0170.849] RestoreDC (hdc=0x6a010289, nSavedDC=-1) returned 1 [0170.849] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x6a010289) returned 0x0 [0170.849] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae30c) returned 0x0 [0170.849] BitBlt (hdc=0xa0107f7, x=0, y=0, cx=354, cy=81, hdcSrc=0x6a010289, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.849] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x6a010289) returned 0x0 [0170.849] SelectPalette (hdc=0xa0107f7, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.849] SelectObject (hdc=0x6a010289, h=0x185000f) returned 0x140506b7 [0170.849] DeleteDC (hdc=0x6a010289) returned 1 [0170.849] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.849] DeleteObject (ho=0x140506b7) returned 1 [0170.850] EndPaint (hWnd=0x201b8, lpPaint=0x2ae2b0) returned 1 [0170.850] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.850] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x84, wParam=0x0, lParam=0x1e302ff) returned 0x1 [0170.850] IsWindowUnicode (hWnd=0x201b0) returned 1 [0170.850] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.850] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x84, wParam=0x0, lParam=0x1e302ff) returned 0x1 [0170.850] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0170.851] SetCursor (hCursor=0x10003) returned 0x10007 [0170.851] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.851] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.855] _TrackMouseEvent (in: lpEventTrack=0x1e7535c | out: lpEventTrack=0x1e7535c) returned 1 [0170.855] SendMessageW (hWnd=0x201b0, Msg=0xc106, wParam=0x0, lParam=0x0) returned 0x0 [0170.855] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0xc106, wParam=0x0, lParam=0x0) returned 0x0 [0170.856] InvalidateRect (hWnd=0x201b0, lpRect=0x0, bErase=0) returned 1 [0170.861] GetKeyState (nVirtKey=2) returned 0 [0170.861] GetKeyState (nVirtKey=4) returned 0 [0170.861] GetKeyState (nVirtKey=5) returned 0 [0170.861] GetKeyState (nVirtKey=6) returned 0 [0170.861] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.861] IsWindowUnicode (hWnd=0x201ae) returned 1 [0170.861] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.861] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.861] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.862] BeginPaint (in: hWnd=0x201ae, lpPaint=0x2ae2a8 | out: lpPaint=0x2ae2a8) returned 0xa0107f7 [0170.862] SelectPalette (hdc=0xa0107f7, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.862] CreateCompatibleDC (hdc=0xa0107f7) returned 0x170106b7 [0170.862] DeleteObject (ho=0x26050820) returned 1 [0170.862] GetObjectType (h=0xa0107f7) returned 0x3 [0170.862] CreateCompatibleBitmap (hdc=0xa0107f7, cx=1, cy=1) returned 0x35050840 [0170.862] GetDIBits (in: hdc=0xa0107f7, hbm=0x35050840, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2add98, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2add98) returned 1 [0170.862] GetDIBits (in: hdc=0xa0107f7, hbm=0x35050840, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2add98, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2add98) returned 1 [0170.862] DeleteObject (ho=0x35050840) returned 1 [0170.862] CreateDIBSection (in: hdc=0xa0107f7, lpbmi=0x2adde8, usage=0x0, ppvBits=0x2ae2dc, hSection=0x0, offset=0x0 | out: ppvBits=0x2ae2dc) returned 0x27050820 [0170.862] SelectObject (hdc=0x170106b7, h=0x27050820) returned 0x185000f [0170.862] GdipCreateFromHDC (hdc=0x170106b7, graphics=0x2ae2c0) returned 0x0 [0170.862] GdipTranslateWorldTransform (graphics=0x5a7bbb8, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0170.862] GdipSetClipRectI (graphics=0x5a7bbb8, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0 [0170.862] GdipCreateMatrix (matrix=0x2ae308) returned 0x0 [0170.863] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.863] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2ae320) returned 0x0 [0170.863] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.863] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.863] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.863] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.863] GdipCreateRegion (region=0x2ae308) returned 0x0 [0170.863] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.863] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae314) returned 0x0 [0170.863] GdipSaveGraphics (graphics=0x5a7bbb8, state=0x2ae340) returned 0x0 [0170.863] GdipRestoreGraphics (graphics=0x5a7bbb8, state=0xfdb00dbd) returned 0x0 [0170.863] GdipDeleteRegion (region=0x1790808) returned 0x0 [0170.863] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x2ae1c4, fWinIni=0x0 | out: pvParam=0x2ae1c4) returned 1 [0170.863] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae12c) returned 0x0 [0170.864] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.864] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.864] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.864] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.864] SaveDC (hdc=0x170106b7) returned 1 [0170.864] GetNearestColor (hdc=0x170106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.864] GetNearestColor (hdc=0x170106b7, color=0xa0a0a0) returned 0xa0a0a0 [0170.864] GetNearestColor (hdc=0x170106b7, color=0x696969) returned 0x696969 [0170.864] GetNearestColor (hdc=0x170106b7, color=0xa0a0a0) returned 0xa0a0a0 [0170.864] GetNearestColor (hdc=0x170106b7, color=0x0) returned 0x0 [0170.864] GetNearestColor (hdc=0x170106b7, color=0xffffff) returned 0xffffff [0170.864] GetNearestColor (hdc=0x170106b7, color=0xe5e5e5) returned 0xe5e5e5 [0170.864] GetNearestColor (hdc=0x170106b7, color=0xd7d7d7) returned 0xd7d7d7 [0170.864] GetNearestColor (hdc=0x170106b7, color=0x0) returned 0x0 [0170.864] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.864] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x170106b7) returned 0x0 [0170.865] IsAppThemed () returned 0x1 [0170.865] GetThemeAppProperties () returned 0x3 [0170.865] GetThemeAppProperties () returned 0x3 [0170.865] OpenThemeData () returned 0x30002 [0170.865] GdipGetImageWidth (image=0x5a7b888, width=0x2ae1c0) returned 0x0 [0170.865] GdipGetImageHeight (image=0x5a7b888, height=0x2ae1c0) returned 0x0 [0170.865] IsAppThemed () returned 0x1 [0170.865] GetThemeAppProperties () returned 0x3 [0170.865] GetThemeAppProperties () returned 0x3 [0170.866] DrawTextExW (in: hdc=0x21010238, lpchText="&Details", cchText=8, lprc=0x2adfe8, format=0x102415, lpdtp=0x1e76dc4 | out: lpchText="&Details", lprc=0x2adfe8) returned 13 [0170.866] IsAppThemed () returned 0x1 [0170.866] GetThemeAppProperties () returned 0x3 [0170.866] GetThemeAppProperties () returned 0x3 [0170.866] IsAppThemed () returned 0x1 [0170.866] GetThemeAppProperties () returned 0x3 [0170.866] GetThemeAppProperties () returned 0x3 [0170.866] GetFocus () returned 0x201ae [0170.867] IsAppThemed () returned 0x1 [0170.867] GetThemeAppProperties () returned 0x3 [0170.867] GetThemeAppProperties () returned 0x3 [0170.867] IsAppThemed () returned 0x1 [0170.867] GetThemeAppProperties () returned 0x3 [0170.867] GetThemeAppProperties () returned 0x3 [0170.867] IsThemePartDefined () returned 0x1 [0170.867] IsAppThemed () returned 0x1 [0170.867] GetThemeAppProperties () returned 0x3 [0170.867] GetThemeAppProperties () returned 0x3 [0170.868] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0170.868] IsAppThemed () returned 0x1 [0170.868] GetThemeAppProperties () returned 0x3 [0170.868] GetThemeAppProperties () returned 0x3 [0170.868] IsAppThemed () returned 0x1 [0170.868] GetThemeAppProperties () returned 0x3 [0170.868] GetThemeAppProperties () returned 0x3 [0170.868] IsThemePartDefined () returned 0x1 [0170.868] GdipCreateRegion (region=0x2ae030) returned 0x0 [0170.868] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.868] GdipCreateMatrix (matrix=0x2ae030) returned 0x0 [0170.868] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.868] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2ae048) returned 0x0 [0170.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.868] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.868] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.868] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.868] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.868] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.868] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.868] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae070) returned 0x0 [0170.868] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae060) returned 0x0 [0170.868] GdipGetRegionHRgn (region=0x1790808, graphics=0x5a7bbb8, hRgn=0x2ae060) returned 0x0 [0170.868] GdipDeleteRegion (region=0x1790808) returned 0x0 [0170.868] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae078) returned 0x0 [0170.868] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.868] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.868] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.868] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.868] SaveDC (hdc=0x170106b7) returned 1 [0170.868] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3804022e [0170.868] GetClipRgn (hdc=0x170106b7, hrgn=0x3804022e) returned 0 [0170.869] SelectClipRgn (hdc=0x170106b7, hrgn=0x5c040288) returned 2 [0170.869] DeleteObject (ho=0x3804022e) returned 1 [0170.869] DeleteObject (ho=0x5c040288) returned 1 [0170.869] OffsetViewportOrgEx (in: hdc=0x170106b7, x=0, y=0, lppt=0x1e774a0 | out: lppt=0x1e774a0) returned 1 [0170.869] DrawThemeParentBackground () returned 0x0 [0170.869] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2addf4 | out: lpwndpl=0x2addf4) returned 1 [0170.869] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adda0 | out: lpRect=0x2adda0) returned 1 [0170.869] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.869] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.869] GetSystemMetrics (nIndex=42) returned 0 [0170.869] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adc44, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.869] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adc44) returned 0x18 [0170.869] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adca8 | out: lpRect=0x2adca8) returned 1 [0170.869] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.869] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.869] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.869] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.869] SaveDC (hdc=0x170106b7) returned 2 [0170.869] GetNearestColor (hdc=0x170106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.869] CreateSolidBrush (color=0xf0f0f0) returned 0x25100834 [0170.869] FillRect (hDC=0x170106b7, lprc=0x2adb48, hbr=0x25100834) returned 1 [0170.869] DeleteObject (ho=0x25100834) returned 1 [0170.870] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.870] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.870] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.870] GetSystemMetrics (nIndex=42) returned 0 [0170.870] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adbe4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.870] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adbe4) returned 0x18 [0170.870] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adc48 | out: lpRect=0x2adc48) returned 1 [0170.870] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.870] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.870] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.870] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.870] SaveDC (hdc=0x170106b7) returned 2 [0170.870] GetNearestColor (hdc=0x170106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.870] CreateSolidBrush (color=0xf0f0f0) returned 0x26100834 [0170.870] FillRect (hDC=0x170106b7, lprc=0x2adae8, hbr=0x26100834) returned 1 [0170.870] DeleteObject (ho=0x26100834) returned 1 [0170.870] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.870] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.870] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.870] GetSystemMetrics (nIndex=42) returned 0 [0170.870] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adbe4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.870] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adbe4) returned 0x18 [0170.870] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.870] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x170106b7) returned 0x0 [0170.870] IsAppThemed () returned 0x1 [0170.870] GetThemeAppProperties () returned 0x3 [0170.870] GetThemeAppProperties () returned 0x3 [0170.871] IsAppThemed () returned 0x1 [0170.871] GetThemeAppProperties () returned 0x3 [0170.871] GetThemeAppProperties () returned 0x3 [0170.871] IsThemePartDefined () returned 0x1 [0170.871] GdipCreateRegion (region=0x2adfd4) returned 0x0 [0170.871] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.871] GdipCreateMatrix (matrix=0x2adfd4) returned 0x0 [0170.871] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.871] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2adfec) returned 0x0 [0170.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.871] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.871] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.871] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.871] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.871] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.871] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.871] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae014) returned 0x0 [0170.871] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2ae004) returned 0x0 [0170.871] GdipGetRegionHRgn (region=0x1790808, graphics=0x5a7bbb8, hRgn=0x2ae004) returned 0x0 [0170.871] GdipDeleteRegion (region=0x1790808) returned 0x0 [0170.871] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae01c) returned 0x0 [0170.871] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.871] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.871] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.871] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.871] SaveDC (hdc=0x170106b7) returned 1 [0170.871] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d040288 [0170.871] GetClipRgn (hdc=0x170106b7, hrgn=0x5d040288) returned 0 [0170.871] SelectClipRgn (hdc=0x170106b7, hrgn=0x3a04022e) returned 2 [0170.871] DeleteObject (ho=0x5d040288) returned 1 [0170.871] DeleteObject (ho=0x3a04022e) returned 1 [0170.871] OffsetViewportOrgEx (in: hdc=0x170106b7, x=0, y=0, lppt=0x1e77e24 | out: lppt=0x1e77e24) returned 1 [0170.872] IsAppThemed () returned 0x1 [0170.872] GetThemeAppProperties () returned 0x3 [0170.872] GetThemeAppProperties () returned 0x3 [0170.872] DrawThemeBackground () returned 0x0 [0170.872] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.872] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x170106b7) returned 0x0 [0170.872] GdipCreateRegion (region=0x2adfbc) returned 0x0 [0170.872] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.872] GdipCreateMatrix (matrix=0x2adfbc) returned 0x0 [0170.872] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.872] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2adfd4) returned 0x0 [0170.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.872] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.872] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.872] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.872] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.872] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.872] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.872] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2adffc) returned 0x0 [0170.872] GdipIsInfiniteRegion (region=0x1790808, graphics=0x5a7bbb8, result=0x2adfec) returned 0x0 [0170.873] GdipGetRegionHRgn (region=0x1790808, graphics=0x5a7bbb8, hRgn=0x2adfec) returned 0x0 [0170.873] GdipDeleteRegion (region=0x1790808) returned 0x0 [0170.873] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae004) returned 0x0 [0170.873] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.873] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.873] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.874] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.874] SaveDC (hdc=0x170106b7) returned 1 [0170.874] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3b04022e [0170.874] GetClipRgn (hdc=0x170106b7, hrgn=0x3b04022e) returned 0 [0170.874] SelectClipRgn (hdc=0x170106b7, hrgn=0x5e040288) returned 2 [0170.874] DeleteObject (ho=0x3b04022e) returned 1 [0170.874] DeleteObject (ho=0x5e040288) returned 1 [0170.874] OffsetViewportOrgEx (in: hdc=0x170106b7, x=0, y=0, lppt=0x1e780f8 | out: lppt=0x1e780f8) returned 1 [0170.874] IsAppThemed () returned 0x1 [0170.874] GetThemeAppProperties () returned 0x3 [0170.874] GetThemeAppProperties () returned 0x3 [0170.874] GetThemeBackgroundContentRect () returned 0x0 [0170.874] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.874] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x170106b7) returned 0x0 [0170.884] GdipCreateRegion (region=0x2ae194) returned 0x0 [0170.884] GdipGetClip (graphics=0x5a7bbb8, region=0x1790808) returned 0x0 [0170.884] GdipCloneRegion (region=0x1790808, cloneRegion=0x2ae1a8) returned 0x0 [0170.884] GdipCombineRegionRectI (region=0x1755318, rect=0x2ae190, combineMode=0x1) returned 0x0 [0170.884] GdipCombineRegionRectI (region=0x1755318, rect=0x2ae190, combineMode=0x1) returned 0x0 [0170.885] GdipSetClipRegion (graphics=0x5a7bbb8, region=0x1755318, combineMode=0x0) returned 0x0 [0170.885] GdipGetImageWidth (image=0x5a7b888, width=0x2ae1a4) returned 0x0 [0170.885] GdipGetImageHeight (image=0x5a7b888, height=0x2ae1a0) returned 0x0 [0170.885] GdipDrawImageRectI (graphics=0x5a7bbb8, image=0x5a7b888, x=4, y=4, width=16, height=16) returned 0x0 [0170.885] GdipSetClipRegion (graphics=0x5a7bbb8, region=0x1790808, combineMode=0x0) returned 0x0 [0170.885] IsAppThemed () returned 0x1 [0170.885] GetThemeAppProperties () returned 0x3 [0170.885] GetThemeAppProperties () returned 0x3 [0170.885] GdipGetTextRenderingHint (graphics=0x5a7bbb8, mode=0x2ae134) returned 0x0 [0170.885] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae120) returned 0x0 [0170.885] GetCurrentObject (hdc=0x170106b7, type=0x1) returned 0x1b00017 [0170.885] GetCurrentObject (hdc=0x170106b7, type=0x2) returned 0x1900010 [0170.885] GetCurrentObject (hdc=0x170106b7, type=0x7) returned 0x27050820 [0170.885] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.885] SaveDC (hdc=0x170106b7) returned 1 [0170.885] GetTextAlign (hdc=0x170106b7) returned 0x0 [0170.886] GetTextColor (hdc=0x170106b7) returned 0x0 [0170.886] GetCurrentObject (hdc=0x170106b7, type=0x6) returned 0x18a002e [0170.886] GetObjectW (in: h=0x18a002e, c=92, pv=0x2ade28 | out: pv=0x2ade28) returned 92 [0170.886] SelectObject (hdc=0x170106b7, h=0x50a0812) returned 0x18a002e [0170.886] GetBkMode (hdc=0x170106b7) returned 2 [0170.886] SetBkMode (hdc=0x170106b7, mode=1) returned 2 [0170.886] DrawTextExW (in: hdc=0x170106b7, lpchText="&Details", cchText=8, lprc=0x2adefc, format=0x102415, lpdtp=0x1e784ac | out: lpchText="&Details", lprc=0x2adefc) returned 13 [0170.886] DrawTextExW (in: hdc=0x170106b7, lpchText="&Details", cchText=8, lprc=0x2ae0b4, format=0x102015, lpdtp=0x1e784ac | out: lpchText="&Details", lprc=0x2ae0b4) returned 13 [0170.886] RestoreDC (hdc=0x170106b7, nSavedDC=-1) returned 1 [0170.886] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x170106b7) returned 0x0 [0170.886] GetFocus () returned 0x201ae [0170.886] IsAppThemed () returned 0x1 [0170.886] GetThemeAppProperties () returned 0x3 [0170.886] GetThemeAppProperties () returned 0x3 [0170.886] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae300) returned 0x0 [0170.886] BitBlt (hdc=0xa0107f7, x=0, y=0, cx=100, cy=23, hdcSrc=0x170106b7, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.886] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x170106b7) returned 0x0 [0170.886] SelectPalette (hdc=0xa0107f7, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.886] SelectObject (hdc=0x170106b7, h=0x185000f) returned 0x27050820 [0170.886] DeleteDC (hdc=0x170106b7) returned 1 [0170.886] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.887] EndPaint (hWnd=0x201ae, lpPaint=0x2ae2a4) returned 1 [0170.887] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.887] IsWindowUnicode (hWnd=0x201b0) returned 1 [0170.887] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.887] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.887] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.887] BeginPaint (in: hWnd=0x201b0, lpPaint=0x2ae2a8 | out: lpPaint=0x2ae2a8) returned 0xa0107f7 [0170.887] SelectPalette (hdc=0xa0107f7, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.887] CreateCompatibleDC (hdc=0xa0107f7) returned 0x190106b7 [0170.887] SelectObject (hdc=0x190106b7, h=0x27050820) returned 0x185000f [0170.887] GdipCreateFromHDC (hdc=0x190106b7, graphics=0x2ae2c0) returned 0x0 [0170.887] GdipTranslateWorldTransform (graphics=0x5a7bbb8, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0170.887] GdipSetClipRectI (graphics=0x5a7bbb8, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0 [0170.887] GdipCreateMatrix (matrix=0x2ae308) returned 0x0 [0170.887] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.887] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2ae320) returned 0x0 [0170.887] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.887] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.887] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.887] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.887] GdipCreateRegion (region=0x2ae308) returned 0x0 [0170.887] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.887] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae314) returned 0x0 [0170.887] GdipSaveGraphics (graphics=0x5a7bbb8, state=0x2ae340) returned 0x0 [0170.887] GdipRestoreGraphics (graphics=0x5a7bbb8, state=0xfdae0dbd) returned 0x0 [0170.887] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.899] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae120) returned 0x0 [0170.899] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.899] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.899] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.899] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.899] SaveDC (hdc=0x190106b7) returned 1 [0170.899] GetNearestColor (hdc=0x190106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.899] GetNearestColor (hdc=0x190106b7, color=0xa0a0a0) returned 0xa0a0a0 [0170.899] GetNearestColor (hdc=0x190106b7, color=0x696969) returned 0x696969 [0170.899] GetNearestColor (hdc=0x190106b7, color=0xa0a0a0) returned 0xa0a0a0 [0170.899] GetNearestColor (hdc=0x190106b7, color=0x0) returned 0x0 [0170.899] GetNearestColor (hdc=0x190106b7, color=0xffffff) returned 0xffffff [0170.899] GetNearestColor (hdc=0x190106b7, color=0xe5e5e5) returned 0xe5e5e5 [0170.899] GetNearestColor (hdc=0x190106b7, color=0xd7d7d7) returned 0xd7d7d7 [0170.899] GetNearestColor (hdc=0x190106b7, color=0x0) returned 0x0 [0170.899] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.899] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x190106b7) returned 0x0 [0170.899] IsAppThemed () returned 0x1 [0170.899] GetThemeAppProperties () returned 0x3 [0170.899] GetThemeAppProperties () returned 0x3 [0170.899] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2ae188, fWinIni=0x0 | out: pvParam=0x2ae188) returned 1 [0170.899] SendMessageW (hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0170.900] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] DrawTextExW (in: hdc=0x21010238, lpchText="&Continue", cchText=9, lprc=0x2adfdc, format=0x102415, lpdtp=0x1e78ca4 | out: lpchText="&Continue", lprc=0x2adfdc) returned 13 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsThemePartDefined () returned 0x1 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsAppThemed () returned 0x1 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] GetThemeAppProperties () returned 0x3 [0170.900] IsThemePartDefined () returned 0x1 [0170.900] GdipCreateRegion (region=0x2ae024) returned 0x0 [0170.900] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.900] GdipCreateMatrix (matrix=0x2ae024) returned 0x0 [0170.900] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.900] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2ae03c) returned 0x0 [0170.900] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.900] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.900] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.900] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.901] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.901] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.901] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.901] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae064) returned 0x0 [0170.901] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae054) returned 0x0 [0170.901] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2ae054) returned 0x0 [0170.901] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.901] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae06c) returned 0x0 [0170.901] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.901] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.901] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.901] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.901] SaveDC (hdc=0x190106b7) returned 1 [0170.901] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5f040288 [0170.901] GetClipRgn (hdc=0x190106b7, hrgn=0x5f040288) returned 0 [0170.901] SelectClipRgn (hdc=0x190106b7, hrgn=0x3f04022e) returned 2 [0170.901] DeleteObject (ho=0x5f040288) returned 1 [0170.901] DeleteObject (ho=0x3f04022e) returned 1 [0170.901] OffsetViewportOrgEx (in: hdc=0x190106b7, x=0, y=0, lppt=0x1e79354 | out: lppt=0x1e79354) returned 1 [0170.901] DrawThemeParentBackground () returned 0x0 [0170.901] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2adde8 | out: lpwndpl=0x2adde8) returned 1 [0170.901] GetClientRect (in: hWnd=0x201b2, lpRect=0x2add94 | out: lpRect=0x2add94) returned 1 [0170.901] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.901] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.901] GetSystemMetrics (nIndex=42) returned 0 [0170.901] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adc38, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.901] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adc38) returned 0x18 [0170.901] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adc9c | out: lpRect=0x2adc9c) returned 1 [0170.901] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.901] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.902] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.902] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.902] SaveDC (hdc=0x190106b7) returned 2 [0170.902] GetNearestColor (hdc=0x190106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.902] CreateSolidBrush (color=0xf0f0f0) returned 0x27100834 [0170.902] FillRect (hDC=0x190106b7, lprc=0x2adb3c, hbr=0x27100834) returned 1 [0170.902] DeleteObject (ho=0x27100834) returned 1 [0170.902] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.902] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.902] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.902] GetSystemMetrics (nIndex=42) returned 0 [0170.902] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adbd8, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.902] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adbd8) returned 0x18 [0170.902] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adc3c | out: lpRect=0x2adc3c) returned 1 [0170.902] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.902] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.902] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.902] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.902] SaveDC (hdc=0x190106b7) returned 2 [0170.902] GetNearestColor (hdc=0x190106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.902] CreateSolidBrush (color=0xf0f0f0) returned 0x28100834 [0170.902] FillRect (hDC=0x190106b7, lprc=0x2adadc, hbr=0x28100834) returned 1 [0170.902] DeleteObject (ho=0x28100834) returned 1 [0170.902] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.902] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.902] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.903] GetSystemMetrics (nIndex=42) returned 0 [0170.903] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adbd8, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.903] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adbd8) returned 0x18 [0170.903] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.903] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x190106b7) returned 0x0 [0170.903] IsAppThemed () returned 0x1 [0170.903] GetThemeAppProperties () returned 0x3 [0170.903] GetThemeAppProperties () returned 0x3 [0170.903] IsAppThemed () returned 0x1 [0170.903] GetThemeAppProperties () returned 0x3 [0170.903] GetThemeAppProperties () returned 0x3 [0170.903] IsThemePartDefined () returned 0x1 [0170.903] GdipCreateRegion (region=0x2adfc8) returned 0x0 [0170.903] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.903] GdipCreateMatrix (matrix=0x2adfc8) returned 0x0 [0170.903] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.903] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2adfe0) returned 0x0 [0170.903] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.903] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.903] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.903] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.903] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.903] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.903] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.903] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae008) returned 0x0 [0170.903] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2adff8) returned 0x0 [0170.903] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2adff8) returned 0x0 [0170.903] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.903] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae010) returned 0x0 [0170.903] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.903] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.903] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.904] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.904] SaveDC (hdc=0x190106b7) returned 1 [0170.904] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4004022e [0170.904] GetClipRgn (hdc=0x190106b7, hrgn=0x4004022e) returned 0 [0170.904] SelectClipRgn (hdc=0x190106b7, hrgn=0x61040288) returned 2 [0170.904] DeleteObject (ho=0x4004022e) returned 1 [0170.904] DeleteObject (ho=0x61040288) returned 1 [0170.904] OffsetViewportOrgEx (in: hdc=0x190106b7, x=0, y=0, lppt=0x1e79cd8 | out: lppt=0x1e79cd8) returned 1 [0170.904] IsAppThemed () returned 0x1 [0170.904] GetThemeAppProperties () returned 0x3 [0170.904] GetThemeAppProperties () returned 0x3 [0170.904] DrawThemeBackground () returned 0x0 [0170.905] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.905] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x190106b7) returned 0x0 [0170.905] GdipCreateRegion (region=0x2adfb0) returned 0x0 [0170.905] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.905] GdipCreateMatrix (matrix=0x2adfb0) returned 0x0 [0170.905] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.905] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2adfc8) returned 0x0 [0170.905] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.905] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.905] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.905] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.905] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.905] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.905] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.905] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2adff0) returned 0x0 [0170.905] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2adfe0) returned 0x0 [0170.905] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2adfe0) returned 0x0 [0170.905] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.905] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2adff8) returned 0x0 [0170.905] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.905] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.905] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.905] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.905] SaveDC (hdc=0x190106b7) returned 1 [0170.905] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x62040288 [0170.905] GetClipRgn (hdc=0x190106b7, hrgn=0x62040288) returned 0 [0170.905] SelectClipRgn (hdc=0x190106b7, hrgn=0x4104022e) returned 2 [0170.905] DeleteObject (ho=0x62040288) returned 1 [0170.906] DeleteObject (ho=0x4104022e) returned 1 [0170.906] OffsetViewportOrgEx (in: hdc=0x190106b7, x=0, y=0, lppt=0x1e79fac | out: lppt=0x1e79fac) returned 1 [0170.906] IsAppThemed () returned 0x1 [0170.906] GetThemeAppProperties () returned 0x3 [0170.906] GetThemeAppProperties () returned 0x3 [0170.906] GetThemeBackgroundContentRect () returned 0x0 [0170.906] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.906] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x190106b7) returned 0x0 [0170.906] IsAppThemed () returned 0x1 [0170.906] GetThemeAppProperties () returned 0x3 [0170.906] GetThemeAppProperties () returned 0x3 [0170.906] GdipGetTextRenderingHint (graphics=0x5a7bbb8, mode=0x2ae128) returned 0x0 [0170.906] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae114) returned 0x0 [0170.906] GetCurrentObject (hdc=0x190106b7, type=0x1) returned 0x1b00017 [0170.906] GetCurrentObject (hdc=0x190106b7, type=0x2) returned 0x1900010 [0170.906] GetCurrentObject (hdc=0x190106b7, type=0x7) returned 0x27050820 [0170.906] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.906] SaveDC (hdc=0x190106b7) returned 1 [0170.906] GetTextAlign (hdc=0x190106b7) returned 0x0 [0170.906] GetTextColor (hdc=0x190106b7) returned 0x0 [0170.906] GetCurrentObject (hdc=0x190106b7, type=0x6) returned 0x18a002e [0170.906] GetObjectW (in: h=0x18a002e, c=92, pv=0x2ade1c | out: pv=0x2ade1c) returned 92 [0170.906] SelectObject (hdc=0x190106b7, h=0x50a0812) returned 0x18a002e [0170.906] GetBkMode (hdc=0x190106b7) returned 2 [0170.906] SetBkMode (hdc=0x190106b7, mode=1) returned 2 [0170.906] DrawTextExW (in: hdc=0x190106b7, lpchText="&Continue", cchText=9, lprc=0x2adef0, format=0x102415, lpdtp=0x1e7a340 | out: lpchText="&Continue", lprc=0x2adef0) returned 13 [0170.906] DrawTextExW (in: hdc=0x190106b7, lpchText="&Continue", cchText=9, lprc=0x2ae0a8, format=0x102015, lpdtp=0x1e7a340 | out: lpchText="&Continue", lprc=0x2ae0a8) returned 13 [0170.907] RestoreDC (hdc=0x190106b7, nSavedDC=-1) returned 1 [0170.907] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x190106b7) returned 0x0 [0170.907] GetFocus () returned 0x201ae [0170.907] IsAppThemed () returned 0x1 [0170.907] GetThemeAppProperties () returned 0x3 [0170.907] GetThemeAppProperties () returned 0x3 [0170.907] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae300) returned 0x0 [0170.907] BitBlt (hdc=0xa0107f7, x=0, y=0, cx=100, cy=23, hdcSrc=0x190106b7, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.907] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x190106b7) returned 0x0 [0170.907] SelectPalette (hdc=0xa0107f7, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.907] SelectObject (hdc=0x190106b7, h=0x185000f) returned 0x27050820 [0170.907] DeleteDC (hdc=0x190106b7) returned 1 [0170.907] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.907] EndPaint (hWnd=0x201b0, lpPaint=0x2ae2a4) returned 1 [0170.907] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.907] IsWindowUnicode (hWnd=0x201aa) returned 1 [0170.907] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.907] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.907] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.907] BeginPaint (in: hWnd=0x201aa, lpPaint=0x2ae2a8 | out: lpPaint=0x2ae2a8) returned 0xa0107f7 [0170.907] SelectPalette (hdc=0xa0107f7, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.907] CreateCompatibleDC (hdc=0xa0107f7) returned 0x1b0106b7 [0170.907] SelectObject (hdc=0x1b0106b7, h=0x27050820) returned 0x185000f [0170.907] GdipCreateFromHDC (hdc=0x1b0106b7, graphics=0x2ae2c0) returned 0x0 [0170.908] GdipTranslateWorldTransform (graphics=0x5a7bbb8, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0170.908] GdipSetClipRectI (graphics=0x5a7bbb8, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0 [0170.908] GdipCreateMatrix (matrix=0x2ae308) returned 0x0 [0170.908] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.908] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2ae320) returned 0x0 [0170.908] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.908] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.908] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.908] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.908] GdipCreateRegion (region=0x2ae308) returned 0x0 [0170.908] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.908] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae314) returned 0x0 [0170.908] GdipSaveGraphics (graphics=0x5a7bbb8, state=0x2ae340) returned 0x0 [0170.908] GdipRestoreGraphics (graphics=0x5a7bbb8, state=0xfdac0dbd) returned 0x0 [0170.908] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.908] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae12c) returned 0x0 [0170.908] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.908] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.908] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.908] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.908] SaveDC (hdc=0x1b0106b7) returned 1 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0xa0a0a0) returned 0xa0a0a0 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0x696969) returned 0x696969 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0xa0a0a0) returned 0xa0a0a0 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0x0) returned 0x0 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0xffffff) returned 0xffffff [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0xe5e5e5) returned 0xe5e5e5 [0170.908] GetNearestColor (hdc=0x1b0106b7, color=0xd7d7d7) returned 0xd7d7d7 [0170.909] GetNearestColor (hdc=0x1b0106b7, color=0x0) returned 0x0 [0170.909] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.909] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x1b0106b7) returned 0x0 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2ae194, fWinIni=0x0 | out: pvParam=0x2ae194) returned 1 [0170.909] SendMessageW (hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0170.909] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] DrawTextExW (in: hdc=0x21010238, lpchText="&Quit", cchText=5, lprc=0x2adfe8, format=0x102415, lpdtp=0x1e7ab38 | out: lpchText="&Quit", lprc=0x2adfe8) returned 13 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetFocus () returned 0x201ae [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] IsThemePartDefined () returned 0x1 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] IsAppThemed () returned 0x1 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] GetThemeAppProperties () returned 0x3 [0170.909] IsThemePartDefined () returned 0x1 [0170.909] GdipCreateRegion (region=0x2ae030) returned 0x0 [0170.909] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.910] GdipCreateMatrix (matrix=0x2ae030) returned 0x0 [0170.910] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.910] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2ae048) returned 0x0 [0170.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.910] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.910] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.910] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.910] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.910] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.910] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.910] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae070) returned 0x0 [0170.910] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae060) returned 0x0 [0170.910] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2ae060) returned 0x0 [0170.910] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.910] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae078) returned 0x0 [0170.910] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.910] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.910] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.910] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.910] SaveDC (hdc=0x1b0106b7) returned 1 [0170.910] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4204022e [0170.910] GetClipRgn (hdc=0x1b0106b7, hrgn=0x4204022e) returned 0 [0170.910] SelectClipRgn (hdc=0x1b0106b7, hrgn=0x66040288) returned 2 [0170.910] DeleteObject (ho=0x4204022e) returned 1 [0170.910] DeleteObject (ho=0x66040288) returned 1 [0170.910] OffsetViewportOrgEx (in: hdc=0x1b0106b7, x=0, y=0, lppt=0x1e7b1e8 | out: lppt=0x1e7b1e8) returned 1 [0170.910] DrawThemeParentBackground () returned 0x0 [0170.910] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2addf4 | out: lpwndpl=0x2addf4) returned 1 [0170.910] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adda0 | out: lpRect=0x2adda0) returned 1 [0170.910] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.911] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.911] GetSystemMetrics (nIndex=42) returned 0 [0170.911] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adc44, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.911] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adc44) returned 0x18 [0170.911] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adca8 | out: lpRect=0x2adca8) returned 1 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.911] SaveDC (hdc=0x1b0106b7) returned 2 [0170.911] GetNearestColor (hdc=0x1b0106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.911] CreateSolidBrush (color=0xf0f0f0) returned 0x29100834 [0170.911] FillRect (hDC=0x1b0106b7, lprc=0x2adb48, hbr=0x29100834) returned 1 [0170.911] DeleteObject (ho=0x29100834) returned 1 [0170.911] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.911] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.911] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.911] GetSystemMetrics (nIndex=42) returned 0 [0170.911] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adbe4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.911] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adbe4) returned 0x18 [0170.911] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adc48 | out: lpRect=0x2adc48) returned 1 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.911] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.911] SaveDC (hdc=0x1b0106b7) returned 2 [0170.911] GetNearestColor (hdc=0x1b0106b7, color=0xf0f0f0) returned 0xf0f0f0 [0170.911] CreateSolidBrush (color=0xf0f0f0) returned 0x2a100834 [0170.912] FillRect (hDC=0x1b0106b7, lprc=0x2adae8, hbr=0x2a100834) returned 1 [0170.912] DeleteObject (ho=0x2a100834) returned 1 [0170.912] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.912] GetWindowTextLengthW (hWnd=0x201b2) returned 24 [0170.912] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0170.912] GetSystemMetrics (nIndex=42) returned 0 [0170.912] GetWindowTextW (in: hWnd=0x201b2, lpString=0x2adbe4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0170.912] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2adbe4) returned 0x18 [0170.912] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.912] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x1b0106b7) returned 0x0 [0170.912] IsAppThemed () returned 0x1 [0170.912] GetThemeAppProperties () returned 0x3 [0170.912] GetThemeAppProperties () returned 0x3 [0170.912] IsAppThemed () returned 0x1 [0170.912] GetThemeAppProperties () returned 0x3 [0170.912] GetThemeAppProperties () returned 0x3 [0170.912] IsThemePartDefined () returned 0x1 [0170.912] GdipCreateRegion (region=0x2adfd4) returned 0x0 [0170.912] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.912] GdipCreateMatrix (matrix=0x2adfd4) returned 0x0 [0170.912] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0170.912] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2adfec) returned 0x0 [0170.912] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.912] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.912] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.912] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.912] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0170.912] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.912] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0170.912] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae014) returned 0x0 [0170.912] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae004) returned 0x0 [0170.913] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2ae004) returned 0x0 [0170.913] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.913] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae01c) returned 0x0 [0170.913] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.913] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.913] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.913] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.913] SaveDC (hdc=0x1b0106b7) returned 1 [0170.913] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x67040288 [0170.913] GetClipRgn (hdc=0x1b0106b7, hrgn=0x67040288) returned 0 [0170.913] SelectClipRgn (hdc=0x1b0106b7, hrgn=0x4404022e) returned 2 [0170.913] DeleteObject (ho=0x67040288) returned 1 [0170.913] DeleteObject (ho=0x4404022e) returned 1 [0170.913] OffsetViewportOrgEx (in: hdc=0x1b0106b7, x=0, y=0, lppt=0x1e7bb6c | out: lppt=0x1e7bb6c) returned 1 [0170.913] IsAppThemed () returned 0x1 [0170.913] GetThemeAppProperties () returned 0x3 [0170.913] GetThemeAppProperties () returned 0x3 [0170.913] DrawThemeBackground () returned 0x0 [0170.913] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.913] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x1b0106b7) returned 0x0 [0170.913] GdipCreateRegion (region=0x2adfbc) returned 0x0 [0170.913] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0170.913] GdipCreateMatrix (matrix=0x2adfbc) returned 0x0 [0170.913] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0170.913] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2adfd4) returned 0x0 [0170.913] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.913] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.913] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.913] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0170.914] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0170.914] LocalFree (hMem=0x3ec8648) returned 0x0 [0170.914] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0170.914] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2adffc) returned 0x0 [0170.914] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2adfec) returned 0x0 [0170.914] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2adfec) returned 0x0 [0170.914] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0170.914] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae004) returned 0x0 [0170.914] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.914] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.914] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.914] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.914] SaveDC (hdc=0x1b0106b7) returned 1 [0170.914] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x4504022e [0170.914] GetClipRgn (hdc=0x1b0106b7, hrgn=0x4504022e) returned 0 [0170.914] SelectClipRgn (hdc=0x1b0106b7, hrgn=0x68040288) returned 2 [0170.914] DeleteObject (ho=0x4504022e) returned 1 [0170.914] DeleteObject (ho=0x68040288) returned 1 [0170.914] OffsetViewportOrgEx (in: hdc=0x1b0106b7, x=0, y=0, lppt=0x1e7be40 | out: lppt=0x1e7be40) returned 1 [0170.914] IsAppThemed () returned 0x1 [0170.914] GetThemeAppProperties () returned 0x3 [0170.914] GetThemeAppProperties () returned 0x3 [0170.914] GetThemeBackgroundContentRect () returned 0x0 [0170.914] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.914] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x1b0106b7) returned 0x0 [0170.914] IsAppThemed () returned 0x1 [0170.914] GetThemeAppProperties () returned 0x3 [0170.914] GetThemeAppProperties () returned 0x3 [0170.914] GdipGetTextRenderingHint (graphics=0x5a7bbb8, mode=0x2ae134) returned 0x0 [0170.914] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae120) returned 0x0 [0170.914] GetCurrentObject (hdc=0x1b0106b7, type=0x1) returned 0x1b00017 [0170.915] GetCurrentObject (hdc=0x1b0106b7, type=0x2) returned 0x1900010 [0170.915] GetCurrentObject (hdc=0x1b0106b7, type=0x7) returned 0x27050820 [0170.915] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.915] SaveDC (hdc=0x1b0106b7) returned 1 [0170.915] GetTextAlign (hdc=0x1b0106b7) returned 0x0 [0170.915] GetTextColor (hdc=0x1b0106b7) returned 0x0 [0170.915] GetCurrentObject (hdc=0x1b0106b7, type=0x6) returned 0x18a002e [0170.915] GetObjectW (in: h=0x18a002e, c=92, pv=0x2ade28 | out: pv=0x2ade28) returned 92 [0170.915] SelectObject (hdc=0x1b0106b7, h=0x50a0812) returned 0x18a002e [0170.915] GetBkMode (hdc=0x1b0106b7) returned 2 [0170.915] SetBkMode (hdc=0x1b0106b7, mode=1) returned 2 [0170.915] DrawTextExW (in: hdc=0x1b0106b7, lpchText="&Quit", cchText=5, lprc=0x2adefc, format=0x102415, lpdtp=0x1e7c1d4 | out: lpchText="&Quit", lprc=0x2adefc) returned 13 [0170.915] DrawTextExW (in: hdc=0x1b0106b7, lpchText="&Quit", cchText=5, lprc=0x2ae0b4, format=0x102015, lpdtp=0x1e7c1d4 | out: lpchText="&Quit", lprc=0x2ae0b4) returned 13 [0170.915] RestoreDC (hdc=0x1b0106b7, nSavedDC=-1) returned 1 [0170.915] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x1b0106b7) returned 0x0 [0170.915] GetFocus () returned 0x201ae [0170.915] IsAppThemed () returned 0x1 [0170.915] GetThemeAppProperties () returned 0x3 [0170.915] GetThemeAppProperties () returned 0x3 [0170.915] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae300) returned 0x0 [0170.915] BitBlt (hdc=0xa0107f7, x=0, y=0, cx=100, cy=23, hdcSrc=0x1b0106b7, x1=0, y1=0, rop=0xcc0020) returned 1 [0170.915] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x1b0106b7) returned 0x0 [0170.915] SelectPalette (hdc=0xa0107f7, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.916] SelectObject (hdc=0x1b0106b7, h=0x185000f) returned 0x27050820 [0170.916] DeleteDC (hdc=0x1b0106b7) returned 1 [0170.916] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0170.916] EndPaint (hWnd=0x201aa, lpPaint=0x2ae2a4) returned 1 [0170.916] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.916] IsWindowUnicode (hWnd=0x201c4) returned 1 [0170.916] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.916] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.916] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.916] BeginPaint (in: hWnd=0x201c4, lpPaint=0x2ae2d0 | out: lpPaint=0x2ae2d0) returned 0x3010800 [0170.916] SelectPalette (hdc=0x3010800, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0170.916] GetWindowTextLengthW (hWnd=0x201c4) returned 19 [0170.916] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0170.916] GetSystemMetrics (nIndex=42) returned 0 [0170.916] GetWindowTextW (in: hWnd=0x201c4, lpString=0x2ae250, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0170.916] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xd, wParam=0x14, lParam=0x2ae250) returned 0x13 [0170.916] SelectPalette (hdc=0x3010800, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0170.916] EndPaint (hWnd=0x201c4, lpPaint=0x2ae2cc) returned 1 [0170.916] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 0 [0170.916] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 0 [0170.951] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.951] IsWindowUnicode (hWnd=0x201b0) returned 1 [0170.951] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.951] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.951] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.951] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.951] IsWindowUnicode (hWnd=0x201b0) returned 1 [0170.951] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0170.951] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0170.951] DispatchMessageW (lpMsg=0x2ae7a8) returned 0x0 [0170.951] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x2a1, wParam=0x0, lParam=0x40029) returned 0x0 [0170.951] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 0 [0170.951] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 0 [0170.951] WaitMessage () returned 1 [0171.086] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0171.223] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0171.223] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0171.223] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0171.223] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x46, wParam=0x0, lParam=0x2ae694) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x46, wParam=0x0, lParam=0x2ae694) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x46, wParam=0x0, lParam=0x2ae694) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x47, wParam=0x0, lParam=0x2ae694) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0xd, wParam=0x104, lParam=0x3fff2e8) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x83, wParam=0x1, lParam=0x2ae290) returned 0x0 [0171.224] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x84, wParam=0x0, lParam=0x1e302ff) returned 0x1 [0171.224] IsWindowUnicode (hWnd=0x201b0) returned 1 [0171.224] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0171.224] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x84, wParam=0x0, lParam=0x1e302ff) returned 0x1 [0171.225] GetDlgItem (hDlg=0x201b2, nIDDlgItem=0) returned 0x0 [0171.225] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x210, wParam=0x201, lParam=0x6f010a) returned 0x0 [0171.225] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x21, wParam=0x201b2, lParam=0x2010001) returned 0x1 [0171.225] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x21, wParam=0x201b2, lParam=0x2010001) returned 0x1 [0171.225] SetCursor (hCursor=0x10003) returned 0x10003 [0171.225] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0171.225] DispatchMessageW (lpMsg=0x2ae7a8) [0171.225] GetKeyState (nVirtKey=1) returned -127 [0171.225] GetKeyState (nVirtKey=2) returned 0 [0171.225] GetKeyState (nVirtKey=4) returned 0 [0171.225] GetKeyState (nVirtKey=5) returned 0 [0171.225] GetKeyState (nVirtKey=6) returned 0 [0171.225] IsWindowVisible (hWnd=0x201b0) returned 1 [0171.225] IsWindowEnabled (hWnd=0x201b0) returned 1 [0171.225] SetFocus (hWnd=0x201b0) returned 0x201ae [0171.227] GetFocus () returned 0x201b0 [0171.227] IsChild (hWndParent=0x201b2, hWnd=0x201b0) returned 1 [0171.227] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x8, wParam=0x201b0, lParam=0x0) returned 0x0 [0171.227] GetCapture () returned 0x0 [0171.227] InvalidateRect (hWnd=0x201ae, lpRect=0x0, bErase=0) returned 1 [0171.227] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0171.227] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0171.228] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.229] InvalidateRect (hWnd=0x201ae, lpRect=0x0, bErase=0) returned 1 [0171.229] InvalidateRect (hWnd=0x201b0, lpRect=0x0, bErase=0) returned 1 [0171.229] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x7, wParam=0x201ae, lParam=0x0) returned 0x0 [0171.229] GetStockObject (i=5) returned 0x1900015 [0171.229] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0171.229] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0xd, wParam=0xa, lParam=0x3edfbc8) returned 0x9 [0171.229] GetDlgItem (hDlg=0x201b2, nIDDlgItem=131504) returned 0x201b0 [0171.229] SendMessageW (hWnd=0x201b0, Msg=0x202b, wParam=0x201b0, lParam=0x2adf34) returned 0x0 [0171.229] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x202b, wParam=0x201b0, lParam=0x2adf34) returned 0x0 [0171.229] InvalidateRect (hWnd=0x201b0, lpRect=0x0, bErase=0) returned 1 [0171.229] GetFocus () returned 0x201b0 [0171.229] GetFocus () returned 0x201b0 [0171.229] GetFocus () returned 0x201b0 [0171.229] GetKeyState (nVirtKey=1) returned -127 [0171.229] GetKeyState (nVirtKey=2) returned 0 [0171.229] GetKeyState (nVirtKey=4) returned 0 [0171.229] GetKeyState (nVirtKey=5) returned 0 [0171.229] GetKeyState (nVirtKey=6) returned 0 [0171.229] GetCapture () returned 0x0 [0171.230] SetCapture (hWnd=0x201b0) returned 0x0 [0171.230] GetKeyState (nVirtKey=1) returned -127 [0171.230] GetKeyState (nVirtKey=2) returned 0 [0171.230] GetKeyState (nVirtKey=4) returned 0 [0171.230] GetKeyState (nVirtKey=5) returned 0 [0171.230] GetKeyState (nVirtKey=6) returned 0 [0171.230] NotifyWinEvent (event=0x800a, hwnd=0x201b0, idObject=-4, idChild=0) [0171.230] InvalidateRect (hWnd=0x201b0, lpRect=0x2ae450, bErase=0) returned 1 [0171.230] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0171.230] GetMessageA (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0171.230] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0171.230] DispatchMessageA (lpMsg=0x2ae7a8) returned 0x0 [0171.230] PeekMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0171.230] IsWindowUnicode (hWnd=0x201b0) returned 1 [0171.230] GetMessageW (in: lpMsg=0x2ae7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ae7a8) returned 1 [0171.230] TranslateMessage (lpMsg=0x2ae7a8) returned 0 [0171.230] DispatchMessageW (lpMsg=0x2ae7a8) [0171.284] MapWindowPoints (in: hWndFrom=0x201b0, hWndTo=0x0, lpPoints=0x1e7c4f8, cPoints=0x1 | out: lpPoints=0x1e7c4f8) returned 31392470 [0171.285] NotifyWinEvent (event=0x800a, hwnd=0x201b0, idObject=-4, idChild=0) [0171.285] InvalidateRect (hWnd=0x201b0, lpRect=0x2ae3f4, bErase=0) returned 1 [0171.285] UpdateWindow (hWnd=0x201b0) [0171.285] BeginPaint (in: hWnd=0x201b0, lpPaint=0x2adfb8 | out: lpPaint=0x2adfb8) returned 0xa0107f7 [0171.285] SelectPalette (hdc=0xa0107f7, hPal=0x5f080826, bForceBkgd=1) returned 0x188000b [0171.285] CreateCompatibleDC (hdc=0xa0107f7) returned 0x2001025b [0171.285] SelectObject (hdc=0x2001025b, h=0x27050820) returned 0x185000f [0171.285] GdipCreateFromHDC (hdc=0x2001025b, graphics=0x2adfd0) returned 0x0 [0171.286] GdipTranslateWorldTransform (graphics=0x5a7bbb8, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0171.286] GdipSetClipRectI (graphics=0x5a7bbb8, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0 [0171.286] GdipCreateMatrix (matrix=0x2ae018) returned 0x0 [0171.286] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0171.286] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2ae030) returned 0x0 [0171.286] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.286] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0171.286] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.286] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0171.286] GdipCreateRegion (region=0x2ae018) returned 0x0 [0171.286] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0171.286] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2ae024) returned 0x0 [0171.286] GdipSaveGraphics (graphics=0x5a7bbb8, state=0x2ae050) returned 0x0 [0171.286] GdipRestoreGraphics (graphics=0x5a7bbb8, state=0xfdaa0dbd) returned 0x0 [0171.286] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0171.286] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ade30) returned 0x0 [0171.286] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.286] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.286] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.286] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.286] SaveDC (hdc=0x2001025b) returned 1 [0171.286] GetNearestColor (hdc=0x2001025b, color=0xf0f0f0) returned 0xf0f0f0 [0171.286] GetNearestColor (hdc=0x2001025b, color=0xa0a0a0) returned 0xa0a0a0 [0171.286] GetNearestColor (hdc=0x2001025b, color=0x696969) returned 0x696969 [0171.286] GetNearestColor (hdc=0x2001025b, color=0xa0a0a0) returned 0xa0a0a0 [0171.286] GetNearestColor (hdc=0x2001025b, color=0x0) returned 0x0 [0171.286] GetNearestColor (hdc=0x2001025b, color=0xffffff) returned 0xffffff [0171.286] GetNearestColor (hdc=0x2001025b, color=0xe5e5e5) returned 0xe5e5e5 [0171.287] GetNearestColor (hdc=0x2001025b, color=0xd7d7d7) returned 0xd7d7d7 [0171.287] GetNearestColor (hdc=0x2001025b, color=0x0) returned 0x0 [0171.287] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.287] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x2001025b) returned 0x0 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] DrawTextExW (in: hdc=0x21010238, lpchText="&Continue", cchText=9, lprc=0x2adcec, format=0x102415, lpdtp=0x1e7cc38 | out: lpchText="&Continue", lprc=0x2adcec) returned 13 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsThemePartDefined () returned 0x1 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsAppThemed () returned 0x1 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] GetThemeAppProperties () returned 0x3 [0171.287] IsThemePartDefined () returned 0x1 [0171.287] GdipCreateRegion (region=0x2add34) returned 0x0 [0171.287] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0171.287] GdipCreateMatrix (matrix=0x2add34) returned 0x0 [0171.288] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0171.288] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2add4c) returned 0x0 [0171.288] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.288] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0171.288] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.288] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.288] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0171.288] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.288] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0171.288] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2add74) returned 0x0 [0171.288] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2add64) returned 0x0 [0171.288] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2add64) returned 0x0 [0171.288] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0171.288] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2add7c) returned 0x0 [0171.288] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.288] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.288] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.288] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.288] SaveDC (hdc=0x2001025b) returned 1 [0171.288] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6a040288 [0171.288] GetClipRgn (hdc=0x2001025b, hrgn=0x6a040288) returned 0 [0171.288] SelectClipRgn (hdc=0x2001025b, hrgn=0x280406b7) returned 2 [0171.288] DeleteObject (ho=0x6a040288) returned 1 [0171.288] DeleteObject (ho=0x280406b7) returned 1 [0171.288] OffsetViewportOrgEx (in: hdc=0x2001025b, x=0, y=0, lppt=0x1e7d2e8 | out: lppt=0x1e7d2e8) returned 1 [0171.288] DrawThemeParentBackground () [0171.288] GetWindowPlacement (in: hWnd=0x201b2, lpwndpl=0x2adaf8 | out: lpwndpl=0x2adaf8) returned 1 [0171.289] GetClientRect (in: hWnd=0x201b2, lpRect=0x2adaa4 | out: lpRect=0x2adaa4) returned 1 [0171.289] GetWindowTextLengthW (hWnd=0x201b2) [0171.289] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0171.289] GetSystemMetrics (nIndex=42) returned 0 [0171.289] GetWindowTextW (hWnd=0x201b2, lpString=0x2ad948, nMaxCount=25) [0171.289] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ad948) returned 0x18 [0171.289] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ad9ac | out: lpRect=0x2ad9ac) returned 1 [0171.289] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.289] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.289] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.289] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.289] SaveDC (hdc=0x2001025b) returned 2 [0171.289] GetNearestColor (hdc=0x2001025b, color=0xf0f0f0) returned 0xf0f0f0 [0171.289] CreateSolidBrush (color=0xf0f0f0) returned 0x2b100834 [0171.289] FillRect (hDC=0x2001025b, lprc=0x2ad84c, hbr=0x2b100834) returned 1 [0171.289] DeleteObject (ho=0x2b100834) returned 1 [0171.289] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.289] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0171.289] GetSystemMetrics (nIndex=42) returned 0 [0171.289] GetWindowTextW (hWnd=0x201b2, lpString=0x2ad8e8, nMaxCount=25) [0171.289] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ad8e8) returned 0x18 [0171.289] GetClientRect (in: hWnd=0x201b2, lpRect=0x2ad94c | out: lpRect=0x2ad94c) returned 1 [0171.289] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.289] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.290] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.290] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.290] SaveDC (hdc=0x2001025b) returned 2 [0171.290] GetNearestColor (hdc=0x2001025b, color=0xf0f0f0) returned 0xf0f0f0 [0171.290] CreateSolidBrush (color=0xf0f0f0) returned 0x2c100834 [0171.290] FillRect (hDC=0x2001025b, lprc=0x2ad7ec, hbr=0x2c100834) returned 1 [0171.290] DeleteObject (ho=0x2c100834) returned 1 [0171.290] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.290] GetWindowTextLengthW (hWnd=0x201b2) [0171.290] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0171.290] GetSystemMetrics (nIndex=42) returned 0 [0171.290] GetWindowTextW (hWnd=0x201b2, lpString=0x2ad8e8, nMaxCount=25) [0171.290] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xd, wParam=0x19, lParam=0x2ad8e8) returned 0x18 [0171.290] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.290] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x2001025b) returned 0x0 [0171.290] IsAppThemed () returned 0x1 [0171.290] GetThemeAppProperties () returned 0x3 [0171.290] GetThemeAppProperties () returned 0x3 [0171.290] IsAppThemed () returned 0x1 [0171.290] GetThemeAppProperties () returned 0x3 [0171.290] GetThemeAppProperties () returned 0x3 [0171.290] IsThemePartDefined () returned 0x1 [0171.290] GdipCreateRegion (region=0x2adcd8) returned 0x0 [0171.290] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0171.290] GdipCreateMatrix (matrix=0x2adcd8) returned 0x0 [0171.290] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x17e2870) returned 0x0 [0171.291] GdipIsMatrixIdentity (matrix=0x17e2870, result=0x2adcf0) returned 0x0 [0171.291] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.291] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0171.291] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.291] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.291] GdipGetMatrixElements (matrix=0x17e2870, matrixOut=0x3ec8648) returned 0x0 [0171.291] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.291] GdipDeleteMatrix (matrix=0x17e2870) returned 0x0 [0171.291] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2add18) returned 0x0 [0171.291] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2add08) returned 0x0 [0171.291] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2add08) returned 0x0 [0171.291] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0171.291] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2add20) returned 0x0 [0171.291] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.291] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.291] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.291] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.291] SaveDC (hdc=0x2001025b) returned 1 [0171.291] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x290406b7 [0171.291] GetClipRgn (hdc=0x2001025b, hrgn=0x290406b7) returned 0 [0171.291] SelectClipRgn (hdc=0x2001025b, hrgn=0x6c040288) returned 2 [0171.291] DeleteObject (ho=0x290406b7) returned 1 [0171.291] DeleteObject (ho=0x6c040288) returned 1 [0171.291] OffsetViewportOrgEx (in: hdc=0x2001025b, x=0, y=0, lppt=0x1e7dc6c | out: lppt=0x1e7dc6c) returned 1 [0171.291] IsAppThemed () returned 0x1 [0171.292] GetThemeAppProperties () returned 0x3 [0171.292] GetThemeAppProperties () returned 0x3 [0171.292] DrawThemeBackground () returned 0x0 [0171.292] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.292] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x2001025b) returned 0x0 [0171.292] GdipCreateRegion (region=0x2adcc0) returned 0x0 [0171.292] GdipGetClip (graphics=0x5a7bbb8, region=0x178e0f0) returned 0x0 [0171.292] GdipCreateMatrix (matrix=0x2adcc0) returned 0x0 [0171.292] GdipGetWorldTransform (graphics=0x5a7bbb8, matrix=0x178eca8) returned 0x0 [0171.292] GdipIsMatrixIdentity (matrix=0x178eca8, result=0x2adcd8) returned 0x0 [0171.292] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.292] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0171.292] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.292] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x3ec8648 [0171.292] GdipGetMatrixElements (matrix=0x178eca8, matrixOut=0x3ec8648) returned 0x0 [0171.292] LocalFree (hMem=0x3ec8648) returned 0x0 [0171.292] GdipDeleteMatrix (matrix=0x178eca8) returned 0x0 [0171.292] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2add00) returned 0x0 [0171.292] GdipIsInfiniteRegion (region=0x178e0f0, graphics=0x5a7bbb8, result=0x2adcf0) returned 0x0 [0171.292] GdipGetRegionHRgn (region=0x178e0f0, graphics=0x5a7bbb8, hRgn=0x2adcf0) returned 0x0 [0171.292] GdipDeleteRegion (region=0x178e0f0) returned 0x0 [0171.292] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2add08) returned 0x0 [0171.292] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.292] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.292] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.292] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.292] SaveDC (hdc=0x2001025b) returned 1 [0171.292] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x6d040288 [0171.293] GetClipRgn (hdc=0x2001025b, hrgn=0x6d040288) returned 0 [0171.293] SelectClipRgn (hdc=0x2001025b, hrgn=0x2a0406b7) returned 2 [0171.293] DeleteObject (ho=0x6d040288) returned 1 [0171.293] DeleteObject (ho=0x2a0406b7) returned 1 [0171.293] OffsetViewportOrgEx (in: hdc=0x2001025b, x=0, y=0, lppt=0x1e7df40 | out: lppt=0x1e7df40) returned 1 [0171.293] IsAppThemed () returned 0x1 [0171.293] GetThemeAppProperties () returned 0x3 [0171.293] GetThemeAppProperties () returned 0x3 [0171.293] GetThemeBackgroundContentRect () returned 0x0 [0171.293] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.293] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x2001025b) returned 0x0 [0171.293] IsAppThemed () returned 0x1 [0171.293] GetThemeAppProperties () returned 0x3 [0171.293] GetThemeAppProperties () returned 0x3 [0171.293] GdipGetTextRenderingHint (graphics=0x5a7bbb8, mode=0x2ade38) returned 0x0 [0171.293] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ade24) returned 0x0 [0171.293] GetCurrentObject (hdc=0x2001025b, type=0x1) returned 0x1b00017 [0171.293] GetCurrentObject (hdc=0x2001025b, type=0x2) returned 0x1900010 [0171.293] GetCurrentObject (hdc=0x2001025b, type=0x7) returned 0x27050820 [0171.293] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.293] SaveDC (hdc=0x2001025b) returned 1 [0171.293] GetTextAlign (hdc=0x2001025b) returned 0x0 [0171.293] GetTextColor (hdc=0x2001025b) returned 0x0 [0171.293] GetCurrentObject (hdc=0x2001025b, type=0x6) returned 0x18a002e [0171.293] GetObjectW (in: h=0x18a002e, c=92, pv=0x2adb2c | out: pv=0x2adb2c) returned 92 [0171.293] SelectObject (hdc=0x2001025b, h=0x50a0812) returned 0x18a002e [0171.293] GetBkMode (hdc=0x2001025b) returned 2 [0171.293] SetBkMode (hdc=0x2001025b, mode=1) returned 2 [0171.294] DrawTextExW (in: hdc=0x2001025b, lpchText="&Continue", cchText=9, lprc=0x2adc00, format=0x102415, lpdtp=0x1e7e2d4 | out: lpchText="&Continue", lprc=0x2adc00) returned 13 [0171.294] DrawTextExW (in: hdc=0x2001025b, lpchText="&Continue", cchText=9, lprc=0x2addb8, format=0x102015, lpdtp=0x1e7e2d4 | out: lpchText="&Continue", lprc=0x2addb8) returned 13 [0171.294] RestoreDC (hdc=0x2001025b, nSavedDC=-1) returned 1 [0171.294] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x2001025b) returned 0x0 [0171.294] GetFocus () returned 0x201b0 [0171.294] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2adef0, fWinIni=0x0 | out: pvParam=0x2adef0) returned 1 [0171.294] SendMessageW (hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) [0171.294] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0171.294] IsAppThemed () returned 0x1 [0171.294] GetThemeAppProperties () returned 0x3 [0171.294] GetThemeAppProperties () returned 0x3 [0171.294] GdipGetDC (graphics=0x5a7bbb8, hdc=0x2ae010) returned 0x0 [0171.294] BitBlt (hdc=0xa0107f7, x=0, y=0, cx=100, cy=23, hdcSrc=0x2001025b, x1=0, y1=0, rop=0xcc0020) returned 1 [0171.294] GdipReleaseDC (graphics=0x5a7bbb8, hdc=0x2001025b) returned 0x0 [0171.294] SelectPalette (hdc=0xa0107f7, hPal=0x188000b, bForceBkgd=0) returned 0x5f080826 [0171.294] SelectObject (hdc=0x2001025b, h=0x185000f) returned 0x27050820 [0171.294] DeleteDC (hdc=0x2001025b) returned 1 [0171.294] GdipDeleteGraphics (graphics=0x5a7bbb8) returned 0x0 [0171.294] EndPaint (hWnd=0x201b0, lpPaint=0x2adfb4) returned 1 [0171.295] WindowFromPoint (Point=0x2ff) [0171.295] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x84, wParam=0x0, lParam=0x1e302ff) returned 0x1 [0171.296] ReleaseCapture () [0171.296] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0171.297] IsWindow (hWnd=0x201b2) returned 1 [0171.297] SetActiveWindow (hWnd=0x201b2) returned 0x201b2 [0171.297] IsWindow (hWnd=0x201b2) returned 1 [0171.297] SetFocus (hWnd=0x201b2) [0171.297] GetFocus () returned 0x201b2 [0171.297] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x8, wParam=0x201b2, lParam=0x0) returned 0x0 [0171.297] GetCapture () returned 0x0 [0171.297] InvalidateRect (hWnd=0x201b0, lpRect=0x0, bErase=0) returned 1 [0171.298] GetDlgItem (hDlg=0x201b2, nIDDlgItem=131504) returned 0x201b0 [0171.298] SendMessageW (hWnd=0x201b0, Msg=0x202b, wParam=0x201b0, lParam=0x2adf3c) [0171.298] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x202b, wParam=0x201b0, lParam=0x2adf3c) returned 0x0 [0171.300] GetWindowLongW (hWnd=0x201b2, nIndex=-20) returned 327945 [0171.300] DestroyWindow (hWnd=0x201b2) returned 1 [0171.300] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0171.317] GetWindowTextLengthW (hWnd=0x201b2) [0171.317] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0171.317] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.317] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.317] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.317] GetWindowTextLengthW (hWnd=0x201b8) returned 248 [0171.318] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf8 [0171.318] GetSystemMetrics (nIndex=42) returned 0 [0171.318] GetWindowTextW (in: hWnd=0x201b8, lpString=0x2ae204, nMaxCount=249 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nValue cannot be null.\r\nParameter name: input.") returned 248 [0171.318] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0xd, wParam=0xf9, lParam=0x2ae204) returned 0xf8 [0171.318] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.318] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.318] InvalidateRect (hWnd=0x201b0, lpRect=0x0, bErase=0) returned 1 [0171.318] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.318] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0171.318] SendMessageW (hWnd=0x201ac, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0171.318] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0171.318] SendMessageW (hWnd=0x201ac, Msg=0xb0, wParam=0x1e49a74, lParam=0x2ae4c4) returned 0x0 [0171.318] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0xb0, wParam=0x1e49a74, lParam=0x2ae4c4) returned 0x0 [0171.318] GetWindowTextLengthW (hWnd=0x201ac) returned 3509 [0171.318] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xdb5 [0171.318] GetSystemMetrics (nIndex=42) returned 0 [0171.318] CoTaskMemAlloc (cb=0x1b70) returned 0x3ed84a8 [0171.318] GetWindowTextW (in: hWnd=0x201ac, lpString=0x3ed84a8, nMaxCount=3510 | out: lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.ArgumentNullException: Value cannot be null.\r\nParameter name: input\r\n at System.IO.BinaryReader..ctor(Stream input, Encoding encoding, Boolean leaveOpen)\r\n at System.IO.BinaryReader..ctor(Stream input)\r\n at hidden_tear.Form1.Extract(String nameSpace, String outDirectory, String InternalFilePath, String resourceName)\r\n at hidden_tear.Form1.UpdateWallpaper()\r\n at hidden_tear.Form1.startAction()\r\n at hidden_tear.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nQinynore Ransomware\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/EEBsYm5/Desktop/Qinynore%20Ransomware.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.81.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 3509 [0171.318] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0xd, wParam=0xdb6, lParam=0x3ed84a8) returned 0xdb5 [0171.319] CoTaskMemFree (pv=0x3ed84a8) [0171.319] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0171.319] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b4, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.319] CallWindowProcW (lpPrevWndFunc=0x7437b8c9, hWnd=0x201b8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.319] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201ae, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.320] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201b0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.320] CallWindowProcW (lpPrevWndFunc=0x7438b495, hWnd=0x201aa, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.320] CallWindowProcW (lpPrevWndFunc=0x743699d0, hWnd=0x201ac, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.320] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.322] GetWindowTextLengthW (hWnd=0x201c4) returned 19 [0171.322] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x13 [0171.322] GetSystemMetrics (nIndex=42) returned 0 [0171.322] GetWindowTextW (in: hWnd=0x201c4, lpString=0x2aeac8, nMaxCount=20 | out: lpString="Qinynore Ransomware") returned 19 [0171.322] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0xd, wParam=0x14, lParam=0x2aeac8) returned 0x13 [0171.322] SetFocus (hWnd=0x201c4) [0171.322] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x46, wParam=0x0, lParam=0x2aec64) returned 0x0 [0171.322] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x46, wParam=0x0, lParam=0x2aec64) returned 0x0 [0171.322] GetWindowPlacement (in: hWnd=0x201c4, lpwndpl=0x2aea2c | out: lpwndpl=0x2aea2c) returned 1 [0171.322] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201c4, Msg=0x47, wParam=0x0, lParam=0x2aec64) returned 0x0 [0171.322] GetClientRect (in: hWnd=0x201c4, lpRect=0x2ae9dc | out: lpRect=0x2ae9dc) returned 1 [0171.322] GetWindowRect (in: hWnd=0x201c4, lpRect=0x2ae9dc | out: lpRect=0x2ae9dc) returned 1 [0171.323] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0x47, wParam=0x0, lParam=0x2aec64) returned 0x0 [0171.323] CallWindowProcW (lpPrevWndFunc=0x76b5507d, hWnd=0x201b6, Msg=0xd, wParam=0x104, lParam=0x3ffc790) returned 0x0 [0171.324] SetFocus (hWnd=0x201c4) [0171.324] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0171.324] GetKeyboardLayout (idThread=0x0) returned 0x4090409 Thread: id = 2 os_tid = 0x974 Thread: id = 3 os_tid = 0x978 [0027.392] CoGetContextToken (in: pToken=0x3a2f7bc | out: pToken=0x3a2f7bc) returned 0x800401f0 [0027.393] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 4 os_tid = 0x97c Thread: id = 5 os_tid = 0x988 Thread: id = 6 os_tid = 0x98c Thread: id = 7 os_tid = 0xa1c [0067.060] SleepEx (dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0090.291] CoGetContextToken (in: pToken=0x4a1fa6c | out: pToken=0x4a1fa6c) returned 0x0 [0090.291] CObjectContext::QueryInterface () returned 0x0 [0090.291] CObjectContext::GetCurrentThreadType () returned 0x0 [0090.291] Release () returned 0x0 Thread: id = 8 os_tid = 0xa50 Thread: id = 9 os_tid = 0xa54